Cloud Native Data Security with OAuth

Chapter 2. OAuth 2.0 Distilled

A Note for Early Release Readers

With Early Release ebooks, you get books in their earliest form—the authors’ raw and unedited content as they write—so you can take advantage of these technologies long before the official release of these titles.

This will be the 2nd chapter of the final book. The GitHub repo is available at https://github.com/curityio/cloud-native-oauth-security-examples.

If you have comments about how we might improve the content and/or examples in this book, or if you notice missing material within this chapter, please reach out to the editor at [e-mail].

In this chapter we explain the main design principles behind OAuth 2.0. Remember that we use OAuth and OAuth 2.0 interchangeably, which means that we always refer to the OAuth 2.0 authorization framework that was originally released as RFC 6749. We provide an overview of the main behaviors for applications on how to get, refresh and revoke unforgeable API message credentials — access tokens. These tokens are the key to access protected data in APIs.

It can be hard to get started with OAuth because there is a lot to digest. Hence, if you are new to OAuth, read on to learn the most important basics. Feel free to skip this chapter if you are familiar with the framework. We provide practical guides in other chapters that show you how to work with OAuth in your APIs and in frontend applications.

The core of OAuth’s design is a mechanism for obtaining the access token. ...