Oauth 2 how does it work

Get the Whitepaper. Login Login Start the Conversation. Feb 12 BY Dave Wallen. Categories: Cloud and Data Security. What is OAuth? Image courtesy of ELEX. How does OAuth work? Application requests Access Token: After the authorization has been authenticated, the resource grants an Access Token to the API, without having to divulge usernames or passwords. Application accesses resource: Tokens come with access permission for the API.

These permissions are called scopes and each token will have an authorized scope for every API. Scopes are an important concept in OAuth 2. They are used to specify exactly the reason for which access to resources may be granted. Acceptable scope values, and which resources they relate to, are dependent on the Resource Server.

Instead, and for better security, an Authorization Code may be returned, which is then exchanged for an Access Token. Unlike Access Tokens, Refresh Tokens normally have long expiry times and may be exchanged for new Access Tokens when the latter expires. Because Refresh Tokens have these properties, they have to be stored securely by clients. At the most basic level, before OAuth 2. Using OAuth 2. The token request, exchange, and response follow this general flow:.

The Client requests authorization authorization request from the Authorization server, supplying the client id and secret to as identification; it also provides the scopes and an endpoint URI redirect URI to send the Access Token or the Authorization Code to.

The Authorization server authenticates the Client and verifies that the requested scopes are permitted. The Resource owner interacts with the Authorization server to grant access. The Authorization server redirects back to the Client with either an Authorization Code or Access Token, depending on the grant type, as it will be explained in the next section.

A Refresh Token may also be returned. With the Access Token, the Client requests access to the resource from the Resource server. In OAuth 2. The authorization framework provides several grant types to address different scenarios:. Authorization Code grant : The Authorization server returns a single-use Authorization Code to the Client, which is then exchanged for an Access Token.

OAuth also allows for granular permission levels. You can give Bitly the right to post to your Twitter account, but restrict LinkedIn to read-only access.

OAuth 2. If you create a new application today, use OAuth 2. This blog only applies to OAuth 2. OAuth 1. OAuth tokens no longer need to be encrypted on the endpoints in 2.

Rob Sobers is a software engineer specializing in web security and is the co-author of the book Learn Ruby the Hard Way. Last Week in Ransomware: Week of August 16th. Last Week in Ransomware: Week of August 9th. Last Week in Ransomware: Week of August 2nd.

Last Week in Ransomware: Week of July 26th. Choose a Session X. What is OAuth? Does your cybersecurity start at the heart? Get a highly customized data risk assessment run by engineers who are obsessed with data security.