Module callback 

Handling the authorization callback: the redirect back from the browser.

This is the half of the flow where the attack surface arrives. Everything the client knows about its own request — the state, the issuer, the PKCE verifier, the resource — was recorded before the user left; everything on this side of the redirect came from a channel the client does not control. The job here is to check the latter against the former and produce a redemption-ready value, or refuse.

The order of the checks is the point

state is checked first, before the response is interpreted as success or failure. RFC 6749 §4.1.2 requires the client validate state on the response whatever it contains. Two consequences follow, and both are why the sequence is not incidental:

• An attacker who can induce the client to follow a crafted redirect must not be able to make it report a failure either. A forged error=access_denied is a denial of service against a flow the user believes is in progress, and reading the error before checking state would let anyone with a link do it.
• An attacker must not be able to make the client redeem someone else’s code by pairing a valid code with a forged state. The two are checked together precisely so neither is meaningful alone.

iss is checked next, then the response is interpreted. RFC 9207’s mix-up defence only means anything if it runs before the code is accepted, and it runs against PendingAuthorization::issuer — what the client recorded on the way out — rather than against a value read from the response being validated.

What this does not do

It does not redeem the code and it does not talk to the authorization server. AuthorizedCode is what a later use case takes to the token endpoint.

Structs

AuthorizationCallback

The query parameters an authorization server redirected with.

AuthorizedCode

A validated callback, ready to redeem.

Enums

CallbackError

Why an authorization callback was refused.

Functions

authorize_callback

Validate an authorization callback against the request that started it.