OAuth

The Authorization Problem OAuth Solves

Before OAuth, granting a third-party app access to your data meant sharing your password — a catastrophic trust model. OAuth 2.0 introduces delegated authorization: a resource owner (you) grants a client application limited access to a server on your behalf, without ever exposing credentials. The client receives a scoped access token instead.

Authorization Flows

OAuth 2.0 defines several grant types for different contexts. The Authorization Code Flow — used by web apps — redirects users to an authorization server, which issues a short-lived code that the backend exchanges for a token over HTTPSHTTP Secure. The encrypted version of HTTP that uses TLS to protect data in transit between a browser and a web server. Identified by the padlock icon in browsers and the https:// URL scheme.. The Client Credentials Flow handles machine-to-machine communication where no user is involved. JWTJSON Web Token. A compact, URL-safe token format for securely transmitting claims between parties as a signed (and optionally encrypted) JSON object. Commonly used for authentication and authorization in web APIs. tokens are commonly used as the access token format, embedding claims that resource servers can verify without a database lookup.

Security Boundaries and Token Management

OAuth scopes limit what an access token can do — a token issued for read:email cannot modify account settings. Tokens expire, forcing re-authorization or use of a refresh token. SSL/TLSSecure Sockets Layer / Transport Layer Security. Cryptographic protocols that provide encrypted, authenticated communication over a network. SSL is deprecated; modern implementations use TLS 1.2 or TLS 1.3. is mandatory for all OAuth exchanges; tokens transmitted over plain HTTPHypertext Transfer Protocol. The application-layer protocol for transmitting web pages, APIs, and other resources. HTTP defines methods (GET, POST, PUT, DELETE) and status codes for client-server communication. are trivially stolen. Rate LimitingA technique that restricts the number of requests a client can make to an API or server within a time window. Rate limiting protects against abuse, brute-force attacks, and resource exhaustion. on token endpoints prevents brute-force and enumeration attacks. The related OpenID Connect (OIDC) standard builds on OAuth to add authentication, issuing an ID token alongside the access token.