OAuth 2.0

OAuth is an open protocol that allows secure authorization in a simple and standard method from web, mobile and desktop applications. 

It specifies a process for resource owners to authorize third-party access to their server resources without sharing their credentials.

Designed specifically to work with Hypertext Transfer Protocol (HTTP), OAuth essentially allows access tokens to be issued to third-party clients by an authorization server, with the approval of the resource owner. The third party then uses the access token to access the protected resources hosted by the resource server.

OAuth2 Roles: There are four roles which can be applied on OAuth2.

1. Resource Owner: The owner of the resource

2. Resource Server: It serves resources that are protected by the OAuth2 token.

3. Client: The application accessing the resource server.

4. Authorization Server: The server issuing access tokens to the client after successfully authenticating the resource owner and obtaining authorization.

OAuth2 Tokens: Tokens are implementation-specific random strings generated by the authorization server.

• Access Token: It is sent with each request, usually valid for about an hour only.

Authorization Workflow

The OAuth authorization is shown below.

1. Client Requests Authorization.

2. Resource owner grants permission.

3. Client requests token using authorization grant.

4. Access token sent to client.

5. Client authenticates to resource server using token.

6. Resource server validates the access token and serves the request.