RFC 6749（OAuth 2.0 授权框架）中的图 3 和图 4

Question

In this RFC , I struggle to understand the diagrams in Figures 3 (Authorization Code Flow) and 4 (Implicit Grant Flow).

In both cases at point (B), it says "The authorization server authenticates the resource owner (via the user-agent)". The (B) arrow has two ends, one towards Resource owner and one towards Authorization server.

 +----------+
 | Resource |
 |   Owner  |
 |          |
 +----------+
      ^
      |
     (B)
 +----|-----+          Client Identifier      +---------------+
 |         -+----(A)-- & Redirection URI ---->|               |
 |  User-   |                                 | Authorization |
 |  Agent  -+----(B)-- User authenticates --->|     Server    |
 |          |                                 |               |
 |         -+----(C)-- Authorization Code ---<|               |
 +-|----|---+                                 +---------------+
   |    |                                         ^      v
  (A)  (C)                                        |      |
   |    |                                         |      |
   ^    v                                         |      |
 +---------+                                      |      |
 |         |>---(D)-- Authorization Code ---------'      |
 |  Client |          & Redirection URI                  |
 |         |                                             |
 |         |<---(E)----- Access Token -------------------'
 +---------+       (w/ Optional Refresh Token)

                 Figure 3: Authorization Code Flow (actual)

It seems to me that the arrow should go from Resource owner to Authorization server, as the RO is the one that has to actively enter his credentials.

 +----------+
 | Resource |
 |   Owner  |
 |          |
 +----------+
      v
      |
     (B)
 +----|-----+          Client Identifier      +---------------+
 |         -+----(A)-- & Redirection URI ---->|               |
 |  User-   |                                 | Authorization |
 |  Agent  -+----(B)-- User authenticates --->|     Server    |
 |          |                                 |               |
 |         -+----(C)-- Authorization Code ---<|               |
 +-|----|---+                                 +---------------+
   |    |                                         ^      v
  (A)  (C)                                        |      |
   |    |                                         |      |
   ^    v                                         |      |
 +---------+                                      |      |
 |         |>---(D)-- Authorization Code ---------'      |
 |  Client |          & Redirection URI                  |
 |         |                                             |
 |         |<---(E)----- Access Token -------------------'
 +---------+       (w/ Optional Refresh Token)

                 Figure 3: Authorization Code Flow (more correct?)

Anyway, I don't understand what this double arrow is supposed to mean. Is this a typo? Am I missing something here?

Answer 1

It means that the user-agent (the browser) tries to reach the resource owner, but then it is being redirected to authorization server. So the 'B' arrow should not be from the resource owner to the authorization server.