Auth
OAuth 2.0
A delegated authorization standard: an app gets limited access to a user's resources without their password.
What it is
OAuth 2.0 answers "what is this app allowed to do". The user confirms access with a trusted provider, and the app gets an access token with limited rights (scopes).
There are several flows (grant types). For web and mobile apps Authorization Code with PKCE is recommended today, for server-to-server Client Credentials. Implicit and Password are considered obsolete.
OAuth 2.0 is about authorization, not authentication. To learn who the user is, OpenID Connect is added on top.
Use it when
- Letting third-party apps access your API without sharing a password.
- Sign in with Google, GitHub and other providers (together with OIDC).
- Service-to-service authorization with limited rights.
Avoid it when
- A single internal app with one login: cookie sessions are simpler.
- As the only user authentication mechanism: use OIDC.
Key concepts
- Roles
- Resource owner, client, authorization server, resource server.
- Access / refresh token
- A short-lived access token and a long-lived one to renew it.
- Scope
- A list of allowed actions, like
read:profile. - PKCE
- Protects the authorization code from interception in public clients.
Example
Interview questions
1. How does OAuth 2.0 differ from authentication?
OAuth issues a token with rights to resources but does not say who the user is. OpenID Connect adds authentication through the ID token.
2. Why PKCE?
Public clients (SPAs, mobile) cannot keep a secret. PKCE binds the authorization code to a one-time
code_verifier, so an intercepted code is useless.3. What is a refresh token for?
Access tokens are short-lived. A refresh token gets a new one without logging in again, and it must be stored carefully and rotated.
Interview questions from the bank
- Explain the authorization code flow with PKCE for an SPA. How does OAuth 2.0 differ from OpenID Connect, and how does
id_tokendiffer fromaccess_token?MiddleHTTP - An access token lives 15 minutes, a refresh token 30 days. The refresh token was stolen. How do you reduce the damage? What are rotation and reuse detection, and how do you implement sign-out from all devices?SeniorHTTP
- How does authentication differ from authorization?JuniorWeb security
- A reporting service pulls data from your API hourly without a user. Which OAuth2 flow do you use?MiddleWeb security
- The authorization code flow has
state,nonceandcode_verifier. What does each one protect against?MiddleWeb security - Where should an SPA keep tokens? A colleague stores access and refresh tokens in
localStoragebecauseHttpOnlycookies are 'inconvenient'.SeniorWeb security - After introducing refresh token rotation with reuse detection, users with two tabs are massively logged out. Why?SeniorWeb security
Related technologies
- OpenID ConnectAn authentication layer on top of OAuth 2.0: the client receives an ID token with user information.
- JWTA compact signed token in JSON format that carries claims about a user or permissions.
- KeycloakAn open source identity and access management solution with SSO, OIDC, SAML and roles.
- Auth0A managed authentication and authorization service: sign-in, SSO, MFA and API access with no identity server of your own.
- PasskeysPasswordless sign-in on public keys: the private key stays on the device and biometrics or a PIN confirm it.
Logos belong to their owners and are used for identification only. Icons: Simple Icons (CC0), Devicon (MIT).