Download as PDF, PPTX
Uploaded byKent Tong
OAuth2 in simple words
1) OAuth2 allows web apps to access user data from authentication services like Google and Facebook by redirecting the user's browser to those services for authentication. 2) When a user grants permission, the authentication service provides an access token to the web app, which it can use to make API requests and access the user's data on the user's behalf. 3) To prevent access token theft, the authentication service provides an authorization code instead, which the web app exchanges for an access token on the backend without exposing it to the browser.
![[Step-by-Step Guide] How To Launch A Self-Hosted WordPress Blog In 27 Minutes...](https://cdn.slidesharecdn.com/ss_thumbnails/is-170907133636-thumbnail.jpg?width=640&height=640&fit=bounds)
OAuth2 in simple words
- 1. OAuth2 Kent Tong, TipTecDevelopment © 2018
- 2. OAuth2: Using yourGoogle or Facebook account with other web apps
- 3. Redirecting the userto authentication server Your web app Browser Google Redirect to: https://auth.google.com http://localhost/myapp https://auth.google.com https://auth.google.com Redirect the user to Google, Facebook, etc.
- 4. User logging inand granting permission to the app Google Grant permission to app 123? Browser OK Your web app http://localhost/myapp Redirect to: http://localhost/myapp/resume? access_token=abc Using the access token, the web app can do things as the user. Redirect the browser to the web app. ... access_token=abc
- 5. But wait! Google Grant permissionto app 123? Browser OK Your web app http://localhost/myapp Redirect to: http://localhost/myapp/resume? access_token=abc How does Google know the URL of your web app? How does Google know the name of your web app (app 123)?
- 6. Your web appneeds to tell Google its name & resume URL at the beginning Your web app Browser Google Redirect to: https://auth.google.com ? client_id=app123& redirect_url=http://localhost/myapp/resume http://localhost/myapp https://auth.google.com ? client_id=...& redirect_url=... Your web app provides its name and resume URL to Google via the browser.
- 7. User logging inand granting permission to the app Google https://auth.google.com Grant permission to app 123? Browser OK Your web app http://localhost/myapp Redirect to: http://localhost/myapp/resume? access_token=abc ... access_token=abc
- 8. Acting as theuser to do things (e.g., retrieve his profile info) Google https://profile.google.com Your web app https://profile.google.com? clientId=app123& access_token=abc { "user_name":"kent", ... } May be a dedicated server for retrieving user profile.
- 9. However, the tokenis for the web app but handed to the browser Google Grant permission to app 123? Browser OK Redirect to: http://localhost/myapp/resume? access_token=abc If the browser has been hacked, the hacker can use the access token and pretend to be your web app. Your web app ... access_token=abc
- 10. Sending an authorizationcode instead of the access token Google Grant permission to app 123? Browser OK Your web app Redirect to: http://localhost/myapp/resume? code=xyz ...?code=xyz
- 11. The authorization codeCANNOT be used to do things as the user Google https://profile.google.com Browser or hacker https://profile.google.com? clientId=app123& access_token=xyz "invalid access token"
- 12. The app canget an access token with the authorization code Google https://token.google.com Grant permission to app 123? Browser OK Your web app ...?code=xyz https://token.google.com? client_id=app123& client_secret=aaa code=xyz { "access_token":"abc", ... } Google Only the web app and Google know this client secret. Allow? Redirect. May be a dedicated server for getting an access token.
- 13. Acting as theuser to do things Google https://profile.google.com Your web app http://localhost/myapp https://profile.google.com? clientId=app123& access_token=abc { "user_name":"kent", ... }
- 14. The app wantseverything or just simple things like email? Your web app Browser Google Redirect to: https://auth.google.com? client_id=app123& scope=public_info& redirect_url=http://localhost/myapp/resume https://auth.google.comhttps://auth.google.com? client_id=app123& scope=public_info& ... The available scope values and meanings are decided by the auth server.
- 15. app wants everythingor just simple things like email? Google https://auth.google.com Grant permission to read your public info to app 123? Browser OK Your web app Redirect