Skip to content

Home

Jump to bottom
saeedprogrammer edited this page May 9, 2021 · 5 revisions

Welcome to the OpenID-with-iOS wiki!

OAuth(Open Authorization) is protocol for token-based authorization

OAuth2 main components:

  • Scopes
  • Flows

Scopes:

It's like a permission grant to clients to allow them access certain resources and prevent them from others. So, if a client has READ scope, and it tries to call an API endpoint that requires WRITE access, the call will fail.

Flows:

  • Implicit Flow(2 Legged OAuth):
  1. Communication to get access-token is done using browser. So, access-token returned from browser to the app directly(front-channel)
  2. No refresh token required , because access-token in this flow permanent.
  • Authorization Code(3 Legged OAuth):
  1. Communication to get access-token is done in tow steps.
    • The browser return authorization-code to the app (front-channel).
    • The app then will connect with auth server and exchange authorization-code with access-token (back-channel).
  2. Refresh token optionally.
  3. It's more secure ,because access-token not passed through browser , but app request it directly
Clone this wiki locally