What is OAuth 2.0 and why is it important?

OAuth2.0 is an authorization standard used to allow apps to request information from another application on behalf of a user. Using this standard, third party applications can access resources from other applications for a user without compromising sensitive information such as passwords. For example, you can sign in to applications like Spotify with your Google account without sharing your password.

How does OAuth 2.0 work?

OAuth2.0 uses access tokens in place of actual user credentials to maintain a layer of security between applications interacting with each other. Before going into details of how that works, it is important to understand the different roles involved in this authorization protocol.

OAuth 2.0 Roles:

Resource Owner:

This is the system that owns what an application is trying to access. In Google and Spotify’s example, Spotify is the resource owner.
Client: The client is the application that wants to access a user’s data from the resource owner. In our example, Google is the client application that needs to access Spotify data for the user.

Resource Server:

The resource server holds the accounts information for all the users of the resource, i.e. Spotify. The client (Google) will need to create an access request to this server before it can get the data.

Authorization Server:

This server verifies the client’s identity and provides it with the tokens needed to request access from the resource server. For example, this server will check the validity of the Google account that needs to connect to Spotify.

From a development perspective, a single API can function as both resource and authorization servers.

Function:

This is how OAuth2.0 works for a user requesting access to a third party using an application:

1. The Client obtains its credentials, namely a client ID and a client secret, from the Authorization Server to serve as identification.
2. The Client requests an Access Token from the Authorization Server using the client ID and client secret. In the request, it also provides the scope of access and a redirect URI where the Access Token should be sent by the server.
3. The Authorization Server authenticates the Client, validates the scope, and interacts with the Resource Owner to obtain a grant.
4. Once access has been granted, the Authorization Server provides the Client with an Access Token.
5. The Client presents the Access Token as identification to the Resource Server to request access to the desired resources.
6. If Token is validated, the resources are provided to the Client.

Why OAuth2.0 is Important

OAuth2.0 has become the industry standard for web and desktop applications, and there are good reasons for that:

1. It allows applications to access data from other apps on the behalf of the user without compromising on the user’s credentials.
2. It is easy to implement, which means developers can create integrations for different platforms much more quickly, while maintaining a high standard of security.
3. It allows for Single Sign On (SSO), which is where users can use one account to sign in to multiple applications, such as using a single Google account for different social media accounts. This reduces the need to remember different passwords for different accounts.

In conclusion, OAuth2.0 saves time for developers, provides ease of access to users, and mitigates risks associated with data sharing between applications.

Interested in our services? Get in touch for a FREE business analysis session. We are glad to assist you!