OAuth 2.0 Authentication Guide

# OAuth 2.0 Authentication Guide OAuth 2.0 is the industry-standard protocol for authorization. Let's learn how to implement it securely. ## What is OAuth 2.0? OAuth 2.0 enables applications to obtain limited access to user accounts without exposing passwords. ## Key Terminology - **Resource Owner**: The user - **Client**: Your application - **Authorization Server**: Issues tokens (e.g., Google, GitHub) - **Resource Server**: Hosts protected resources ## Authorization Flows ### Authorization Code Flow Most secure flow for web applications: 1. Client redirects user to authorization server 2. User authorizes application 3. Server redirects back with authorization code 4. Client exchanges code for access token ```javascript // Step 1: Redirect to authorization app.get('/auth/login', (req, res) => { const authUrl = `${AUTH_SERVER}/authorize?` + `client_id=${CLIENT_ID}&` + `redirect_uri=${REDIRECT_URI}&` + `response_type=code&` + `scope=profile email`; res.redirect(authUrl); }); // Step 2: Handle callback app.get('/auth/callback', async (req, res) => { const { code } = req.query; // Exchange code for token const token = await exchangeCodeForToken(code); // Store token and redirect req.session.accessToken = token; res.redirect('/dashboard'); }); ``` ### Client Credentials Flow For server-to-server authentication: ```javascript async function getAccessToken() { const response = await fetch(`${AUTH_SERVER}/token`, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ grant_type: 'client_credentials', client_id: CLIENT_ID, client_secret: CLIENT_SECRET }) }); return response.json(); } ``` ## Using Access Tokens ```javascript async function fetchUserData(accessToken) { const response = await fetch(`${API_SERVER}/user`, { headers: { 'Authorization': `Bearer ${accessToken}` } }); return response.json(); } ``` ## Refresh Tokens Handle expired tokens gracefully: ```javascript async function refreshAccessToken(refreshToken) { const response = await fetch(`${AUTH_SERVER}/token`, { method: 'POST', body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: refreshToken, client_id: CLIENT_ID, client_secret: CLIENT_SECRET }) }); return response.json(); } ``` ## Security Best Practices 1. Always use HTTPS 2. Validate redirect URIs 3. Use PKCE for mobile apps 4. Store tokens securely 5. Implement token expiration 6. Use state parameter to prevent CSRF OAuth 2.0 provides secure, standardized authentication. Implement it correctly to protect your users.