Oauth 2.0
How It's Made
Gerard
Svietlana
Gerard
Svietlana
Czesio
Andrzej
Czesio
Andrzej
- Notariusz
- Weryfikuje strony umowy
- Wydaje dokument autoryzacyjny
- Weryfikuje dokument autoryzacyjny
- Nadaje klucz dostępu do określonych szafek
Authorization Code
Svietlana
Czesio
Gerard
Kto: Gerard
Komu: Svietlanie
Numery szafek: 1, 2 ,3
Dokument autoryzacyjny
Authorization Code
Svietlana
Kto: Gerard
Komu: Svietlanie
Numery szafek: 1, 2 ,3
Andrzej
PIN: 8909
PUK: 9876
Svietlana - Client
Kto: Gerard
Komu: Svietlanie
Numery szafek: 1, 2 ,3
Authorization Server
PIN: 8909
PUK: 9876
Czesio
/authorize
Andrzej
/token
Gerard - Resource owner
Resource Server
Authorization Code
Access & Refresh Code
response_type = code
client_id = Svietlana
redirect_uri = sprzatamy.com/callback
scope = 1 2 3
state = 9natvp98n4wtpaw4nvao9tv4acode = ao9wrhcoaw8noraw3ncra
state = 9natvp98n4wtpaw4nvao9tv4agrant_type = authorization_code
code = ao9wrhcoaw8noraw3ncra
redirect_uri = sprzatamy.com/callback
client_id = Svietlana{
"access_token":"2YotnFZFEjr1zCsicMWpAA",
"token_type":"example",
"expires_in":3600,
"refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
"example_parameter":"example_value"
}
Implicit Grant
- Clients are typically implemented in a browser using a scripting language such as JavaScript.
- Access token returned in URL fragment component
http://example.com/cb#access_token=2YotnFZFEjr1zCsicMWpAA
&state=xyz&token_type=example&expires_in=3600
Resource Owner
Password Credentials Grant
Client Credentials Grant
Access Token
- Format is undefined
- Should be opaque
- JWT is very popular
- Should expire
- Keep securly
Security threats
Authorization Code Redirection URI Manipulation
Solution: Compare redirect_uri
Cross-Site Request Forgery
Solution: "state" param
Clickjacking
Solution: x-frame-options header
Mobile Apps
- Recommended to use external browser (dropped support for embedded)
- PKCE for client authentication
- Private URI scheme for redirect_url
Registering application
Bydzie.
Ku pamięci @weeman
deck
By Adam Mazur
