OAuth authorization code Life Span

[Dist]

@BehEh

So, In a compliant implementation you should expect:

1. The code is no longer valid after 10 minutes
2. The code can only be used, and in fact using it a second time should lock down of all tokens issued from that code because it looks like it was compromised

For clarification, neither of the points you listed are required to be compliant. 10 min is just a recommendation, the requirement is it just has to be shortly after issuance. And the 2nd point about it locking down all tokens is also just a recommendation, and in Twitch’s case they do not follow this recommendation so is not relevant to this thread.