quizlet/oauth2-php — Issue #4: Authorization code lifetime
Author: ramunasd
Created: 2011-10-24 15:23:28+00:00
State: open

From IETF OAuth 2.0 draft v20:

Authorization codes MUST be short lived and single use. If the
authorization server observes multiple attempts to exchange an
authorization code for an access token, the authorization server
SHOULD attempt to revoke all access tokens already granted based on
the compromised authorization code.