OAuth2: (Why) does exchanging authorization code for access token require authorization header?

0
votes

I'm reading RFC6749 defining OAuth2 and in section 4.1 (about the Authorization Code Grant) it seems to state that when a client is exchanging authorization code for access token, the request needs to include authorization header (see section 4.1.3 specifically).

  • Is it indeed required for all such requests or maybe I understand it wrong and it's only required for a subset of such requests? If so, what is the subset?
  • If it is required, then why? I thought that the authorization code is enough to prove that the client is authorized to get the token.

Thanks.

1
oauthoauth-2.0

1 Answers

2
votes

The answer comes from section 2.3 Client Authentication.

If the client type is confidential, the client and authorization server establish a client authentication method suitable for the security requirements of the authorization server. The authorization server MAY accept any form of client authentication meeting its security requirements.

Confidential clients are typically issued (or establish) a set of client credentials used for authenticating with the authorization server (e.g., password, public/private key pair).

The authorization server MAY establish a client authentication method with public clients. However, the authorization server MUST NOT rely on public client authentication for the purpose of identifying the client.

Section 2.1 Client Types

OAuth defines two client types, based on their ability to authenticate securely with the authorization server (i.e., ability to maintain the confidentiality of their client credentials):

confidential

Clients capable of maintaining the confidentiality of their credentials (e.g., client implemented on a secure server with restricted access to the client credentials), or capable of secure client authentication using other means.

public

Clients incapable of maintaining the confidentiality of their credentials (e.g., clients executing on the device used by the resource owner, such as an installed native application or a web browser-based application), and incapable of secure client
authentication via any other means.

Summary

The requirement for an authorization header is determined by the authorization server and is implementation specific.