wtf( )unctionsystem design, drawn
← all problemsPolicy & IAMHard

Where the token actually comes from

A user signs in to an application through an identity provider. The application ends up holding an access token, and most people can name every box in this diagram without being able to say what order they're touched in.

One hop matters more than the rest: the code the browser carries is not the token, and the exchange that turns one into the other never goes through the browser at all.

Tap the components in the order the sign-in visits them.
?The whole design rests on which hops the browser can see and which it cannot.

Boundaries, outermost first: Back channel · the browser never sees this: API call (with the token), Code exchange (server to server) Outside every boundary: Browser (starts sign-in), Application (redirects them out), Identity provider (authenticates), Redirect back (carries a short code) Connections: Browser calls Application — sign in Application sends outbound traffic to Identity provider — redirect out Identity provider sends outbound traffic to Redirect back — redirect home Redirect back calls Code exchange — hands over the code Code exchange calls API call — token in hand

Tap the components in the order a request travels them.