In the world of modern web development, OAuth2 has become a ubiquitous standard for securing APIs and enabling third-party applications to access resources on behalf of users. However, with its widespread adoption comes a myriad of misconceptions that can lead to security vulnerabilities, misconfigurations, and a general misunderstanding of its purpose. In this post, we’ll clarify some of the most common misconceptions about OAuth2, highlight the differences between authentication and authorization, and provide guidance on using OAuth2 correctly.

Authentication vs. Authorization: Understanding the Core Differences

Before diving into OAuth2 specifics, it’s crucial to differentiate between authentication and authorization.

• Authentication: the process of verifying the identity of a user. When you log into a system, you’re proving who you are. Like using username and password. Is the action of checking if you are who you say you are.
• Authorization: after authenticated, it determines what the user is allowed to do. It answers the question: “Does this user have permission to perform this action or access this resource?”

OAuth2 is an Authorization framework, not an Authentication framework. This distinction is fundamental yet often misunderstood, leading to misconfigurations and security issues.

OAuth2: An Authorization Framework

OAuth2 is designed to delegate access. It’s a protocol that allows third-party applications to obtain limited access to a resource server on behalf of a user. It was never intended to handle authentication directly, although it can be used as part of an authentication process in conjunction with other protocols, like OpenID Connect (OIDC).

Common Pitfalls: Misusing Grant Types

One of the most frequent mistakes developers make is using the wrong OAuth2 grant type. Tutorials often oversimplify scenarios, leading to the misuse of grant types, especially in Single Page Applications (SPAs).

Common Grant Types and Their Uses

1. Authorization Code Grant: Used for client-side applications. It involves exchanging an authorization code for an access token and is considered secure because the client_secret is never exposed to the user agent.
2. Client Credentials Grant: Used for machine-to-machine communication where no user is involved. It’s ideal for server-to-server interactions and shall not be used on client-side apps, cause it has client_secret and it cannot be exposed on the user’s device;
3. Refresh Token Grant: Allows obtaining new access tokens using a refresh token. It’s essential for long-lived user sessions without requiring the user to re-authenticate.

The Actors in the OAuth2 Flow

Understanding the key actors in the OAuth2 flow is critical:

• User: The person who owns the data and grants permission to access it.
• Authorization Server: The server that authenticates the user and issues access tokens.
• Identity Provider (IdP): The service that provides authentication (like “Log In with Google”, Facebook and etc). You get redirected to the IdP’s login page, once Authenticated, the Authorization Server authorize you to move forward.
• Client: The application requesting access to the user’s resources (like the front-end app).
• Resource Server: The server hosting the protected resources, which validates the access token (like APIs).

Access Tokens vs. ID Tokens

• Access Tokens: Used to access protected resources on behalf of the user. They should only be used for API access and are typically opaque to the client.
• ID Tokens: Used in OpenID Connect to verify the identity of the user. These tokens contain user information and are intended for the client application to authenticate the user.

In general, you shall use access_token when consuming external APIs and idToken when you’re building an application where you want to make your user to log into.

Refresh Tokens: Extending Session Lifespan

Refresh tokens are used to obtain new access tokens without requiring the user to re-authenticate. They are especially useful in maintaining long-lived sessions. However, they should be handled securely to prevent unauthorized access.

Leveraging Provider Libraries

Implementing OAuth2 correctly can be complex and error-prone. It’s often more secure and efficient to use libraries provided by OAuth2 providers, which abstract much of the complexity and ensure best practices are followed.

Conclusion

OAuth2 is a powerful tool for authorization, but it must be used correctly to avoid security pitfalls. By understanding the correct usage of grant types, the roles of different actors, and the differences between access tokens and id tokens, you can implement OAuth2 securely and effectively in your applications.