OAuth

As explained in Secure APIs

OAuth 2.0 is the earlier major version of the OAuth authorization framework that defined multiple authorization flows for delegated access.

OAuth 2.0 delegates access without requiring an application to receive a user’s password. It limits access by combining an authorization flow, requested scopes, and time-limited access tokens. section 7.3

OAuth authorization flows use four roles and several flow types:

• The resource owner controls the data, the client requests access, the authorization server authenticates users and issues tokens, and the resource server stores data and enforces access. section 7.3
• Authorization code exchanges a code for a token; client credentials obtains tokens directly for programmatic access such as microservices; device authorization supports input-constrained devices; refresh tokens renew expired access. section 7.8
• Scopes specify permitted data and operations, while access tokens carry access for a limited period and within those requested scopes. section 7.3

Importing a LinkedIn profile

A job portal should not ask for LinkedIn credentials, because those credentials could give it unrestricted account access. Instead, the user authorizes limited employment-history access, and the portal receives a scoped, temporary access token. section 7.3

Figure 7.5 OAuth describes flows through which users (resource owners) can authorize applications (clients) to access their data in an API (resource server). Every flow begins with an authorization request, followed by user login and consent and then by an access token grant.

Use the flow diagram to follow authorization request, user login and consent, and access-token grant. section 7.3

How Secure APIs covers it

How deep it goes

Explains roles, scopes, tokens, and four flows, then adds PKCE and sender-constrained-token protections without implementation code.

Examples

Uses a job portal importing LinkedIn employment history and identifies microservices and smart TVs as flow-selection scenarios.

What it assumes

Assumes basic API access concepts while defining authentication, authorization, resource roles, scopes, and tokens.

What you can do after

Apply OAuth by selecting a flow, requesting scopes, and using time-limited access tokens for delegated API access.

How it connects

Connects delegated access with authentication, authorization, scopes, access tokens, PKCE, JWTs, and OpenID Connect.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Software Security for DevelopersOAuth is an authorization framework that enables delegated access to protected resources without sharing the resource owner's credentials with the resource server.
• 

  liveBookmanning.com
  Authorization in ActionOAuth 2.0 is an open authorization framework that lets applications obtain limited delegated access to protected resources without exposing a user's credentials.
• 

  liveBookmanning.com
  .NET MAUI in ActionOAuth is an authorization framework that allows an application to obtain delegated access to protected resources without receiving the user's password.
• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eOAuth 2.0 is an authorization protocol that lets a resource owner delegate controlled access to protected resources without revealing credentials to the accessing service.
• 

  liveBookmanning.com
  Acing the CCNA Exam: Volume 2 Advanced Networking and SecurityOAuth 2.0 is an industry-standard authorization framework that delegates controlled access to protected resources without sharing the resource owner's credentials with a third-party application.
• 

  liveBookmanning.com
  Spring Security in Action, Second EditionOAuth 2 is an authorization framework specification for delegated access to protected resources using access tokens.
• 

  liveBookmanning.com
  Spring in Action, Sixth EditionOAuth 2 is an authorization framework that enables a client to obtain limited access to protected resources on behalf of a resource owner.
• 

  liveBookmanning.com
  Building Distributed Applications that WorkOAuth is an authorization framework that enables clients to obtain limited access to protected resources without handling the resource owner's credentials.

Compare how 9 books explain OAuth →

Related concepts

• openid connectused by · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
• API keyproduces · An API key is a credential used to identify or authorize a client accessing an application programming interface.
• scopeuses · Scope is a defined boundary specifying which entities, activities, resources, or conditions are included or governed in a particular context.
• authenticationuses · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
• authorization code flowhas part · The authorization code flow is an OAuth protocol in which a client obtains a short-lived authorization code after user authorization and exchanges it for access or other tokens.
• resource serverhas part · A resource server is a service that hosts protected resources, validates access credentials such as tokens, and enforces authorization for client requests.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.