OAuth is a specification for authorization OAuth 2.0 is a specification for authorization, but NOT for authentication. RFC 6749, 3.1. Authorization Endpoint explicitly says as follows: The authorization endpoint is used to interact with the resource owner and obtain an authorization grant. The authorization server MUST first verify the identity of the resource owner. The … Read more
Add this to the scope – https://www.googleapis.com/auth/userinfo.profile And after authorization is done, get the information from – https://www.googleapis.com/oauth2/v1/userinfo?alt=json It has loads of stuff – including name, public profile url, gender, photo etc.
State and nonce seem to be similar. But if you dig deep, you will find that they serve different purposes. State is there to protect the end user from cross site request forgery(CSRF) attacks. It is introduced from OAuth 2.0 protocol RFC6749. Protocol states that, Once authorization has been obtained from the end-user, the authorization … Read more
First I’d like to emphasize the difference between authentication and authorization: A user authenticates to your web site by supplying some credential such as a username+password. OpenID allows this to be displaced by having the user authenticate to another service, which then asserts the user’s identity to your web site on the user’s behalf. Your … Read more
What exactly is OAuth (Open Authorization)? OAuth allows notifying a resource provider (e.g. Facebook) that the resource owner (e.g. you) grants permission to a third-party (e.g. a Facebook Application) access to their information (e.g. the list of your friends). If you read it stated plainly, I would understand your confusion. So let’s go with a … Read more
As it turns out, my suspicions were right. The audience aud claim in a JWT is meant to refer to the Resource Servers that should accept the token. As this post simply puts it: The audience of a token is the intended recipient of the token. The audience value is a string — typically, the … Read more
The access_token is what you need to call a protected resource (an API). In the Authorization Code flow there are 2 steps to get it: User must authenticate and returns a code to the API consumer (called the “Client”). The “client” of the API (usually your web server) exchanges the code obtained in #1 for … Read more
Google way Google Oauth2 Token Validation Request: https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=1/fFBGRNJru1FQd44AzqT3Zg Respond: { “audience”:”8819981768.apps.googleusercontent.com”, “user_id”:”123456789″, “scope”:”https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email”, “expires_in”:436 } Microsoft way Microsoft – Oauth2 check an authorization Github way Github – Oauth2 check an authorization Request: GET /applications/:client_id/tokens/:access_token Respond: { “id”: 1, “url”: “https://api.github.com/authorizations/1”, “scopes”: [ “public_repo” ], “token”: “abc123”, “app”: { “url”: “http://my-github-app.com”, “name”: “my github app”, … Read more
Short answer JWTs are a convenient way to encode and verify claims. A Bearer token is just string, potentially arbitrary, that is used for authorization. Context (story time) A few years ago, before the JWT revolution, a <token> was just a string with no intrinsic meaning, e.g. 2pWS6RQmdZpE0TQ93X. That token was then looked-up in a … Read more
Update October 2016: Easiest now: use lvh.me which always points to 127.0.0.1, but make sure to verify that this is still true every time you need to invoke it (because domains can expire or get taken over, and DNS poisoning is always a concern) Previous Answer: Since the callback request is issued by the browser, … Read more