No Password Handed Over: Access Is Granted via a Code and a Token
OAuth 2.0's authorization code flow involves the user, the client application, the authorization server, and the resource server.
The user logs in directly at the authorization server and approves the client's request. The client never sees the user's password.
Once the user approves, the authorization server redirects the user back to the client with a short-lived authorization code. The client sends that code, together with its own client secret, straight to the authorization server and exchanges it for an access token. This exchange is a server-to-server step with no user involved.
Finally, the client presents the access token to the resource server, which grants access without ever seeing the user's credentials.
Trace the authorization code flow through its four parties, and explain what the authorization code and the access token each accomplish.
At which step does the client application ever see the user's password?