Stack Overflow
Stack Overflow

Questions tagged [oauth]

OAuth (Open Authorization) is a specification for client applications to access protected resources on behalf of a user. It was developed as an alternative to users handing out their login credentials to third-party applications.

Description

OAuth is an open standard for authorization. OAuth provides client applications a 'secure delegated access' to server resources on behalf of a resource owner. It specifies a process for resource owners to authorize third-party access to their server resources without sharing their credentials. Designed specifically to work with Hypertext Transfer Protocol (HTTP), OAuth essentially allows access tokens to be issued to third-party clients by an authorization server, with the approval of the resource owner, or end-user. The client then uses the access token to access the protected resources hosted by the resource server. OAuth is commonly used as a way for web surfers to log into third party web sites using their Google, Facebook or Twitter passwords, without worrying about their access credentials being compromised.

OAuth is a service that is complementary to, and therefore distinct from, OpenID. OAuth is also distinct from OATH, which is a reference architecture for authentication, not a standard.

Resources

20112 questions
33
votes
2 answers

Can I really not ship open source with Client ID?

Developer credentials (such as passwords, keys, and client IDs) are intended to be used by you and identify your API Client. You will keep your credentials confidential and make reasonable efforts to prevent and discourage other API Clients from…
Thomas
  • 4,208
  • 2
  • 29
  • 31
33
votes
1 answer

Get started with Office 365 REST API

I'm sure related questions have been asked, but I cannot find this answer. I'm trying to make a simple ruby api wrapper for Office 365, and I can't figure out how to get an oauth app created (secret/token/callback url/. In everyone else's oauth/api…
Troy Anderson
  • 616
  • 1
  • 6
  • 10
32
votes
22 answers

Laravel Passport Password Grant - Client authentication failed

After hearing a lot about laravel passport, i thought of implementing it into my new project where my requirement is to create an API that'll be used in a mobile app. So my mobile app is a client, which will further have its users. I followed the…
Kanav
  • 2,695
  • 8
  • 34
  • 56
32
votes
4 answers

Github oauth multiple authorization callback URL

I want to work in my localhost and my live domain, there is any way to insert more then one callback to github oauth settings? How we solve this problem? Redirect URLs
Bazinga
  • 10,716
  • 6
  • 38
  • 63
32
votes
10 answers

401. That’s an error. Error: invalid_client The OAuth client was not found

I am working with Google Drive File Picker by following this Google Drive File Picker Example demo project. I have generated API Key and Client Id. But when I run the project I am getting following error That’s an error. Error:…
user3653474
  • 3,393
  • 6
  • 49
  • 135
32
votes
2 answers

OAuth2: What is the difference between the JWT Authorization Grant and Client Credentials Grant with JWT client authentication?

The OAuth2 JWT Profile introduces the possibility to use JWTs both as authorization grant and as client authentication. The JWT client authentication feature is independent of a certain grant type, and can be used with any grant type, also the…
Misch
  • 10,350
  • 4
  • 35
  • 49
32
votes
5 answers

How to use Google Login API with Cordova/Phonegap

I want to use "Login with Google" in my Phonegap App. I have read many articles but couldn't find out how it is done. Thanks in Advance. I tried using oAuth2 for "installed Applications" as per this URL. But then the app users have to manually copy…
Augustus Francis
  • 2,694
  • 4
  • 22
  • 32
32
votes
6 answers

Refresh token using Omniauth-oauth2 in Rails application

I am using omniauth-oauth2 in rails to authenticate to a site which supports oauth2. After doing the oauth dance, the site gives me the following, which I then persist into the database: Access Token Expires_AT (ticks) Refresh token Is there an…
ganeshran
  • 3,512
  • 7
  • 41
  • 69
32
votes
1 answer

Implementing OAuth provider in Java

What is the fastest/easiest way to get an OAuth provider running in Java? Specifically, I need to authorize third-party apps to access certain web services (I'm thinking token authentication using OAuth). I've been looking at Jersey's OAuth…
jay_soo
  • 1,278
  • 2
  • 13
  • 20
32
votes
4 answers

Get IPrincipal from OAuth Bearer Token in OWIN

I have successfully added OAuth to my WebAPI 2 project using OWIN. I receive tokens and can use them in the HTTP Header to access resources. Now I want to use those tokens also on other channels for authentication that are not the standard HTTP…
Sebastian Rosch
  • 1,033
  • 1
  • 11
  • 17
31
votes
5 answers

How to get Uri.EscapeDataString to comply with RFC 3986

The Uri class defaults to RFC 2396. For OpenID and OAuth, I need Uri escaping consistent with RFC 3986. From the System.Uri class documentation: By default, any reserved characters in the URI are escaped in accordance with RFC 2396. This…
Andrew Arnott
  • 80,040
  • 26
  • 132
  • 171
31
votes
3 answers

Closing OAuth 2.0 popup window after redirect

I redirect user to the OAuth 2.0 authorization endpoint in popup window. What is best way to close this popup and refresh main window after OAuth 2.0 authorization server redirects user back with an authorization code? Thanks in advance for any…
Lukasz Moren
  • 1,625
  • 2
  • 15
  • 16
31
votes
4 answers

Using OAuth for server-to-server authentication?

I'm currently working to specify my company's new partner/public API, which will be a resource-oriented RESTful web service. The missing piece of the puzzle at the moment is authentication/authorization. The requirements are: Initially it must work…
Greg Beech
  • 133,383
  • 43
  • 204
  • 250
31
votes
5 answers

Update/change roles claim (or any other claim) in JWT

I'm storing user roles inside a JWT (to restrict API endpoints). The roles can be changed by an administrator. If a role is changed. How am I supposed to reflect this inside all tokens? I've thought about a couple of solutions: If I'd use refresh…
tobbe
  • 1,737
  • 6
  • 23
  • 40
31
votes
2 answers

SFSafariViewController Remove OAuth2 Cookie

I have an iOS application that authenticates with Uber API using OAuth2 in a UIWebView. When upgrading to iOS 9, I run in to the issue of ATS blocking the https request for the login page. I then added an exception for the Uber login page, but then…
duncanc4
  • 1,191
  • 1
  • 9
  • 17
1 2 3
…
99 100