An OAuth 2 client is an application that requests authorization and accesses protected resources on behalf of a resource owner. It may be a web, mobile, desktop, or backend application. A backend service can act as a client when it calls another protected backend. section 13.1 section 16.0
The client obtains an access token from an authorization server, then presents that token when calling a resource server. The token lets the resource server authorize the requested operation. section 13.1 section 13.6
Choose the client flow according to whether a user participates:
- Use the authorization code grant when a user signs in. The authorization server authenticates the user, redirects the browser back with an authorization code, and the client exchanges that code for an access token. section 13.3.1
- Use the client credentials grant when one backend authenticates as itself. The client sends its credentials to the token endpoint and does not need a user, redirect URI, or authorization URI. section 16.2
- Add PKCE to the authorization code grant when the client needs supplementary protection against stolen authorization codes and credentials. section 13.3
Spring Security client
A Spring MVC application can enable OAuth 2 login with oauth2Login(), require authentication for every request, and configure only client credentials when using a well-known provider such as Google or GitHub. A backend service instead enables oauth2Client(), registers a client-credentials registration, and uses an OAuth2AuthorizedClientManager to obtain an access token. section 16.1.1 section 16.2
