oauth

Why is OAuth designed to have request token and access token?

by

For usability and security reasons. From the Beginner’s Guide to OAuth: https://hueniverse.com/beginners-guide-to-oauth-part-iii-security-architecture-e9394f5263b5 … While mostly an artifact of how the OAuth specification evolved, the two-Token design offers some usability and security features which made it worthwhile to stay in the specification. OAuth operates on two channels: a front-channel which is used to engage the User … Read more

What is an opaque token?

by

A JWT has readable content, as you can see for example on https://jwt.io/. Everyone can decode the token and read the information in it. The format is documented in RFC 7519. An opaque token on the other hand has a format that is not intended to be read by you. Only the issuer knows the … Read more

Keycloak integration in Swagger

by

Swagger-ui can integrate with keycloak using the implicit authentication mode. You can setup oauth2 on swagger-ui so that it will ask you to authenticate instead of giving swagger-ui the access token directly. 1st thing, your swagger need to reference a Security definition like: “securityDefinitions”: { “oauth2”: { “type”:”oauth2″, “authorizationUrl”:”http://172.17.0.2:8080/auth/realms/master/protocol/openid-connect/auth”, “flow”:”implicit”, “scopes”: { “openid”:”openid”, “profile”:”profile” } … Read more

How to get dummy google access token to test oauth google api

by

Use the Google OAuth playground: Request: POST /oauth2/v3/token HTTP/1.1 Host: www.googleapis.com Content-Type: application/x-www-form-urlencoded code=4/P7q7W91a-oMsCeLvIaQm6bTrgtp7& client_id=8819981768.apps.googleusercontent.com& client_secret={client_secret}& redirect_uri=https://oauth2-login-demo.appspot.com/code& grant_type=authorization_code (Successful) Response: { “access_token”:”1/fFAGRNJru1FTz70BzhT3Zg”, “expires_in”:3920, “token_type”:”Bearer” } I also highly recommend reading the Google OAuth 2.0 documentation

Multiple Scope Values to oauth2

by

You were on the right track when you combined them to a single field . There should be only one scope parameter in the request, with the values separated by spaces. If you’re putting it in a form like that, the browser will take care of encoding the space for you. <input type=”hidden” name=”scope” value=”https://www.googleapis.com/auth/calendar … Read more

What is the Access Token vs. Access Token Secret and Consumer Key vs. Consumer Secret

by

Consumer key is the API key that a service provider (Twitter, Facebook, etc.) issues to a consumer (a service that wants to access a user’s resources on the service provider). This key is what identifies the consumer. Consumer secret is the consumer “password” that is used, along with the consumer key, to request access (i.e. … Read more