Browse Library
Sign In Start Free Trial
Close icon Search icon
Account
Browse Library Advanced Search Sign In Start Free Trial

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Mastering OAuth 2.0
  • Toc
  • feedback
Mastering OAuth 2.0

Mastering OAuth 2.0

3.5 (6)
close
Mastering OAuth 2.0

Mastering OAuth 2.0

3.5 (6)

Overview of this book

OAuth 2.0 is a powerful authentication and authorization framework that has been adopted as a standard in the technical community. Proper use of this protocol will enable your application to interact with the world's most popular service providers, allowing you to leverage their world-class technologies in your own application. Want to log your user in to your application with their Facebook account? Want to display an interactive Google Map in your application? How about posting an update to your user's LinkedIn feed? This is all achievable through the power of OAuth. With a focus on practicality and security, this book takes a detailed and hands-on approach to explaining the protocol, highlighting important pieces of information along the way. At the beginning, you will learn what OAuth is, how it works at a high level, and the steps involved in creating an application. After obtaining an overview of OAuth, you will move on to the second part of the book where you will learn the need for and importance of registering your application and types of supported workflows. You will discover more about the access token, how you can use it with your application, and how to refresh it after expiration. By the end of the book, you will know how to make your application architecture robust. You will explore the security considerations and effective methods to debug your applications using appropriate tools. You will also have a look at special considerations to integrate with OAuth service providers via native mobile applications. In addition, you will also come across support resources for OAuth and credentials grant.
Table of Contents (17 chapters)
close
close
Preface
chevron up
Preface
What this book covers
What you need for this book
Who this book is for
Conventions
Reader feedback
Customer support
Free Chapter
1
1. Why Should I Care About OAuth 2.0?
1. Why Should I Care About OAuth 2.0?
Authentication versus authorization
What problems does it solve?
How does OAuth 2.0 actually solve the problem?
Who uses OAuth 2.0?
Introducing "The World's Most Interesting Infographic Generator"
Summary
2
2. A Bird's Eye View of OAuth 2.0
2. A Bird's Eye View of OAuth 2.0
How does it work?
First look at the client-side flow
First look at the server-side flow
What are the differences?
What about mobile?
Summary
3
3. Four Easy Steps
3. Four Easy Steps
Let's get started
Step 1 – Register your client application
Step 2 – Get your access token
Step 3 – Use your access token
Step 4 – Refresh your access token
Putting it all together
Summary
4
4. Register Your Application
4. Register Your Application
Recap of registration process
Registering your application with Facebook
Putting it all together!
Summary
5
5. Get an Access Token with the Client-Side Flow
5. Get an Access Token with the Client-Side Flow
Refresher on the implicit grant flow
A closer look at the implicit grant flow
Let's build it!
Summary
Reference pages
6
6. Get an Access Token with the Server-Side Flow
6. Get an Access Token with the Server-Side Flow
Refresher on the authorization code grant flow
A closer look at the authorization code grant flow
Let's build it!
Summary
Reference pages
7
7. Use Your Access Token
7. Use Your Access Token
Refresher on access tokens
Use your access token to make an API call
Let's build it!
Creating the world's most interesting infographic
Summary
Reference pages
8
8. Refresh Your Access Token
8. Refresh Your Access Token
A closer look at the refresh token flow
What if I have no refresh token? Or my refresh token has expired?
The ideal workflow
Summary
Reference pages
9
9. Security Considerations
9. Security Considerations
What's at stake?
Security best practices
Common attacks
Summary
10
10. What About Mobile?
10. What About Mobile?
What is a mobile application?
What flow should we use for mobile applications?
Hybrid architectures
Authorization via application instead of user-agent
Summary
11
11. Tooling and Troubleshooting
11. Tooling and Troubleshooting
Tools
Troubleshooting
Summary
12
12. Extensions to OAuth 2.0
12. Extensions to OAuth 2.0
Extensions to the OAuth 2.0 framework
OpenID Connect
Summary
13
A. Resource Owner Password Credentials Grant
A. Resource Owner Password Credentials Grant
When should you use it?
Reference pages
14
B. Client Credentials Grant
B. Client Credentials Grant
When should you use it?
Reference pages
Overview of the client credentials grant
15
C. Reference Specifications
C. Reference Specifications
The OAuth 2 Authorization Framework
The OAuth 2 Authorization Framework: Bearer Token Usage
OAuth 2.0 Token Revocation
OAuth 2.0 Thread Model and Security Considerations
Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants
Security Assertion Markup Language (SAML) 2.0 Profile for OAuth 2.0 Client Authentication and Authorization Grants
JSON Web Token (JWT)
JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants
OpenID Connect Core 1.0
HTTP Authentication: Basic and Digest Access Authentication
16
Index
Index

Preface

The Internet is a thriving and dynamic ecosystem. Living and playing within this ecosystem are many world-class services, all offering world-class technologies. Think about the massive social graph that Facebook hosts, the most up-to-date mapping system proudly owned and operated by Google, or the ever-growing professional network that is available from LinkedIn. All of these companies, and more, are presenting their world-class technologies for the world to use!

Until recently, it was very difficult to access these technologies in your own applications. Each company would create their own protocols for how to access and leverage their respective technologies. You may have heard of Yahoo!'s BBAuth, or Google's AuthSub. These are just a couple of examples of proprietary protocols created to allow people to leverage these company's services. Unfortunately, the trend of creating and using proprietary protocols just doesn't scale. Enter OAuth 2.0.

OAuth 2.0 is an open protocol for delegating authorization to such services, and it has become the standard authorization protocol used by companies around the world. It allows developers like you and I to access these world-class technologies and use them in our own applications! It is a fascinating problem space with an equally fascinating and elegant solution.

I've been lucky enough to work in the Identity space for the past 7 years, and during this time, I've been able to witness the evolution and progression of this protocol. Mastering OAuth 2.0 is an attempt at distilling the most important parts of the protocol, including design and usage. With a hard focus on practicality and security, this book focuses on the parts of integration that will give application developers like you and I the most benefit and mileage.

As OAuth 2.0 continues to gain adoption, and more and more services become available for developers to integrate with and leverage, I'm hoping that this book will allow you to be able to comfortably dive in and start building the next generation of world-class applications and technologies!

Unlock full access

Continue reading for free

A Packt free trial gives you instant online access to our library of over 7000 practical eBooks and videos, constantly updated with the latest in tech
Start a 7-day FREE trial
Next Section
bookmark search playlist download
font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected
Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete