Unlocking the power of OAuth 2.0 for secure authorization – Made simple

Introduction:

OAuth 2.0 (Open Authorization 2.0) is a powerful authorization framework that enables third-party applications to obtain limited access to a user's resources hosted by a service, such as Facebook, Google, or GitHub, without the need to expose the user's credentials.

It provides a way for users to grant access to their data stored on one website or service to another website or service, without sharing their passwords.

Understand the difference between authorization and authentication:

Authentication:

Authorization:

What is OAuth 2.0 and why we need?:

1. Industry-standard protocol for authorization and anyone can implement it. OAuth was not created for service to authorize a person, it is meant for service to authorize another service.

2.Its an authorization framework which allows a service use another service without requiring the security details (username, password, etc.) of the user.

3.OAuth 2.0 allows applications to obtain limited access to user accounts on an HTTP service, such as Facebook, GitHub, or Google, without exposing the user's credentials. Instead of sharing passwords, OAuth 2.0 introduces the concept of tokens, which grant access to specific resources for a limited time.

4.Allows us to access the resource server with the help of access token, which is generated by authorization server using Client ID and Secret

The significant difference between OAuth 1.0 & OAuth 2.0:

OAuth 1.0:

OAuth 2.0:

Key Concepts:

1.Clients: Applications that request access to resources on behalf of the resource owner.

Resources: An entity capable of granting access to protected resources.

Resource Owner: User

2.Authorization Server: The server that authenticates the resource owner and issues access tokens.

3. Resource Server: The server hosting the protected resources, which accepts and responds to requests using access tokens.

4.Tokens: Credentials issued by the authorization server to the client for accessing resources on behalf of the resource owner.

There are more than one flow available in OAUTH:

Authorization Code Flow

Implicit Flow

OAuth 2.0 defines several grant types for different use cases:

1.Authorization Code Grant: Used by web applications running on a server.

2.Implicit Grant: Used by single-page web applications or mobile apps.

3.Resource Owner Password Credentials Grant: Used when the resource owner has a trust relationship with the client.

4.Client Credentials Grant: Used by confidential clients to access their own resources.

OAUTH 2.0 Workflow Typically Involves,

1.Authorization Request 2. User Authentication and Authorization 3.Authorization Grant, 4.Token Request, 5.Token Response and Accessing Protected Resources

OAuth 2.0 introduces various security considerations to protect against threats such as token leakage, token theft, and unauthorized access:

1.Token Expiration and Refresh

2.Token Scope

3.Token Storage

4.Token Revocation

5.Token Replay Attacks

Example scenarios:

1.Social Media Integration

2.Online Shopping with PayPal

OAuth vs SAML:

1.Purpose

2.User Experience

3.Token Types

4.Scalability

Recap:

OAuth 2.0 is an authorization framework that enables secure access to resources on behalf of a user without sharing their credentials

It is widely used in modern web and mobile applications to facilitate delegated access to protected resources from various providers

FAQs:

Various Questions and Answers about OAUTH2.0