OAuth 2.0

OAuth 2.0 is the industry-standard protocol for authorization, replacing the original OAuth 1.0 protocol. It focuses on client developer simplicity while providing specific authorization flows for web applications, desktop applications, mobile phones, and living room devices. The framework defines four grant types -- authorization code, implicit, resource owner password credentials, and client credentials -- each suited to different application architectures and trust levels.

OAuth 2.0 separates the role of the client from the resource owner, introducing an authorization layer. Instead of using the resource owner's credentials to access protected resources, the client obtains an access token -- a string denoting a specific scope, lifetime, and other access attributes. Access tokens are issued to third-party clients by an authorization server with the approval of the resource owner. The client then uses the access token to access the protected resources hosted by the resource server.

Proper implementation requires careful consideration of token storage, transport security (TLS everywhere), redirect URI validation, state parameter usage for CSRF protection, and scope management. The specification has evolved with security best current practices (BCP) recommending against the implicit grant and resource owner password credentials grant in favor of the authorization code grant with PKCE for all client types.