OAuth 2.0

Also Known As

TL;DR

Explanation

OAuth 2.0 defines several grant types for different use cases. The Authorization Code flow (with PKCE for public clients) is the most secure: the user authenticates with the identity provider, receives a short-lived code, and the client exchanges it for tokens. The Implicit flow is deprecated. Client Credentials is used for machine-to-machine. OAuth 2.0 handles authorisation only; OpenID Connect adds identity (authentication) on top.

Diagram

sequenceDiagram
    participant U as User
    participant C as Client App
    participant A as Auth Server
    participant R as Resource Server
    U->>C: Click Login with Google
    C->>A: Redirect + client_id + state + scope
    A->>U: Show login and consent screen
    U->>A: Approve
    A->>C: Redirect with code + state
    C->>A: POST code + client_secret
    A->>C: access_token + id_token
    C->>R: GET /userinfo Bearer token
    R->>C: User profile data

Common Misconception

Why It Matters

Common Mistakes

• Not validating the state parameter — enables CSRF against the OAuth callback.
• Not restricting redirect_uri — any URI can receive the authorisation code.
• Using Implicit flow — the access token is exposed in the browser URL and history.
• Not validating the id_token audience (aud) claim when using OIDC — tokens issued to other clients are accepted.

Code Examples

// Missing state validation — CSRF on OAuth callback:
$code = $_GET['code'];
// state parameter not checked — attacker can forge the callback
$tokens = exchangeCode($code);
loginUser($tokens);

// State validation prevents CSRF:
$state = $_GET['state'] ?? '';
if (!hash_equals($_SESSION['oauth_state'], $state)) {
    throw new SecurityException('Invalid state — possible CSRF');
}
unset($_SESSION['oauth_state']);
$tokens = exchangeCode($_GET['code']);

References

• ↗ https://oauth.net/2/
• ↗ https://datatracker.ietf.org/doc/html/rfc6749

Tags

Related Terms