OAuth 2.0
OAuth 2.0
It's about time I learn this shit. Here are some notes as I am going through a Getting Started with OAuth2.0 course.
OAuth 2.0 is an authorization framework specifically built for HTTP APIs.
It's a delegation protocol. It's all about scoping access to the API.
There are 4 players:
- the protected resource (an HTTP API)
- the client (requesting application)
- resource owner (the user who owns the data)
- authorization server (trusted by all parties involved)
The OAuth Dance
client application makes an authorization request to the authorization server -- done by the browser so the resource owner gets physically redirected from the client application to the authorization server.
authorization server challenges the user to verify their identity. they need to authenticate. this can be email/password, google, facebook, etc.
user needs to consent to the authorization request -- e.g., Notion (the client application) requesting authorization to read my Gmail messages and contacts) -- its up to me (the user / data owner) to authorize that.
after consenting, the user is redirected to the client application with an authorization grant
client application sends another request to the authorization server that includes the grant.
authorization server responds to the client application with an access token
this access token can be used by the client application to authorize requests to the protected resource (API). this request includes a header like
Authorization: Bearer f4halkx7x7s8192jxlsxkprotect resource responds to the client application