Sign In Start Free Trial

Book Overview & Buying
Table Of Contents
Feedback & Rating

Mastering OAuth 2.0

3.5 (6)

Mastering OAuth 2.0

3.5 (6)

Overview of this book

OAuth 2.0 is a powerful authentication and authorization framework that has been adopted as a standard in the technical community. Proper use of this protocol will enable your application to interact with the world's most popular service providers, allowing you to leverage their world-class technologies in your own application. Want to log your user in to your application with their Facebook account? Want to display an interactive Google Map in your application? How about posting an update to your user's LinkedIn feed? This is all achievable through the power of OAuth. With a focus on practicality and security, this book takes a detailed and hands-on approach to explaining the protocol, highlighting important pieces of information along the way. At the beginning, you will learn what OAuth is, how it works at a high level, and the steps involved in creating an application. After obtaining an overview of OAuth, you will move on to the second part of the book where you will learn the need for and importance of registering your application and types of supported workflows. You will discover more about the access token, how you can use it with your application, and how to refresh it after expiration. By the end of the book, you will know how to make your application architecture robust. You will explore the security considerations and effective methods to debug your applications using appropriate tools. You will also have a look at special considerations to integrate with OAuth service providers via native mobile applications. In addition, you will also come across support resources for OAuth and credentials grant.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Why Should I Care About OAuth 2.0?

1. Why Should I Care About OAuth 2.0?

Authentication versus authorization

What problems does it solve?

How does OAuth 2.0 actually solve the problem?

Who uses OAuth 2.0?

Introducing "The World's Most Interesting Infographic Generator"

Summary

2. A Bird's Eye View of OAuth 2.0

2. A Bird's Eye View of OAuth 2.0

How does it work?

First look at the client-side flow

First look at the server-side flow

What are the differences?

What about mobile?

Summary

3. Four Easy Steps

3. Four Easy Steps

Let's get started

Step 1 – Register your client application

Step 2 – Get your access token

Step 3 – Use your access token

Step 4 – Refresh your access token

Putting it all together

Summary

4. Register Your Application

4. Register Your Application

Recap of registration process

Registering your application with Facebook

Putting it all together!

Summary

5. Get an Access Token with the Client-Side Flow

5. Get an Access Token with the Client-Side Flow

Refresher on the implicit grant flow

A closer look at the implicit grant flow

Let's build it!

Summary

Reference pages

6. Get an Access Token with the Server-Side Flow

6. Get an Access Token with the Server-Side Flow

Refresher on the authorization code grant flow

A closer look at the authorization code grant flow

Let's build it!

Summary

Reference pages

7. Use Your Access Token

7. Use Your Access Token

Refresher on access tokens

Use your access token to make an API call

Let's build it!

Creating the world's most interesting infographic

Summary

Reference pages

8. Refresh Your Access Token

8. Refresh Your Access Token

A closer look at the refresh token flow

What if I have no refresh token? Or my refresh token has expired?

The ideal workflow

Summary

Reference pages

9. Security Considerations

9. Security Considerations

What's at stake?

Security best practices

Common attacks

Summary

10. What About Mobile?

10. What About Mobile?

What is a mobile application?

What flow should we use for mobile applications?

Hybrid architectures

Authorization via application instead of user-agent

Summary

11. Tooling and Troubleshooting

11. Tooling and Troubleshooting

Tools

Troubleshooting

Summary

12. Extensions to OAuth 2.0

12. Extensions to OAuth 2.0

Extensions to the OAuth 2.0 framework

OpenID Connect

Summary

A. Resource Owner Password Credentials Grant

A. Resource Owner Password Credentials Grant

When should you use it?

Reference pages

B. Client Credentials Grant

B. Client Credentials Grant

When should you use it?

Reference pages

Overview of the client credentials grant

C. Reference Specifications

C. Reference Specifications

The OAuth 2 Authorization Framework

The OAuth 2 Authorization Framework: Bearer Token Usage

OAuth 2.0 Token Revocation

OAuth 2.0 Thread Model and Security Considerations

Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants

Security Assertion Markup Language (SAML) 2.0 Profile for OAuth 2.0 Client Authentication and Authorization Grants

JSON Web Token (JWT)

JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants

OpenID Connect Core 1.0

HTTP Authentication: Basic and Digest Access Authentication

Index

Index

Customer Reviews

3.5 (6)

5 star

50%

4 star

16.7%

3 star

0

2 star

0

1 star

33.3%

What this book covers

Chapter 1, Why Should I Care About OAuth 2.0?, introduces the OAuth 2.0 protocol, and discusses its purpose, prevalence, and importance.

Chapter 2, A Bird's Eye View of OAuth 2.0, takes a high-level look at the OAuth 2.0 protocol and the different workflows it describes.

Chapter 3, Four Easy Steps, enumerates the simple steps necessary to integrate with a service provider using the OAuth 2.0 protocol.

Chapter 4, Register Your Application, details the first of these four steps which covers registering your application with the service provider.

Chapter 5, Get an Access Token with the Client-Side Flow, discusses the complicated topic of gaining access to a protected resource from what we call an untrusted client.

Chapter 6, Get an Access Token with the Server-Side Flow, discusses the complicated topic of gaining access to a protected resource from what we call a trusted client.

Chapter 7, Use Your Access Token, outlines the process for exercising access to a resource once it has been granted to you.

Chapter 8, Refresh Your Access Token, talks about the process of refreshing your access once it expires.

Chapter 9, Security Considerations, discusses the many important security considerations to be made in your application. This is an important topic for any application, but is especially important given the power that this protocol allows.

Chapter 10, What About Mobile?, is a chapter dedicated to the topic of mobile devices, including phones and tablets, and all of the considerations that come with it.

Chapter 11, Tooling and Troubleshooting, talks about how to troubleshoot issues with your integration as well as how to appropriately handle errors so as to minimize user interaction.

Chapter 12, Extensions to OAuth 2.0, looks at the various ways OAuth 2.0 can be extended to satisfy a multitude of use cases.

Appendix A, Resource Owner Password Credentials Grant, takes a look at one of the supplemental supported flows in the book.

Appendix B, Client Credentials Grant, takes a look at another of the supplemental supported flows in the book.

Appendix C, Reference Specifications, enumerates the various open specifications that are referenced throughout the book.

Search

Your notes and bookmarks