The Ultimate Guide to Understand OAuth 2.0
By: Hossam Houssien
Tags: Authentication, Oauth, Oauth2

If you still find the OAuth2 concept problematic for you or you would like to ensure that you properly understand what it is, I guess you will find this article interesting.

Table of Content

What is OAuth2?

So, let’s start by defining what is OAuth2. As always, we will be starting by looking into some definitions:

OAuth 2.0 is the industry-standard protocol for authorization. — OAuth2 Official Specs OAuth is an open standard for access delegation, commonly used as a way for internet users to grant websites or applications access to their information on other websites but without giving them the passwords. — Wikipedia

Huh? Can you explain it in English? OAuth2 is, you guessed it, version 2 of the OAuth protocol (also called framework). To clearly understand what OAuth2 is, we will get to cover the OAuth protocol first.

OAuth protocol allows third-party applications to grant limited access to an HTTP service, either on behalf of a user or by allowing the third-party application to obtain access on its own behalf.

To make it even more clear, imagine this scenario in a traditional client-server authentication model, the client requests an access-restricted resource (protected resource) on the server by authenticating with the server using the resource owner’s (user) credentials. To provide third-party applications access to restricted resources, the resource owner shares its credentials with the third party. This creates several problems and limitations:

Third-party applications are required to store the resource

owner’s credentials for future use, typically a password in

clear-text (which is a big NO ).

owner’s credentials for future use, typically a password in clear-text (which is a big ). Servers are required to support password authentication, despite

the security weaknesses inherent in passwords.

the security weaknesses inherent in passwords. Third-party applications gain overly broad access to the resource

owner’s protected resources, leaving resource owners without any

ability to restrict duration or access to a limited subset of

resources.

owner’s protected resources, leaving resource owners without any ability to restrict duration or access to a limited subset of resources. Resource owners cannot revoke access to an individual third party

without revoking access to all third parties, and must do so by

changing the third party’s password.

without revoking access to all third parties, and must do so by changing the third party’s password. Compromise of any third-party application results in a compromise of the end-user’s password and all of the data protected by that password.

OAuth2 addresses these issues by introducing an authorization layer and separating the role of the client from that of the resource owner. In OAuth2, the client requests access to resources controlled by the resource owner and hosted by the resource server and is issued a different set of credentials than those of the resource

owner.

Instead of using the resource owner’s credentials to access protected resources, the client obtains an access token — a string denoting a specific scope, lifetime, and other access attributes (will be covered later). Access tokens are issued to third-party clients by an authorization server with the approval of the resource owner. The client uses the access token to access the protected resources hosted by the resource server.

For example, an end-user (resource owner) can grant a printing service (client) access to his/her protected photos stored at a photo-sharing service (resource server), without sharing his/her username and password with the printing service. Instead, s/he authenticates directly with a server trusted by the photo-sharing service (authorization server), which issues the printing service delegation- specific credentials (access token).

Now, after we introduced the OAuth protocol, you can easily get what is OAuth 2.0 is all about (with its own specs, of course, covered later). Before diving into OAuth2 we need to clarify some terminologies first.