DeepFrontend
Learning Paths
Practice
System Design & DS
Design Studio
Data Structures Curriculum
Real-World Case Studies
Careers
Job Board
Resume Builder
Blog
Sign in
Search
⌘K
Go Pro
Loading compiler resources...
API Development Quiz Practice
Active Recall Drill Session
← Exit Session
Question 1 of 1
hard
API Development
What specifically makes the authorization code safe to pass through the browser's less-trusted redirect channel, despite the risk of it appearing in browser history or referrer headers?
A
The code is encrypted so no one can read it
B
The code is deliberately short-lived and useless alone — completing the exchange requires an additional secret (client_secret or PKCE's code_verifier) that never traveled through that same channel
C
Browsers automatically delete authorization codes from history
D
This is actually a known unfixed security hole in OAuth
Check Answer