A grant type is an OAuth 2 flow through which a client obtains an access token from an authorization server. The client then uses that token to request protected resources from a resource server. Short token lifetimes limit the impact of a lost token. section 13.1
Choose the flow according to whether a user authenticates and how the client is deployed:
- Use the authorization code grant type when a user must authenticate; add PKCE to reduce the risk of stolen authorization codes and client credentials. section 13.3 section 13.6
- Use the client credentials grant type when one backend service needs an access token without a user authenticating. section 13.3 section 16.3
- Use refresh tokens when the application needs a new access token without requiring the user to authenticate again. section 13.6
- Avoid implicit and password grant types; they are deprecated because they were found insufficiently secure. section 13.3
Backend service calling another backend
A proxy or backend client obtains an access token with the client credentials grant type, then sends authenticated requests to the other application. In Spring Security, a client manager executes the configured grant flow and obtains the token. section 16.3
Figure 13.3 The simplest explanation of the OAuth 2 authentication procedure involves the client obtaining a token from the authorization server. This token is then used to gain authorization for requests sent to the backend application, or resource server.
Trace the basic sequence: client obtains a token from the authorization server, then presents it when requesting authorization from the resource server. section 13.1
