0

I am using Spring MVC project in the server to provide APIs to access data from both mobile-app and web-app.

Done research on security with Oauth 2.0 and thought Authorization code flow is suitable for both app's mentioned above, but little confusion on that. Can anyone tell which flow is best suitable for this type of scenario?

info:I need to implement Oauth 2.0 in server-side(Spring MVC project deployed in AWS).

User
  • 89
  • 2
  • 13

1 Answers1

0

If you are implementing your own authorization server and you already handle your consumerDB, I don't think you need an authorization code grant type of oAuth2. You can use Client Credential or ROPC. Authorization code is used when the log in is handled by a 3rd party (auth server).

There are 4 grant types in oAuth2 which is meant for different scenarios.. Refer : Securing an existing API with our own solution

Abbin Varghese
  • 2,422
  • 5
  • 28
  • 42