2learn

Authentication & Authorization (OAuth2 / JWT)

OAuth2, JWT

What it is

Authentication is proving who the caller is; authorization is deciding what that caller may do. They are separate problems with separate failure modes, and confusing them is the origin of most access-control bugs. OAuth2 is a framework for delegating authorization to a third party — a client obtains a token that represents a limited grant — and JWT is a token format whose contents can be verified without consulting the issuer. Together they cover how an API learns who is calling and what they are permitted.

Why it matters

Access control is where the consequences are worst. A service that authenticates correctly and authorizes carelessly lets any signed-in user read any other user’s data, which is a breach rather than a bug. The protocols involved are also easy to use in a way that looks correct and is not: tokens that never expire, signatures that are not verified, scopes that are ignored. Understanding the flows and the verification steps is what separates a token check that works from one that can be bypassed.

In this track

  1. Authentication and OAuth2 flows (05-backend-data/10-authentication-authorization-oauth2-jwt/01-authentication-and-oauth2-flows) — who issues the credential, and which flow suits which kind of client.
  2. JWT verification and authorization (05-backend-data/10-authentication-authorization-oauth2-jwt/02-jwt-verification-and-authorization) — verifying a token and turning its claims into a decision.

Prerequisites

Go deeper

Analytics cookies are set only if you allow them. Nothing is loaded, and nothing is sent, until you choose.