reading-notes

🗒️ Class 15

What is OAuth

Oauth is a open-standard authentication protocol created and stronly supported by Twitter, Google and other companies.

WHen you go to a website and try to log onto it and it offers the ability to logon using another service such as Github, google, or twitter.

User selects what sercive they want to use to connect to the first website with. The service provider will generate a token and secret and sends it to the first website. Once approved, the first website will get an access token and secret that will allow them to connect using the selected service provider.

simply put, OpenID is a service used for humans logging into a machine (server) where as Oauth is a machine logging into a machine.

Authorization and Authentication flows

Auhorization is what you are allowed to access in an applicaiton and authentication is verifying who the user is.

Authorization code flow is the process of exchanging Authorization codes for tokens and granting access.

An authorization method that uses a different grant type because the application doesnt support soring of client secrets. Instead it uses an authorization server, such as Code Verifier, to generate a secret.

A method that uses an authorization code flow from the backend to create an ID Token. This method eliminates the need for secrets and any additional backend calls.

A method that allows an application to authenticate and authorize using only a client ID and Secret

Device authorization flow provides the user with a link to their device or email and they access that link via their smart phone or thorugh the email.

A resource owner password flow is a method that requests the user to provide their username and password and get sent to the backend to be authenticated and then exchanged for an access token.