Auth 2's primary platform is the web, as the oauth2 authentication protocol basic framework, but the specification also covers how to handle delegated access to various other client types as part of the essence of OAuth meaning nested into the authorization of access, that is with browser-based applications, server-side web applications, native/mobile apps, connected devices, and so on.

Principles of Auth 2

It is critical to recognize that Auth 2 is an authorization protocol, not an authentication protocol that verifies the details. As such, it is intended primarily to grant access to a set of resources, such as remote APIs or user data.

In Auth 2.0, access tokens are used. An access token is a data structure that represents the end user's authorization token to access resources. The format of access tokens is not specified in Auth 2.0. However, in some situations, the JSON Web Token (JWT) format is commonly used. Token creators can now include data in their tokens. For security reasons, access tokens may also have an expiration date.

Auth 2 Overview

The Auth 2.0 protocol is a second-generation authorization framework part of an integration platform as a service that allows a user to grant a third-party website or application access to the user's protected resources without revealing their long-term credentials or even their identity.

OAuth adds an authorization layer and distinguishes the client's role from the resource owner's. In Auth 2, the client requests access to resources controlled by the resource owner and hosted by the resource server and is provided with credentials that differ from the resource owner's. Instead of using the credentials of the resource owner, the client obtains an access token, which is a string containing the scope, lifetime, and other access attributes. Access tokens for third parties are distributed. As such, in the aforementioned scenario, there are several hybrid integration platform services available to support the single point of access and authentication.

Auth 2 generates JSON web token (JWT) access tokens for API authorization scenarios. In OAuth terminology, the permissions represented by the access token are known as scopes. When an application uses Auth0 to authenticate, it specifies the scopes it wants. If the user authorizes those scopes, the access token will represent those authorized scopes.

Key Roles of Auth 2

An Auth 2.0 flow performs the following functions:

• Resource Owner: An entity that has the authority to grant access to a protected resource. This is usually the end user.

• Resource Server: The server that houses the protected resources. This is the API you wish to use.

• Client: An application that requests access to a protected resource on the Resource Owner's behalf.

• Authorization Server: A server that authenticates the Resource Owner and issues access tokens once proper authorization has been obtained. Auth0 in this case.

Access Grant Types

To obtain an access token, Auth 2.0 defines four flows. These are known as grant types. Which one is best for your situation is largely determined by the nature of your application.

• Authorization Code Flow: used by server-side Web Apps. The Proof Key for Code Exchange (PKCE) technique is also used by mobile apps.

• Implicit Flow with Form Post: This is a technique used by JavaScript-centric apps (Single-Page Applications) that run in the user's browser.

• Highly trusted apps use the Resource Owner Password Flow.

• Client Credentials Flow A machine-to-machine communication protocol.

The specification also includes a mechanism for defining additional grant types. See Authentication and Authorization Flows for more information on how each grant type works and when it should be used.

Endpoints

The authorize endpoint and the OAuth token endpoint are used by Auth 2

Endpoint of Authorization

The /authorize endpoint is used to communicate with the resource owner and obtain access to the protected resource. Consider the following scenario: If you want to log in to a service using your Google account. First, the service will redirect you to Google to authenticate (if you are not already logged in), and then you will be presented with a consent screen in which you will be asked to authorize the service to access some of your data (protected resources), such as your email address and contact list.

Endpoint for Tokens

The application uses the /oauth/token endpoint to obtain an access token or a refresh token. Except for the implicit flow, where an access token is issued directly, it is used by all flows.

• The application exchanges the authorization code obtained from the authorization endpoint for an access token in the Authorization Code Flow.

• The application authenticates using a set of credentials in the Client Credentials Flow and Resource Owner Password Credentials Grant Exchange and then receives an access token.

State Parameters in Auth 2 Framework

Authorization protocols include a state parameter that allows you to restore your application's previous state. The state parameter saves some state objects that the client specified in the authorization request and returns them to the client in the response. The state parameter is primarily used to prevent CSRF attacks. For more information, see Use Auth 2.0 State Parameters.

Conclusion

In summary, Auth 2 is a simple and effective method of authorizing access to the system. Before OAuth 2.0 can be used, the client must first obtain its own credentials, a client id, and a client secret code, from the Authorization Server in order to identify and authenticate itself when requesting an access token.

The client, for example, a mobile app, website, smart TV app, desktop application, etc., initiates access requests using OAuth 2.0. The token request, exchange, and response follow a general flow and may effectively authorize the process to proceed safely and securely."