Use Case of Oauth 2.0?

user_13868478 0
Viewed 436

I have asked this question to many developers and even in stack overflow and CSharpCorner but never got a satisfactory answer. According to every developer there is only one use case of oauth2.0 and it is like stated below.

“hey, do you want to log into our website with other website’s login?

My question is if I am having a REST API which will be consumed only by my frontend clients(browser and mobile), and no third party apps involved. Is the OAuth2.0 the right tool? I know Form and Basic authentication is there. But is Social login the only use case of OAuth2.0

I politely request to answer my question from all oauth gurus here and please don't answer if you are only going to state

Oauth is an authorization protocol which allows one app to consume services of another app on user's behalf without actually knowing his password.

oauth-2.0
1 Answers

BENEFITS

OAuth 2 and Open Id Connect are the security stack for modern software, due to the following factors:

  • Web and mobile friendly - based on JSON and HTTPS
  • Tokens are used as cross domain credentials when Web / Mobile UIs call Web APIs
  • A good fit for modern hosting (API Gateways and Content Delivery Networks)
  • Web APIs use tokens as the only form of API credential
  • Web APIs use claims based on the caller's identity to authorise requests
  • When you use OAuth you no longer code authentication aspects or deal with passwords
  • Login usability can sometimes be improved, eg on mobile
  • Federation with business partners has better future options

Many future business security solutions are being built based on these protocols, such as Open Banking and access to Medical Data.

OAuth can also be something you build a modern software platform around, and can lead to simpler code.

CHALLENGES

There can also be a steep learning curve to implementing 'flows' and getting usability + reliability in good shape.

When companies start using OAuth they typically need to migrate some existing User Data to the Authorization Server and change the Login User Experience.

A blog of mine focuses on getting started with an OAuth architecture, and there are some web and mobile code samples you can run.

IS IT RIGHT FOR YOUR WEB / MOBILE UIs?

On the technical side OAuth is the preferred solution for web / mobile integration with REST APIs, where both the Web UI and Mobile UI send access tokens on API requests.

The cost and end user impact is another key factor in choosing the moment to dive into OAuth. It can be a 'project' rather than a small technical job.

user_90198850
Related