{"id":48251,"date":"2012-10-05T00:00:00","date_gmt":"2012-10-05T00:00:00","guid":{"rendered":"https:\/\/www.techopedia.com\/oauth-2-0-101\/"},"modified":"2023-03-07T09:38:20","modified_gmt":"2023-03-07T09:38:20","slug":"oauth-2-0-101","status":"publish","type":"post","link":"https:\/\/www.techopedia.com\/2\/28834\/internet\/web-services\/oauth-20-101","title":{"rendered":"OAuth 2.0 101"},"content":{"rendered":"
Many luxury cars come with a valet key. It is a special key you give the parking attendant and unlike your regular key, will only allow the car to be driven a short distance while blocking access to the trunk and the onboard cell phone. Regardless of the restrictions the valet key imposes, the idea is very clever. You give someone limited access to your car with a special key, while using another key to unlock everything else. <\/span>– The Official Guide to OAuth 1.0<\/p>\n That’s how the community-based specification guidelines explained OAuth<\/a> way back in 2007. And while OAuth 2.0 is a completely new protocol, the same description still applies – OAuth remains a way for users to grant third-party access (and limited access) to their resources without sharing their passwords.<\/p>\n If you are on the Internet regularly, chances are you have come across a site that uses OAuth. After all, the world’s biggest websites, such as Facebook, Google, MySpace, Twitter, Photobcuket, Yahoo, Evernote and Vimeo, use this authentication standard. Read on to learn more about this standard, and why the next generation, OAuth 2.0<\/a>, is still being used on a relatively experimental basis.<\/p>\n First, you need to know what OAuth, as a protocol, does: It allows application programming interface<\/a> authorization between two Web or desktop apps. As a result, websites are able to share protected resources with other websites and services.<\/p>\n For example, if you play Scramble with friends on your iPad, you could enter your Facebook credentials, allowing the game to look through your friends list to see which of them are playing the game – and invite others to join. Or you could connect with friends on Google+ based on who’s following you on Twitter. These type of applications are handy for users, but they involve giving one site or program access to information about you on another site.<\/p>\n OAuth 2.0 works much like the first incarnation of OAuth, but it is a totally new standard altogether. This means that it is not backward compatible<\/a> with OAuth 1.0. Version 2.0 cleaned up many of the problems with the original OAuth and made improvements.<\/p>\n While basically retaining the architecture of the first version, 2.0 improved on:<\/p>\n A more comprehensive explanation on what is new with OAuth 2.0 is provided by Eran Hammer, who used to be part of the OAuth working group. You can access it here<\/a>. However, note that Hammer left the working group in July of 2012, citing issues with security concerns<\/a> when implementing the standard. As a result, although OAuth was supposed to be finalized by the end of 2010, it remains a proposed standard (at time of writing), although it is part of Facebook’s Graph API. Google and Microsoft are also experimenting with OAuth 2.0 support in their APIs.<\/p>\n One of the best reasons to use OAuth is that it makes sharing so much easier. We’re already used to uploading photos to Instagram and having them post automatically to Twitter and Facebook. In fact, it’s this kind of ease of use and crossover that continues to make social media so appealing. <\/p>\n But that’s not all. For end users, OAuth means that you do not have to create another profile. For example, if you want to leave a comment on an article, you can use your Facebook or Twitter credentials to do so, instead of having to sign up for an account on a given website. This is great for sites that you aren’t usually active on, or that you may not trust. It can also benefit the sites by ensuring that users have an identity on Facebook, making comment spam less likely.<\/p>\n OAuth also means fewer passwords to remember. It’s a best practice to have different passwords for different website services. So instead of memorizing another password for Pinterest, you only have to use your Facebook password to access the service. Pinterest, by the way, won’t see your password.<\/p>\n You can also limit what resources are accessed via your OAuth. For example, when playing a game on Facebook, you can specify if you want the game to be posted on your wall on your behalf or not.<\/p>\n For the developer, OAuth 2.0 provides an already developed code for authentications, social interaction display and user profile display. This means fewer bugs for developers to contend with and a lower risk because the API has already been debugged, tested and proven. Lastly, you also benefit from having less data to stored on your own servers.<\/p>\nWhat Is OAuth 2.0?<\/span><\/h2>\n
\n
The Benefits of Using OAuth 2.0<\/span><\/h2>\n
How OAuth 2.0 Came to Be<\/span><\/h2>\n