Webopedia on Google+Webopedia on TwitterWebopedia on FacebookTech Bytes Blog
Main » TERM » O »

OAuth

OAuth is an open authorization standard used to provide secure client application access to server resources. The OAuth authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner or by allowing the third-party application to obtain access on its own behalf.

OAuth enables server owners to authorize access to the server resources without sharing credentials. This means the user can grant access to private resources from one server to another server resource without sharing their identity.

OAuth Solves Traditional Client-Server Authentication Issues

OAuth is designed to problems and limitations found in traditional client-server authentication model where third-party applications are required to store the resource owner's credentials for future use and where resource owners cannot revoke access to an individual third party without revoking access to all third parties.

OAuth addresses these issues by introducing an authorization layer and separating the role of the client from that of the resource owner. Instead of using the resource owner's credentials to access protected resources, the client obtains an access token, issued to third-party clients by an authorization server with the approval of the resource owner.

The OAuth Protocol

The OAuth 1.0 protocol (RFC5849), published as an informational document, was the result of a small ad hoc community effort. The OAuth 2.0 protocol is not backward compatible with OAuth 1.0. 

OAuth Security Flaws

In May, 2014 a security flaw was discovered in the widely used OAuth and OpenID website authentication mechanisms. The flaw was not in OAuth 2, but was a result of how some businesses implemented the standards, primary in situations where open redirects were used. Following news of the security flaw, Google said it will be more stringent in securing users when they log in to their accounts by applying additional authorization checks.







TECH RESOURCES FROM OUR PARTNERS
LATEST ARTICLES
Slideshow: 5 Hot Holiday Gifts for Tech Enthusiasts

From cute electronic toys to VR gaming, here are 5 hot gifts to give to your special tech enthusiast this holiday season. Read More »

What's Hot in Tech: AI Tops the List

Like everything in technology, AI touches on so many other trends, like self-driving cars and automation, and Big Data and the Internet of Things... Read More »

DevOp's Role in Application Security

As organizations rush to release new applications, security appears to be getting short shrift. DevSecOps is a new approach that holds promise. Read More »

STUDY GUIDES
Java Basics, Part 1

Java is a high-level programming language. This guide describes the basics of Java, providing an overview of syntax, variables, data types and... Read More »

Java Basics, Part 2

This second Study Guide describes the basics of Java, providing an overview of operators, modifiers and control Structures. Read More »

The 7 Layers of the OSI Model

The Open System Interconnection (OSI) model defines a networking framework to implement protocols in seven layers. Use this handy guide to compare... Read More »