OAuth

OAuth is an open standard for delegated authorization. It lets you grant an application limited access to your data on another service, such as reading your calendar, by issuing it a token instead of sharing your password.

Why it matters

OAuth is why you can click Sign in with Google or let a tool post to your account without handing over credentials. The access is scoped to specific permissions and can be revoked at any time. Note that OAuth itself handles authorization; OpenID Connect is the identity layer built on top for login.

Example

GET https://auth.example.com/authorize
  ?response_type=code
  &client_id=abc123
  &redirect_uri=https://app.example/callback
  &scope=calendar.read

The user approves, the app receives a short-lived code, and it exchanges the code for an access token.

Common mistakes

• Confusing OAuth authorization with authentication.
• Granting broad scopes when read-only access would do.
• Not validating the redirect URI or the state parameter, which opens the door to token theft and CSRF.

Related

• JWT
• SSO
• CSRF
• Least privilege
• टूल: JWT decoder

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.