Oauth 2.0

How It's Made

Gerard

Svietlana

Gerard

Svietlana

Czesio

Andrzej

Czesio

Andrzej

Notariusz
Weryfikuje strony umowy
Wydaje dokument autoryzacyjny

Weryfikuje dokument autoryzacyjny
Nadaje klucz dostępu do określonych szafek

Authorization Code

Svietlana

Czesio

Gerard

Kto: Gerard

Komu: Svietlanie

Numery szafek: 1, 2 ,3

Dokument autoryzacyjny

Authorization Code

Svietlana

Kto: Gerard

Komu: Svietlanie

Numery szafek: 1, 2 ,3

Andrzej

PIN: 8909

PUK: 9876

Svietlana - Client

Kto: Gerard

Komu: Svietlanie

Numery szafek: 1, 2 ,3

Authorization Server

PIN: 8909

PUK: 9876

Czesio

/authorize

Andrzej

/token

Gerard - Resource owner

Resource Server

Authorization Code

Access & Refresh Code

response_type = code
client_id = Svietlana
redirect_uri = sprzatamy.com/callback
scope = 1 2 3
state = 9natvp98n4wtpaw4nvao9tv4a

code = ao9wrhcoaw8noraw3ncra
state = 9natvp98n4wtpaw4nvao9tv4a

grant_type = authorization_code
code = ao9wrhcoaw8noraw3ncra
redirect_uri = sprzatamy.com/callback
client_id = Svietlana

{
 "access_token":"2YotnFZFEjr1zCsicMWpAA",
 "token_type":"example",
 "expires_in":3600,
 "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
 "example_parameter":"example_value"
}

Implicit Grant

Clients are typically implemented in a browser using a scripting language such as JavaScript.
Access token returned in URL fragment component

http://example.com/cb#access_token=2YotnFZFEjr1zCsicMWpAA
&state=xyz&token_type=example&expires_in=3600

Resource Owner

Password Credentials Grant

Client Credentials Grant

Access Token

Format is undefined
Should be opaque
JWT is very popular
Should expire
Keep securly

Security threats

Authorization Code Redirection URI Manipulation

Solution: Compare redirect_uri

Cross-Site Request Forgery

Solution: "state" param

Clickjacking

Solution: x-frame-options header

Mobile Apps

Recommended to use external browser (dropped support for embedded)
PKCE for client authentication
Private URI scheme for redirect_url

Registering application

Bydzie.

Ku pamięci @weeman