Understanding OAuth2: How Access Tokens Secure User Data

This article provides a simple description of the OAuth2 working background, enabling readers to easily understand the problems OAuth2 solves.

1. Users have their own data

2. A server that manages user data, called the Resource Server

3. A client application that wants to use the user's data

4. The resource server provides an API to deliver user data

5. The client requests the API for user data

6. The resource server returns the user data

7. What if a malicious client tries to access data?

8. The bad client also requests the resource server API

9. The resource server can still return user data

10. The malicious client obtains the user data

11. A mechanism is needed to protect user data

12. Best practice: clients use an Access Token to prove permission

13. The client presents its Token when requesting the API

14. The resource server extracts the Token from the request

15. The resource server validates the Token

16. If valid, the resource server returns the user data

17. The client must obtain the Token beforehand

18. Someone must issue the Token

20. The token‑issuing role is the Authorization Server

21. The client interacts with the Authorization Server

22. The Authorization Server generates a Token

23. The Token is issued to the client

24. At this point there are three roles: Authorization Server, Client, Resource Server

27. The client uses the Token to request the Resource Server API

28. The Resource Server extracts the Token from the request

29. The Token is validated

30. If the Token is valid, the Resource Server returns user data

31. In practice, before generating a Token the Authorization Server must ask the user for consent

32. The client requests a Token from the Authorization Server

33. The Authorization Server asks the user whether to grant permission

34. If the user agrees, the Authorization Server generates a Token

35. The Token is issued to the client

39. This process—requesting and issuing Tokens—is the core focus of the OAuth2 framework

Summary

The OAuth2 framework concentrates on the "request Token, issue Token" portion of the security authentication process. OAuth2 defines four grant types to handle this, which will be detailed in future articles.

Translated and compiled from https://medium.com/@darutk/the-simplest-guide-to-oauth-2-0-8c71bd9a15bb