What exactly is OAuth (Open Authorization)? OAuth allows notifying a resource provider (e.g. Facebook) that the resource owner (e.g. you) grants permission to a third-party (e.g. a Facebook Application) access to their information (e.g. the list of your friends). If you read it stated plainly, I would understand your confusion. So let’s go with a … Read more
Answer: These checkboxes are due to the rolling out of a new granular account permission system, they are completely normal, and can not be turned off. More Information: After some digging, I discovered this Google Developers blog post from 2018 in which it is discussed that in the new permission system, users will have the … Read more
After digging manually through the configuration classes I was able to find and add the following, which did the trick… security.oauth2.client.pre-established-redirect-uri=https://[application_host]/login security.oauth2.client.registered-redirect-uri=https://[application_host]/login security.oauth2.client.use-current-uri=false I’m not convinced there isn’t a better way to solve the problem of forcing a HTTPS redirect URL, but this fix worked for me.
State and nonce seem to be similar. But if you dig deep, you will find that they serve different purposes. State is there to protect the end user from cross site request forgery(CSRF) attacks. It is introduced from OAuth 2.0 protocol RFC6749. Protocol states that, Once authorization has been obtained from the end-user, the authorization … Read more
Here are my thoughts: The purpose of auth code + token in authorization code flow is that token and client secret will never be exposed to resource owner because they travel server-to-server. On the other side, implicit grant flow is for clients that are implemented entirely using javascript and are running in resource owner’s browser. … Read more
Background: I’ve written client and server stacks for OAuth 1.0a and 2.0. Both OAuth 1.0a & 2.0 support two-legged authentication, where a server is assured of a user’s identity, and three-legged authentication, where a server is assured by a content provider of the user’s identity. Three-legged authentication is where authorization requests and access tokens come … Read more
Bearer Token A security token with the property that any party in possession of the token (a “bearer”) can use the token in any way that any other party in possession of it can. Using a bearer token does not require a bearer to prove possession of cryptographic key material (proof-of-possession). The Bearer Token is … Read more
This is very much implementation specific, but the general idea is to allow providers to issue short term access tokens with long term refresh tokens. Why? Many providers support bearer tokens which are very weak security-wise. By making them short-lived and requiring refresh, they limit the time an attacker can abuse a stolen token. Large … Read more
The access_token is what you need to call a protected resource (an API). In the Authorization Code flow there are 2 steps to get it: User must authenticate and returns a code to the API consumer (called the “Client”). The “client” of the API (usually your web server) exchanges the code obtained in #1 for … Read more