Grant type

As explained in ASP.NET Core in Action, 3e

A grant type is an OAuth 2.0-defined authorization flow for obtaining access credentials in a particular application scenario.

A grant type is an OAuth 2.0 authorization flow for obtaining an access token in a particular scenario. Choosing the right flow helps an application delegate API access without sharing a user's credentials. section 25.1.3

Common OAuth 2.0 grant types include:

• Authorization code: lets an application exchange an authorization code and secret for a token after a user interaction. section 25.1.3
• Authorization code with PKCE: adds protections against certain attacks and should be preferred when possible. section 25.1.3
• Client credentials: supports machine-to-machine access when no user is involved, such as one API calling another. section 25.1.3 section 25.7

Delegating access to photos

When dogphotos.com needs access to a user's Facebook photos, the user signs in to Facebook rather than giving dogphotos.com their Facebook credentials. OAuth 2.0 grants dogphotos.com permission to call the photos API on the user's behalf. This is authorization, not authentication: the application receives delegated access, not necessarily the user's identity. section 25.1.3

Figure 25.5 Using OAuth 2.0 to authorize dogphotos.com to access your photos on Facebook

Follow the authorization-code flow from the user's interaction through delegated access to the photos API. section 25.1.3

How ASP.NET Core in Action, 3e covers it

How deep it goes

Defines three common flows and their scenarios, while directing readers to explore additional grants instead of inventing one.

Examples

Uses Facebook photo delegation, interactive authorization, and one API calling another without a user.

What it assumes

Assumes familiarity with APIs and access tokens, while distinguishing authorization from authentication through a concrete delegation example.

What you can do after

Evaluate which OAuth 2.0 flow fits an interactive user scenario or a machine-only API workflow.

How it connects

Connects authorization code, PKCE, client credentials, OAuth 2.0, OpenID Connect, access tokens, and APIs.

liveBookmanning.com

Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Spring Security in Action, Second EditionA grant type is an OAuth 2 protocol flow by which a client obtains a token from an authorization server.

Compare how 2 books explain grant type →

Related concepts

• authorization code flowincludes · The authorization code flow is an OAuth protocol in which a client obtains a short-lived authorization code after user authorization and exchanges it for access or other tokens.
• client credentials grant typeincludes · The client credentials grant is an OAuth authorization flow in which a client authenticates with its own credentials to obtain an access token without user involvement.
• OAuthpart of · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
• tokenproduces · A token is a discrete unit of text, such as a word, word fragment, character, or symbol, represented and processed as an element by a language model.
• OAuth2AuthorizedClientManagerimplemented by · OAuth2AuthorizedClientManager is a Spring Security component that manages authorized clients and obtains access tokens by executing OAuth 2 grant flows.
• authorization flowconfigures · An authorization flow is a sequence of protocol and application operations through which a client obtains permission to access protected resources.

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.