Lab: Implement OAuth 2.0 Authorization Code Flow (Simulated)

#Coding the Delegation Chain#link

In this lab, you will build a mock implementation of the OAuth 2.0 Authorization Code flow. You will simulate the Client, the Authorization Server, and the Resource Server to see exactly how tokens move through the system.

Phase 1: The Authorization Request

The client must initiate the flow by redirecting the user to the server. You will craft this URL using the required parameters: `client_id`, `response_type`, `scope`, and `state`.

Phase 2: Exchanging the Code for a Token

Once the client receives the `code` via the redirect, it must exchange it for an access token using a secure back-channel POST request.

async function exchangeCodeForToken(code) {
  const response = await fetch('https://mock-auth.com/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'authorization_code',
      code: code,
      client_id: 'app_123',
      client_secret: 'SUPER_SECRET_KEY'
    })
  });
  return response.json();
}

The `client_secret` is the key here. Only a confidential client (one with a backend) can perform this exchange securely.

Phase 3: Accessing the Resource Server

Hardening the Lab

Now, try to break your implementation. Attempt to use a code that has already been used, or change the `state` parameter in the callback.

• ▪Verify that codes are one-time use only
• ▪Check that a missing state parameter results in an error
• ▪Test the behavior when the scope is changed mid-flow
• ▪Ensure the token expires after 3600 seconds