OAuth2 Introduction — Delegated Authorization for Third-Party Access

In this tutorial, you will learn about OAuth2 Introduction. We cover key concepts, practical examples, and best practices to help you master this topic.

OAuth2 is an authorization framework that enables third-party applications to obtain limited access to user resources without exposing user credentials.

What You'll Learn

The core OAuth2 concepts: roles, grant types, tokens, scopes, and how OAuth2 differs from simple API authentication methods.

Why It Matters

Sharing passwords with third-party apps is dangerous. If an app is compromised, the attacker gets your password. OAuth2 solves this by issuing scoped, revocable tokens. When you click "Sign in with Google," you are using OAuth2.

Real-World Use

"Login with Google," "Login with GitHub," "Login with Facebook" — all use OAuth2. Doda Browser uses OAuth2 so users can grant access to their Google Drive files without sharing their Google password.

flowchart LR
    A["User\n(Resource Owner)"] -->|"Authorizes"| B["Client App"]
    B -->|"Requests token"| C["Authorization Server"]
    C -->|"Issues access token"| B
    B -->|"API call + token"| D["Resource Server"]
    D -->|"Returns data"| B
    B -->|"Shows result"| A
    style A fill:#dbeafe,stroke:#2563eb
    style B fill:#fef3c7,stroke:#d97706
    style C fill:#fef3c7,stroke:#d97706
    style D fill:#dcfce7,stroke:#16a34a

OAuth2 Roles

Grant Types Overview

Code Example: Simple OAuth2 Authorization URL

import urllib.parse

CLIENT_ID = "your-client-id"
REDIRECT_URI = "https://yourapp.com/callback"
AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth"
SCOPES = ["openid", "email", "profile"]

params = {
    "client_id": CLIENT_ID,
    "redirect_uri": REDIRECT_URI,
    "response_type": "code",
    "scope": " ".join(SCOPES),
    "access_type": "offline",
    "state": "random-state-value"
}

authorization_url = f"{AUTH_URL}?{urllib.parse.urlencode(params)}"
print(f"Redirect user to:\n{authorization_url}")

Expected output:

Redirect user to:
https://accounts.google.com/o/oauth2/v2/auth?client_id=your-client-id&redirect_uri=https://yourapp.com/callback&response_type=code&scope=openid+email+profile&access_type=offline&state=random-state-value

Common Mistakes

1. Using OAuth2 for Authentication Only

OAuth2 is an authorization framework. It does not authenticate users — it authorizes access. Use Openid Connect for authentication.

2. Not Using State Parameter

Without the state parameter, CSRF Attacks can swap the authorization code. Always use a unique, unguessable state value.

3. Exposing Client Secrets in Frontend

Client secrets are for confidential clients (backend). Public clients (mobile, SPA) cannot keep secrets. Use PKCE instead.

4. Confusing Access Tokens with API Keys

Access tokens are short-lived, scoped, and revocable. API keys are static and identify the application, not the user.

5. Storing Tokens Insecurely

Access tokens grant API access. Store them securely (httpOnly cookies, secure device storage).

Practice Questions

1. What is the purpose of the state parameter in OAuth2?
2. What is the difference between OAuth2 and OpenID Connect?
3. Why should mobile apps use PKCE instead of the Authorization Code grant?
4. What does a scope define in OAuth2?
5. What happens when an access token expires?

Answers:

1. The state parameter prevents CSRF attacks by correlating the authorization request with the callback. It should be unique and unguessable.
2. OAuth2 authorizes access (what the app can do). OpenID Connect adds authentication (who the user is) with an ID token.
3. Mobile apps are public clients that cannot keep secrets. PKCE adds a cryptographic challenge that prevents interception of the authorization code.
4. A scope defines the specific permissions the client is requesting (e.g., read:email, write:posts). The user consents to each scope.
5. The server returns 401. The client uses the refresh token to obtain a new access token without user interaction.

Challenge: Map a real-world OAuth2 flow you use (e.g., "Sign in with GitHub"). Identify each role, the grant type used, and the tokens involved.

FAQ

Mini Project

Create a simple Python script that generates an OAuth2 authorization URL, handles the redirect callback, exchanges the code for tokens, and makes an authenticated API call using the access token.

What's Next

Learn about specific OAuth2 grant types starting with Authorization Code Grant — the most secure and commonly used grant for web applications.