OAuth

lastmod 2025-01-14created 2014-08-2818 edits

OAuth is a standard authentication method developed as an OpenAPI, and it can be used when various applications go through user authentication.

Categories

• Nango - Open source that handles OAuth tokens for 40+ APIs
• Ory Hydra - OpenID Certified OAuth 2.0 Server and OpenID Connect Provider
• Lucia - Authentication, simple and clean
• oauth.network - Introducing a service for free text message and email authentication.
• Keypub.sh - OAuth for the terminal using SSH keys

Terminology

Brief explanations of OAuth-related terms.

• User: An individual who has an account used with the service provider and the consumer
• Consumer: A website or application that accesses the service provider using OAuth, developed with an Open API
• Service provider: A web application that supports access through OAuth (a service that provides an Open API)
• Consumer secret: A key with which the consumer authenticates itself to the service provider
• Request token: Contains the information the consumer needs to get access permission authenticated by the user, and is later exchanged for an access token.
• Access token: A value containing the key with which, after authentication, the user accesses protected resources through the consumer rather than the service provider.

OAuth 2.0

See the corresponding page.

Favorite site

• OAuth web site
• RFC 6749: The OAuth 2.0 Authorization Framework
• An OAuth2 Server Library for PHP
• liboauth web site
• liboauth project site
• Wikipedia (en) Description of OAuth
• Hello world: Dancing with OAuth ¹
• [Recommended] Daum: Getting started with OAuth 2.0
• [Recommended] Understanding OAuth 2.0 ²
• oauth2-restapi-server: Making mobile apps a bit more secure with OAuth2.0!
• Joinc: OAuth2: Components
• Authenticating with OAuth (Ver 1.0) ³
• [Recommended] OAuth 2.0 Authorization Code Requests and Responses
• donghwi-kim.github.io - OAuth 2.0

Article

• Millions of Accounts Vulnerable due to Google’s OAuth Flaw ◆ Truffle Security Co. - Millions of accounts at risk due to a Google OAuth flaw
  • A flaw in Google's "Sign in with Google" authentication flow puts the personal information of millions of people at risk of theft.
  • Google OAuth login does not stop an attacker who buys a failed startup's domain from recreating former employees' email accounts.
  • This can give access to various SaaS products and may leak sensitive data (Social Security numbers, tax documents, etc.).
  • More than 100,000 failed startups' domains are currently up for sale, and the number of potentially exposed accounts could exceed 10 million.
  • Google has acknowledged the issue but has not yet offered a fix.

References