English
Menu

What is OAuth?

A mechanism that lets users allow another application (the client) limited access to their resources without handing over their passwords (delegated authorization). OAuth 2.0 is widely used. It has four roles: the resource owner (the user), the client, the authorization server, which obtains the user's consent and issues access tokens, and the resource server, which checks tokens and returns resources. OAuth itself is an authorization mechanism; for logging in (authentication), OpenID Connect, which adds ID tokens, is used.

Japanese name: OAuth

OAuth appears in 2 practice questions across 1 topic, including Web Technology Basics.

Field: Web Technology Basics

Try it: questions about OAuth

A photo-printing app, with the user's permission, reads the user's photos stored on another company's photo storage service. In OAuth 2.0, which of the following roles shows the user a screen asking for permission and, when the user agrees, issues an access token to the app?

  1. AResource server
  2. BAuthorization server
  3. CClient
Show answer and explanation

Answer: B. Authorization server

OAuth 2.0 has four roles: the resource owner (the user), the client (the photo-printing app), the authorization server and the resource server (the API that returns the photos). The authorization server confirms the user and obtains consent, then issues the client an access token limited in scope and lifetime. The client calls the resource server's API with the token, and the resource server checks the token and returns the photos. The user does not have to give the app the password for the photo storage service and can also revoke the permission later.

Which of the following correctly describes the relationship between OAuth 2.0 and OpenID Connect?

  1. AOAuth 2.0 is a mechanism for delegating permission to access resources (authorization), and OpenID Connect builds on it by adding an ID token that conveys the result of authentication, so that it can be used for login
  2. BOAuth 2.0 is a mechanism for conveying the result of user authentication, and OpenID Connect does not use it but sends the user's password directly to each connected service to check it
  3. COpenID Connect is a protocol for encrypting HTTP communication and is used instead of TLS when sending login screens
Show answer and explanation

Answer: A. OAuth 2.0 is a mechanism for delegating permission to access resources (authorization), and OpenID Connect builds on it by adding an ID token that conveys the result of authentication, so that it can be used for login

An OAuth 2.0 access token represents permission, meaning "you may use resources within this scope", and is not designed to confirm who has logged in. OpenID Connect adds to the OAuth 2.0 flow an ID token in the form of a signed JWT. The ID token contains the issuer, the user identifier, the intended client, the expiry and so on, and the client checks the signature and contents to learn who the user is. This mechanism is used for features that let users log in with an account from another service and for single sign-on.

OAuth in the explanations

Questions that mention OAuth (2)

  1. A photo-printing app, with the user's permission, reads the user's photos stored on another company's photo storage service. In OAuth 2.0, which of the following roles shows the user a screen asking for permission and, when the user agrees, issues an access token to the app?
  2. Which of the following correctly describes the relationship between OAuth 2.0 and OpenID Connect?

Books on Web Technology Basics Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

JWT (JSON Web Token) Cookie (HTTP cookie) CORS (cross-origin resource sharing) DOM (Document Object Model) Event loop HTTP (Hypertext Transfer Protocol) HTTP method HTTP status code JSON (JavaScript Object Notation) REST API

Back to the glossary