OAuth

As explained in ASP.NET Core in Action, 3e

OAuth 2.0 is an authorization protocol that lets a resource owner delegate controlled access to protected resources without revealing credentials to the accessing service.

OAuth 2.0 is an authorization protocol for delegating controlled access to a protected resource without revealing the resource owner's credentials or other private details. section 25.1.3

The protocol separates access delegation from identity management. OpenID Connect builds on OAuth 2.0 to add authentication, conventions, discoverability, and identity information. section 25.1.3 section 25.7

A typical interactive authorization flow proceeds as follows:

• The application redirects the user to an identity provider. section 25.1.3
• The user signs in and approves the requested access, such as access to photos. section 25.1.3
• The provider redirects back with an authorization code, which the application uses with its client secret to obtain access. section 25.1.3

Printing dog photos

A user asks dogphotos.com to print photos stored on Facebook. Instead of giving dogphotos.com Facebook credentials, the user signs in at Facebook, approves access to photos, and lets dogphotos.com receive delegated access. section 25.1.3

Figure 25.5 Using OAuth 2.0 to authorize dogphotos.com to access your photos on Facebook

Follow the authorization-code sequence from the application redirect through user consent and the provider callback. section 25.1.3

OAuth 2.0 defines multiple grant types. Authorization code with PKCE is the common interactive choice, while client credentials suits machine-to-machine API calls. section 25.7

How ASP.NET Core in Action, 3e covers it

How deep it goes

Explains the authorization-code sequence and grant-type choices, but stops short of protocol internals or implementation code.

Examples

Uses dogphotos.com accessing Facebook photos through redirects, consent, an authorization code, and delegated access.

What it assumes

Builds from a basic distinction between authentication and authorization, introducing identity providers before OpenID Connect details.

What you can do after

Evaluate authorization flows and choose interactive or machine-to-machine grants for API access scenarios.

How it connects

Connects authorization codes, PKCE, client credentials, OpenID Connect, identity providers, protected resources, and bearer tokens.

liveBookmanning.com

Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Software Security for DevelopersOAuth is an authorization framework that enables delegated access to protected resources without sharing the resource owner's credentials with the resource server.
• 

  liveBookmanning.com
  Authorization in ActionOAuth 2.0 is an open authorization framework that lets applications obtain limited delegated access to protected resources without exposing a user's credentials.
• 

  liveBookmanning.com
  .NET MAUI in ActionOAuth is an authorization framework that allows an application to obtain delegated access to protected resources without receiving the user's password.
• 

  liveBookmanning.com
  Acing the CCNA Exam: Volume 2 Advanced Networking and SecurityOAuth 2.0 is an industry-standard authorization framework that delegates controlled access to protected resources without sharing the resource owner's credentials with a third-party application.
• 

  liveBookmanning.com
  Secure APIsOAuth 2.0 is the earlier major version of the OAuth authorization framework that defined multiple authorization flows for delegated access.
• 

  liveBookmanning.com
  Spring Security in Action, Second EditionOAuth 2 is an authorization framework specification for delegated access to protected resources using access tokens.
• 

  liveBookmanning.com
  Spring in Action, Sixth EditionOAuth 2 is an authorization framework that enables a client to obtain limited access to protected resources on behalf of a resource owner.
• 

  liveBookmanning.com
  Building Distributed Applications that WorkOAuth is an authorization framework that enables clients to obtain limited access to protected resources without handling the resource owner's credentials.

Compare how 9 books explain OAuth →

Related concepts

• openid connectused by · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
• API keyproduces · An API key is a credential used to identify or authorize a client accessing an application programming interface.
• scopeuses · Scope is a defined boundary specifying which entities, activities, resources, or conditions are included or governed in a particular context.
• authenticationuses · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
• authorization code flowhas part · The authorization code flow is an OAuth protocol in which a client obtains a short-lived authorization code after user authorization and exchanges it for access or other tokens.
• resource serverhas part · A resource server is a service that hosts protected resources, validates access credentials such as tokens, and enforces authorization for client requests.

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.