A server-side web app (backend for frontend) is a confidential client: it runs the Authorization Code Flow itself, authenticates at the token endpoint with its client secret (or a private key) and keeps the tokens in a server-side session. The browser only holds the session cookie and never sees a token. The web app calls the backend with the access token as bearer token, the backend (this library) verifies it against the auth provider's discovery document and JWKS.
The diagram has three phases:
- Login: the browser follows the redirects between the web app and the auth provider, the web app exchanges the code (with PKCE and client authentication) and starts the session. The backend is not involved.
- API call: the browser calls the web app with the cookie, the web app calls the backend with the access token, the backend extracts and verifies it and either calls the handler or responds with
401. The notes name the parts of this library involved. - Token lifetime: the web app refreshes the tokens and ends the session on logout. The backend just checks
exp, an issued access token stays valid until then.
Open the diagram directly to follow the links within it.
