Beginner LevelAuthentication & Authorization
How do Cross-Domain SSO redirects exchange authentication tokens safely?
❓ Interview Prompt: Explain authorization code redirection, front-channel browser redirects, back-channel server-to-server token exchanges, and state parameters.
Browser security boundaries prevent scripts on one domain ('app-a.com') from reading cookies on another domain ('sso-idp.com'). Cross-Domain SSO resolves this via Authorization Code Exchange Redirects.
Step-by-Step Flow:
1
Front-Channel Redirect: 'app-a.com' redirects browser to 'sso-idp.com/auth?response_type=code&state=xyz123'.
2
IdP Verification: User authenticates at 'sso-idp.com'.
3
Auth Code Callback: IdP redirects browser back to 'app-a.com/callback?code=AUTH_CODE_99&state=xyz123'.
4
Back-Channel Token Exchange: 'app-a.com' backend makes a direct server-to-server POST request to 'sso-idp.com/token' exchanging 'AUTH_CODE_99' for access/ID tokens.
5
'state' Parameter: Prevents CSRF by verifying that the returned 'state' matches the value stored in the client session before redirect.
Code Implementation Example
typescript
// Express callback handler exchanging auth code for tokens
app.get('/callback', async (req, res) => {
const { code, state } = req.query;
// 1. Verify CSRF state parameter matches session state
if (state !== req.session.oauthState) {
return res.status(403).send('State mismatch CSRF attempt detected');
}
// 2. Back-channel server-to-server token exchange POST
const tokenRes = await fetch('https://idp.com/oauth/token', {
method: 'POST',
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
body: new URLSearchParams({
grant_type: 'authorization_code',
code: String(code),
redirect_uri: 'https://app-a.com/callback',
client_id: process.env.CLIENT_ID!,
client_secret: process.env.CLIENT_SECRET!
})
});
const tokens = await tokenRes.json();
});💡Back-channel server-to-server authorization code exchange.
🎯 Interview Key Takeaway
Cross-domain SSO exchanges temporary authorization codes via back-channel server requests, protecting tokens from browser inspection.
#SSO#OAuth 2.0#Redirects#State Parameter#Beginner
Back to all Authentication & Authorization Questions→