OAuth 2.0
OAuth 2.0 is the standard authorization framework for delegated access. It lets a client obtain limited access to a resource owner's data without handling their credentials. OAuth 2.0 is defined by RFC 6749; modern usage should follow OAuth 2.1 guidance, which removes deprecated flows and bakes in PKCE.
The most common OAuth mistake is using it for authentication. OAuth answers "may this client access that resource", not "who is this person", and building a login on the presence of an access token produces well-known impersonation bugs. Use OIDC when you need identity. OAuth 2.1 consolidates the current best practice: authorization code with PKCE everywhere, no implicit flow, no password grant.
See also: OAuth 2.0, OAuth 2.1, OAuth vs OIDC, protect an API with OAuth scopes recipe, GNAP
Related on Start with Identity
- GlossaryResource Indicators for OAuth 2.0
Resource Indicators for OAuth 2.0 ([RFC 8707](https://www.rfc-editor.org/rfc/rfc8707), Proposed Standard, February 2020) define a `resource` request parameter a
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- GlossaryAuthorization Server
In OAuth 2.0, the component that authenticates the resource owner, obtains their authorization, and issues access tokens to clients. It exposes the authorizatio
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- BlogConsentFix: hijacking Microsoft 365 through the OAuth consent flow
ConsentFix adapts the ClickFix pattern to identity. Instead of running a command on the victim's machine, it walks them through an OAuth consent flow and asks t
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.