OAuth 2.0

OAuth 2.0 is an authorization framework defined by IETF RFC 6749 that enables secure, delegated access between applications without exposing user credentials. It allows a user to grant a third-party service limited access to protected resources hosted on another service—using tokens instead of passwords.

Key Capabilities

• Standard authorization flows: Defines several standardized flows—Authorization Code, Client Credentials, Resource Owner Password (deprecated), Implicit (deprecated), and Device Authorization—each specifying how tokens are requested and used depending on the client type and use case.

• Access tokens: Issues short-lived credentials (often JWTs) that APIs can validate to confirm a client’s permissions without exposing end-user credentials.

• Refresh tokens: Allow clients to maintain long-lived sessions by obtaining new access tokens after expiry without re-prompting the user for consent.

• Scopes and consent: Use scopes to define granular access permissions; users grant consent for specific scopes during the authorization process.

Limitations

• Not an authentication protocol: OAuth 2.0 only handles authorization—identity and user claims are provided by protocols like OpenID Connect (OIDC) built on top.

• Complex and fragmented ecosystem: The wide variety of extensions, flows, and drafts can cause interoperability challenges; the emerging OAuth 2.1 draft consolidates best practices.

• Bearer-token exposure risk: Standard OAuth tokens are bearer tokens—if intercepted, they can be reused unless bound to the client via DPoP or mTLS.

• Implementation variability: Security posture and token-handling practices differ across identity providers, making consistent enforcement dependent on careful configuration.