Definition
OAuth 2.0 is an open standard authorization framework that allows third-party applications to gain limited access to user accounts on an HTTP service, such as Facebook, GitHub, or Google, without exposing the user's password.How It Works
- 1Request: A third-party application asks to access the HTTP service on the user's behalf.
- 2Authorization: The user authenticates and permits the service to issue an access token.
- 3Token Issuance: The service provides an access token to the third-party application.
- 4Access: The application uses this token to access the user's data on the service.
- 5Expiration: The token expires after a set time, ensuring limited access.
Key Characteristics
- Token-based: Utilizes tokens instead of user credentials.
- Scope-defined: Access can be restricted to specific resources.
- Time-constrained: Tokens have expiration times to limit their validity.
Comparison
| Feature | OAuth 2.0 | Basic Auth | API Key |
|---|---|---|---|
| Token-based | Yes | No | No |
| Password storage | No | Yes | No |
| Scope control | Yes | No | Limited |
Real-World Example
When you log into Spotify using your Facebook account, Spotify employs OAuth 2.0 to access your Facebook profile without knowing your Facebook password.Best Practices
- Always use HTTPS to encrypt tokens during transmission.
- Regularly review and revoke unused access tokens.
- Define narrow scopes for access tokens to limit exposure.
Common Misconceptions
- OAuth 2.0 is not the same as OpenID Connect, though they are often used together for authentication and authorization.
- OAuth 2.0 does not handle authentication, it only manages authorization.
- Tokens are not inherently secure, they require proper handling and storage to maintain security.