How deeply does Spring Security in Action, Second Edition cover OAuth?

Explains actors, token categories, grant types, PKCE, refresh tokens, and Spring configuration, without detailing protocol message exchanges.

OAuth

As explained in Spring Security in Action, Second Edition

OAuth 2 is an authorization framework specification for delegated access to protected resources using access tokens.

OAuth 2.0 is an authorization framework for delegated access to protected resources. It separates the user, client, resource server, and authorization server: the authorization server authenticates users and clients, then issues access tokens that the client presents to a resource server. section 13.6

Implementations commonly distinguish these mechanisms:

Use opaque tokens when the resource server validates them through authorization-server introspection; use non-opaque tokens when the token carries details, commonly as a JWT. section 13.6
Obtain tokens through grant types such as authorization code or client credentials; add PKCE to authorization code flows when supplementary protection is needed. section 13.6
Use refresh tokens when an application needs new access tokens without requiring the user to authenticate again. section 13.6
Treat OpenID Connect as a protocol built over OAuth 2 that constrains the framework with values such as openid and profile scopes and an ID token. section 13.4

Spring Security clients

Configure a Spring web application to authenticate through GitHub, Google, Facebook, Okta, or another provider. Common providers supply known OAuth 2 details, while custom providers require authorization, token, and key-set URIs. For backend-to-backend calls, use the client credentials grant and Spring Security's client manager to obtain an access token. section 16.3

How Spring Security in Action, Second Edition covers it

Cover of Spring Security in Action, Second Edition

liveBook manning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Software Security for DevelopersOAuth is an authorization framework that enables delegated access to protected resources without sharing the resource owner's credentials with the resource server.
liveBook manning.com

Authorization in ActionOAuth 2.0 is an open authorization framework that lets applications obtain limited delegated access to protected resources without exposing a user's credentials.
liveBook manning.com

.NET MAUI in ActionOAuth is an authorization framework that allows an application to obtain delegated access to protected resources without receiving the user's password.
liveBook manning.com

ASP.NET Core in Action, 3eOAuth 2.0 is an authorization protocol that lets a resource owner delegate controlled access to protected resources without revealing credentials to the accessing service.
liveBook manning.com

Acing the CCNA Exam: Volume 2 Advanced Networking and SecurityOAuth 2.0 is an industry-standard authorization framework that delegates controlled access to protected resources without sharing the resource owner's credentials with a third-party application.
liveBook manning.com

Secure APIsOAuth 2.0 is the earlier major version of the OAuth authorization framework that defined multiple authorization flows for delegated access.
liveBook manning.com

Spring in Action, Sixth EditionOAuth 2 is an authorization framework that enables a client to obtain limited access to protected resources on behalf of a resource owner.
liveBook manning.com

Building Distributed Applications that WorkOAuth is an authorization framework that enables clients to obtain limited access to protected resources without handling the resource owner's credentials.

Compare how 9 books explain OAuth →

Related concepts

openid connectused by · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
API keyproduces · An API key is a credential used to identify or authorize a client accessing an application programming interface.
scopeuses · Scope is a defined boundary specifying which entities, activities, resources, or conditions are included or governed in a particular context.
authenticationuses · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
authorization code flowhas part · The authorization code flow is an OAuth protocol in which a client obtains a short-lived authorization code after user authorization and exchanges it for access or other tokens.
resource serverhas part · A resource server is a service that hosts protected resources, validates access credentials such as tokens, and enforces authorization for client requests.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.