Securing Electron Applications with OpenID Connect and OAuth2

Blog Discussions
, , , ,
11

Hi. I’m quite new to OAuth/OpenId connect, so apologies if this is an obvious question.

What grant/flow is this example using? It looks like it is the Authorization Code flow, but as far as I can tell, you don’t pass a client secret.

Unless I’m missing something, according to the docs on the Auth0 Authentication API, it shouldn’t be possible to call the /oauth/token endpoint without either a client_secret (if using normal authorization code flow), or a code_verifier (if using Authorization code with PKCE)

To clarify, this is the call I’m confused about

 const exchangeOptions = {
    grant_type: "authorization_code",
    client_id: clientId,
    code: query.code,
    redirect_uri: redirectUri,
  };

  const options = {
    method: "POST",
    url: `https://${auth0Domain}/oauth/token`,
    headers: {
      "content-type": "application/json",
    },
    data: JSON.stringify(exchangeOptions),
  };

  try {
    const response = await axios(options);