You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/routes/blog/post/understand-oauth2/+page.markdoc
+20-20Lines changed: 20 additions & 20 deletions
Original file line number
Diff line number
Diff line change
@@ -11,34 +11,34 @@ unlisted: true
11
11
category: product
12
12
---
13
13
14
-
In today’s interconnected app ecosystem, users expect seamless, secure access across services. OAuth 2.0 has emerged as the industry standard for handling secure delegated access, making it a critical protocol for developers to understand.
14
+
In today’s interconnected app ecosystem, users expect seamless, secure access across services. OAuth2 has emerged as the industry standard for handling secure delegated access, making it a critical protocol for developers to understand.
15
15
16
-
This guide explains OAuth 2.0, how it works, the different flows available, and when to use each one, helping you build secure, scalable authorization experiences.
16
+
This guide explains OAuth2, how it works, the different flows available, and when to use each one, helping you build secure, scalable authorization experiences.
17
17
18
-
# What is OAuth 2.0?
18
+
# What is OAuth2?
19
19
20
-
OAuth 2.0 is an open standard for authorization. It allows users to grant limited access to their resources on one service to another service without sharing credentials.
20
+
OAuth2 is an open standard for authorization. It allows users to grant limited access to their resources on one service to another service without sharing credentials.
21
21
22
-
Rather than handing out a username and password, users authorize apps to act on their behalf using access tokens. OAuth 2.0 ensures that:
22
+
Rather than handing out a username and password, users authorize apps to act on their behalf using access tokens. OAuth2 ensures that:
23
23
24
24
- Apps never directly handle user credentials.
25
25
- Users retain control over what permissions they grant.
26
26
- Access can be easily revoked.
27
27
28
-
# Core components of OAuth 2.0
28
+
# Core components of OAuth2
29
29
30
30
Before diving into the flows, it's important to understand the key players:
31
31
32
-
- **Resource Owner**: The user who authorizes access to their data.
32
+
- **Resource owner**: The user who authorizes access to their data.
33
33
- **Client**: The application requesting access.
34
-
- **Authorization Server**: Issues access tokens after authenticating the user.
35
-
- **Resource Server**: Hosts the protected resources.
34
+
- **Authorization server**: Issues access tokens after authenticating the user.
35
+
- **Resource server**: Hosts the protected resources.
36
36
37
37
These components work together to ensure secure authorization across systems.
38
38
39
39
Refer to the OAuth2 [documentation](/docs/product/auth/oauth2) for complete technical details.
40
40
41
-
# How OAuth 2.0 works: A simple flow
41
+
# How OAuth2 works: A simple flow
42
42
43
43
1. **Authorization request**: The client asks the resource owner for permission.
44
44
2. **Authorization grant**: If the user consents, the server issues a grant (authorization code, token, etc.).
@@ -47,9 +47,9 @@ Refer to the OAuth2 [documentation](/docs/product/auth/oauth2) for complete tech
47
47
48
48
Tokens are typically short-lived and scoped, meaning they only allow the operations the user approved.
49
49
50
-
# Major OAuth 2.0 flows
50
+
# Major OAuth2 flows
51
51
52
-
OAuth 2.0 offers different "flows" to accommodate various scenarios. Here's a breakdown of the major ones:
52
+
OAuth2 offers different "flows" to accommodate various scenarios. Here's a breakdown of the major ones:
53
53
54
54
## 1. Authorization code flow
55
55
@@ -123,36 +123,36 @@ OAuth 2.0 offers different "flows" to accommodate various scenarios. Here's a br
123
123
124
124
[Appwrite Auth](/products/auth) supports all major OAuth2 flows, making it easy to integrate secure authentication into any app
125
125
126
-
# OAuth 2.0 Tokens: Access and refresh
126
+
# OAuth2 Tokens: Access and refresh
127
127
128
-
OAuth 2.0 commonly uses two types of tokens:
128
+
OAuth2 commonly uses two types of tokens:
129
129
130
130
- **Access Token**: Grants access to protected resources.
131
131
- **Refresh Token**: Used to obtain new access tokens without re-authenticating the user.
132
132
133
133
Tokens are often JWTs (JSON Web Tokens) containing claims about the user and the permissions granted.
134
134
135
-
# When to Use OAuth 2.0
135
+
# When to Use OAuth2
136
136
137
137
- **Third-party integrations**: Allowing users to connect external services securely.
138
138
- **APIs**: Protecting APIs from unauthorized access.
139
139
- **Mobile and web Apps**: Enabling secure login and data access without managing credentials.
- **Over-scoped tokens**: Granting too many permissions.
145
145
- **Insecure storage**: Storing tokens in insecure locations (e.g., localStorage without encryption).
146
146
- **Ignoring token expiration**: Failing to handle token refresh flows.
147
147
- **Misusing Implicit Flow**: Using legacy flows where better options (PKCE) are available.
148
148
149
-
# OAuth 2.0: A key enabler of modern security
149
+
# OAuth2: A key enabler of modern security
150
150
151
-
OAuth 2.0 powers secure, flexible authorization across the modern internet. Understanding its core flows and best practices helps developers build safer, more user-friendly apps.
151
+
OAuth2 powers secure, flexible authorization across the modern internet. Understanding its core flows and best practices helps developers build safer, more user-friendly apps.
152
152
153
-
Choosing the proper OAuth 2.0 flow based on your application's architecture and user needs is critical to balancing security, usability, and scalability.
153
+
Choosing the proper OAuth2 flow based on your application's architecture and user needs is critical to balancing security, usability, and scalability.
0 commit comments