A
A
Alexiuscrow2015-10-14 18:09:03
Java
Alexiuscrow, 2015-10-14 18:09:03

How to implement OAuth2 authorization for clients with access code type?

There is a java project where it is necessary to implement oauth2 authorization for clients.
It was decided to use the access code grant type. The project uses Apache Oltu to implement oauth2 authorization.
To begin with, the client must request:

/oauth/authorize?response_type=code&client_id=CLIENT_ID&redirect_uri=CALLBACK_URL&scope=read
, where the user will have to confirm permission for the client to use all the listed scopes (in this case, read).
After the user clicks on the consent confirmation button, I plan to send a post request to the current uri (/oauth/authorize), where the passed parameters will be checked and, based on the result of the check, an access code will be sent to the user.
The problem is that in the post request some value should be transmitted, with the help of which it would be possible to check whether this post request was really sent after the user's consent (by pressing the confirm button) or whether it is just a "third-party" post request and access code should not be issued.
Are there other solutions to the problem?
Thank you.

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question