Questions tagged [oauth]

OAuth (Open Authorization) is a specification for client applications to access protected resources on behalf of a user. It was developed as an alternative to users handing out their login credentials to third-party applications.

Description

OAuth is an open standard for authorization. OAuth provides client applications a 'secure delegated access' to server resources on behalf of a resource owner. It specifies a process for resource owners to authorize third-party access to their server resources without sharing their credentials. Designed specifically to work with Hypertext Transfer Protocol (HTTP), OAuth essentially allows access tokens to be issued to third-party clients by an authorization server, with the approval of the resource owner, or end-user. The client then uses the access token to access the protected resources hosted by the resource server. OAuth is commonly used as a way for web surfers to log into third party web sites using their Google, Facebook or Twitter passwords, without worrying about their access credentials being compromised.

OAuth is a service that is complementary to, and therefore distinct from, OpenID. OAuth is also distinct from OATH, which is a reference architecture for authentication, not a standard.

Resources

RFC 5849 - The OAuth 1.0 Protocol. The RFC is the stable and recommended specification to implement, it is based on the obsolete OAuth Core 1.0 Revision A specification.
RFC 6749 - The OAuth 2.0 Authorization Framework. This specification replaces and obsoletes the OAuth 1.0 protocol described in RFC 5849.
"OAuth Code Library Support". on Google Groups
Basic protocol workflow. Explanation of the OAuth "dance".
OAuth resources. A good walkthrough of the OAuth 1.0 specification. OAuth libraries. An overview of various OAuth implementations in different languages.
Key differences OAuth 1.0/2.0. An answer to a stackoverflow question asking for the differences between OAuth 1.0 and 2.0.

20112 questions

votes

2 answers

OAuth Refresh Token Best Practice

I am implementing OAuth for a project, and I want to know the best way to handle refresh tokens. The API I call will return a JSON object with access_token, expires_in, and refresh_token. So I was wondering, is it better to: Calculate the time when…

asked Mar 20 '15 at 15:20

Angel Gao

votes

1 answer

What is the difference between Google Identity Toolkit, Google OAuth, Firebase Auth and Google+ sign in

For my understanding, Google Identity Toolkit provides a layer for login with different accounts, like Facebook, Yahoo etc. but how does that differ from the Google OAuth implementation? And regarding Google+ sign in, it is still using OAuth, but…

oauth firebase-authentication google-plus google-identity-toolkit google-identity

asked Aug 22 '14 at 08:33

Maksim Luzik

5,863
4
36
57

votes

3 answers

How to generate OAuth 2 Client Id and Secret

I want to generate client id and client secret using .NET. I read the OAuth 2 specification and for example the size of client secret is not specified there. Is there a good practice for generating client id and client secret using .NET framework???

c# .net vb.net web-services oauth

asked May 14 '14 at 10:33

Sargis Koshkaryan

1,012
3
9
19

votes

2 answers

Constructing requests with URL Query String in Python

I'm not really sure what I'm doing. Should I be using a library for this? Or do it manually? So I'm trying to do some work with the WiThings (http://www.withings.com/api) API in Python. In order to perform some of the requests, OAuth authentication…

python api oauth request

asked Jul 22 '13 at 13:07

elykl33t

votes

3 answers

Rails authentication across apps/servers

I've been developing my rails apps whilst keeping them as modular as possible. I'm trying to implement different parts underneath as services. Say an example of Facebook: a) A MainApp that allows the user to have a wall, posts, etc. b) A PhotoApp…

ruby-on-rails ruby authentication oauth single-sign-on

asked Apr 18 '12 at 18:41

RailsN00B

votes

2 answers

OAuth Client Credential Flow - Refresh Tokens

The Scenario I've recently built an API, and have protected its resources using OAuth Bearer Access Tokens. I've used the Client_Credentials Flow, as it will be accessed by clients as opposed to users. Here's the thing, when a client has…

oauth-2.0 oauth

asked Apr 11 '17 at 08:28

Derek

8,300
12
56
88

votes

1 answer

How to get user email address from twitter, using oAuth?

Possible Duplicate: Is there a way to get an user's email ID after verifying her Twitter identity using OAuth? Using oAuth I'm able to sucessfully login and forward it back to my PHP application. How can I get the email address of the…

twitter oauth

asked Nov 07 '10 at 19:41

Giffary

3,060
12
50
71

votes

4 answers

Too many cookies OpenIdConnect.nonce cause error page "Bad Request - Request Too Long"

I'm using OWIN / OAuth with OpenId Connect authentication (Microsoft.Owin.Security.OpenIdConnect) in a C# ASP MVC web app. The SSO login with Microsoft account basically works, but from time to time I'm getting an error page on the browser that says…

asp.net cookies oauth owin

asked Apr 22 '16 at 13:30

andrew.fox

7,435
5
52
75

votes

2 answers

Difference between Client and User-Agent

What is the difference between a Client, User-Agent and Resource Owner in OAuth 2.0 definitions? What are some examples for each term? (browser, user, ...)

security authentication oauth oauth-2.0

asked Feb 25 '16 at 20:25

A-Sharabiani

17,750
17
113
128

votes

7 answers

Require Google to return email address as part of OAuth

I am using OAuth to access Gmail with dotNetOAuth. How can I force Google to return user's email address as part of callback after authorization? By default, Google OAuth callback only returns the token secret and access tokens.

oauth dotnetopenauth

asked Jun 27 '10 at 21:37

Khash

2,500
4
30
56

votes

3 answers

What is the simplest example of Spring OAuth2 with Java configuration?

I have recently built a REST API in Spring which I am consuming with a .Net C# client. At the moment there is no security so I would like to implement OAuth2. I am going to be the only user of my REST API so I don't need something complicated. Is…

java spring oauth spring-security oauth-2.0

asked May 06 '15 at 22:19

Dimitris

2,030
3
27
45

votes

3 answers

Login using Google OAuth 2.0 with C#

I want to allow User to login using Gmail. So, I googled and got many samples but all were using OpenID and as I have checked Google Documentation, they have stopped new domain registration for OpenID and from now, Developer will need to use OAuth…

c# oauth

asked Jun 05 '14 at 10:37

Jeeten Parmar

5,568
15
62
111

votes

0 answers

How to Create Facebook OAuth in WPF & C#

I am developing a WPF application that requires me to get an Access Token from Facebook using oAuth. After much searching online, I came to the following conclusions: OAuth must be done in a browser I need to watch the URL posts in that browser,…

c# wpf facebook oauth

asked Dec 03 '13 at 14:23

mkamioner

2,451
1
17
14

votes

3 answers

How to save refresh tokens?

I'm trying to add authentication feature to my application. The authentication server implements oauth 2.0 I'm not sure how to save the refresh_token. I want to save it to a file, so next time when the application starts and there is a refresh_token…

oauth oauth-2.0

asked Jan 04 '13 at 19:30

Bill Yan

3,369
4
27
42

votes

2 answers

Why is there 3-legged OAuth2 when 2-legged works so well?

2-legged OAuth2 is used for Browser based app, where no client credential can be hidden from public. 3-legged OAuth2 is used by "Web Server Apps" where there's a third call between servers. All well described here. The question: Why bother with…

authentication oauth oauth-2.0

asked Nov 13 '12 at 21:56

Aron Woost

19,268
13
43
51

Prev 1 2 3

…

99 100 Next