Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
API Authorization with OAuth2
Search
Bastian Hofmann
April 18, 2012
Technology
4
770
API Authorization with OAuth2
How it works and how to use it
Bastian Hofmann
April 18, 2012
Tweet
Share
More Decks by Bastian Hofmann
See All by Bastian Hofmann
Monitoring in Kubernetes with Prometheus and Grafana
bastianhofmann
0
330
Creating a fast Kubernetes Development Workflow
bastianhofmann
0
120
Highly available cross-region deployments with Kubernetes
bastianhofmann
1
150
From source to Kubernetes in 30 minutes
bastianhofmann
0
160
Introduction to Kubernetes
bastianhofmann
1
140
CI/CD with Kubernetes
bastianhofmann
0
190
Creating a fast Kubernetes Development Workflow
bastianhofmann
1
260
Deploying your first Micro-Service application to Kubernetes
bastianhofmann
2
180
Creating a fast Kubernetes Development Workflow
bastianhofmann
0
230
Other Decks in Technology
See All in Technology
AI AgentをLangflowでサクッと作って、1日働かせてみた!
yano13
1
170
Dify on AWS 環境構築手順
yosse95ai
0
150
コンパウンド組織のCRE #cre_meetup
layerx
PRO
1
280
会社を支える Pythonという言語戦略 ~なぜPythonを主要言語にしているのか?~
curekoshimizu
3
880
Behind Postgres 18: The People, the Code, & the Invisible Work | Claire Giordano | PGConfEU 2025
clairegiordano
0
150
AWS re:Invent 2025事前勉強会資料 / AWS re:Invent 2025 pre study meetup
kinunori
0
700
webpack依存からの脱却!快適フロントエンド開発をViteで実現する #vuefes
bengo4com
4
3.6k
ソースを読む時の思考プロセスの例-MkDocs
sat
PRO
1
310
ストレージエンジニアの仕事と、近年の計算機について / 第58回 情報科学若手の会
pfn
PRO
3
880
「タコピーの原罪」から学ぶ間違った”支援” / the bad support of Takopii
piyonakajima
0
150
ざっくり学ぶ 『エンジニアリングリーダー 技術組織を育てるリーダーシップと セルフマネジメント』 / 50 minute Engineering Leader
iwashi86
4
1.8k
AI-Readyを目指した非構造化データのメダリオンアーキテクチャ
r_miura
1
340
Featured
See All Featured
Facilitating Awesome Meetings
lara
57
6.6k
Design and Strategy: How to Deal with People Who Don’t "Get" Design
morganepeng
132
19k
JavaScript: Past, Present, and Future - NDC Porto 2020
reverentgeek
52
5.7k
Balancing Empowerment & Direction
lara
5
700
How GitHub (no longer) Works
holman
315
140k
KATA
mclloyd
PRO
32
15k
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
sstephenson
162
15k
Put a Button on it: Removing Barriers to Going Fast.
kastner
60
4k
Java REST API Framework Comparison - PWX 2021
mraible
34
8.9k
Documentation Writing (for coders)
carmenintech
75
5.1k
Scaling GitHub
holman
463
140k
Practical Orchestrator
shlominoach
190
11k
Transcript
@BastianHofmann API Authorization with OAuth2 How it works and how
to use it
http://oauth.net/
None
None
None
None
None
None
None
Questions? Ask!
http://speakerdeck.com/u/bastianhofmann
http://oauth.net/
http://tools.ietf.org/html/rfc5849
lanyrd.com twitter.com Pre Registration of Client at Twitter: - Shared
Consumer Key - Shared Consumer Secret
HTTP POST Connect with Twitter lanyrd.com
twitter.com HTTP POST Connect with Twitter HTTP GET Consumer Key
Redirect URI Signature (Consumer Secret) lanyrd.com
twitter.com HTTP POST Connect with Twitter Request Token Request Token
Secret lanyrd.com
http://twitter.com/authorize? requestToken=... HTTP Redirect lanyrd.com
HTTP GET twitter.com/ authorize
Login twitter.com/ authorize
Grant permission twitter.com/ authorize Create verifier and bind it to
User and Request Token
Redirect URI?verifier=...&requestToken=.. HTTP Redirect twitter.com/ authorize
HTTP GET lanyrd.com (RedirectURI? verifier=...)
HTTP GET HTTP GET Consumer Key, RequestToken Verifier Signature (Consumer
& Request Token Secret) twitter.com lanyrd.com
HTTP GET Access Token Access Token Secret twitter.com lanyrd.com
HTTP GET API Request Consumer Key, Access Token Signature (Consumer
& Access Token Secret) twitter.com lanyrd.com
POST /oauth/request_token HTTP/1.1 Host: api.twitter.com Authorization: OAuth oauth_consumer_key=“abcdef“, oauth_signature_method=“HMAC-SHA1“, oauth_timestamp=“137131200“,
oauth_nonce=“gggg“, oauth_callback=“http%3A%2F %2Fexample.com%2Fcallback“ oauth_signature=“...“
HTTP/1.1 200 OK Content-Type: application/x-www-form- urlencode oauth_token=defghi&oauth_token_secret=jkl mnop&oauth_callback_confirmed=true
HTTP/1.1 302 Found Location: https://api.twitter.com/oauth/ authorization?oauth_token=defghi
HTTP/1.1 302 Found Location: http://example.com/callback? oauth_token=defghi&oauth_verifier=qrstuvw
POST /oauth/access_token HTTP/1.1 Host: api.twitter.com Authorization: OAuth oauth_consumer_key=“abcdef“, oauth_token=“defghi“ oauth_signature_method=“HMAC-SHA1“,
oauth_timestamp=“137131201“, oauth_nonce=“hhhhh“, oauth_verifier=“qrstuvw“ oauth_signature=“...“
HTTP/1.1 200 OK Content-Type: application/x-www-form- urlencode oauth_token=xzyabc&oauth_token_secret=defg hijk
POST /1/statuses/update.json HTTP/1.1 Host: api.twitter.com Authorization: OAuth oauth_consumer_key=“abcdef“, oauth_token=“ xzyabc“
oauth_signature_method=“HMAC-SHA1“, oauth_timestamp=“137131203“, oauth_nonce=“iiiiiii“, oauth_signature=“...“ status=New %20Tweet&trim_user=true&include_entities=tru e
Signatures
GET /photos/vacation.jpg? oauth_consumer_key=123&oauth_nonce= 456&oauth_signature_method=HMAC- SHA1&oauth_timestamp=1191242096&oau th_token=789&oauth_version=1.0 HTTP/1.1 Host: photos.example.net
GET&http%3A%2F %2Fphotos.example.net%2Fphotos %2Fvacation.jpg&oauth_consumer_key %3D123%26oauth_nonce %3D456%26oauth_signature_method %3DHMAC-SHA1%26oauth_timestamp %3D1191242096%26oauth_token %3D789%26oauth_version%3D1.0
PLAINTEXT
HMAC-SHA1 Salt: consumerSecret(&tokenSecret)
RSA-SHA1 Public/Private Key
DEMO
http://oauth.googlecode.com/svn/code/java/
Problems Does not work well with non web or JavaScript
based clients The „Invalid Signature“ Problem Complicated Flow, many requests
How to fix it?
http://oauth.net/
http://tools.ietf.org/html/draft-ietf-oauth-v2
http://tools.ietf.org/html/draft-ietf-oauth-v2 What‘s new in OAuth2? (Draft 10) Different client profiles
No signatures No Token Secrets Cookie-like Bearer Token No Request Tokens Much more flexible regarding extensions Mandatory TSL/SSL
Web-Server Profile
lanyrd.com twitter.com Pre Registration of Client at Twitter: - Shared
Client ID - Shared Client Secret - Redirect URI
HTTP(S) POST Connect with Twitter lanyrd.com
http://twitter.com/authorize?&clientId=... HTTPS Redirect lanyrd.com
HTTPS GET twitter.com/ authorize
Login twitter.com/ authorize
Grant permission twitter.com/ authorize Create authorization code and bind it
to User and ClientID
Redirect URI?authorizationCode=... HTTPS Redirect twitter.com/ authorize
HTTPS GET lanyrd.com (RedirectURI? authorizationCode= ...)
HTTPS GET HTTPS GET Consumer Key Authorization Code Consumer Secret
twitter.com lanyrd.com
HTTPS GET Access Token (Refresh Token) twitter.com lanyrd.com
HTTPS GET HTTPS API Request Access Token twitter.com lanyrd.com
HTTPS GET HTTPS GET Consumer Key Refresh Token Consumer Secret
twitter.com lanyrd.com
HTTPS GET Access Token Refresh Token twitter.com lanyrd.com
HTTPS GET API Request with Access Token twitter.com lanyrd.com
HTTP/1.1 302 Found Location: https://api.twitter.com/oauth2/ authorize? response_type=code&client_id=abcdefg&state=x yz&scope=write
HTTP/1.1 302 Found Location: https://example.com/callback? code=ghijkl&state=xyz
POST /oauth2/token HTTP/1.1 Host: api.twitter.com Content-Type: application/x-www-form- urlencoded;charset=UTF-8 grant_type=authorization_code&code=ghijkl&c lient_id=12345&client_secret=7890
POST /oauth2/token HTTP/1.1 Host: api.twitter.com Authorization: Basic mnopqrs Content-Type: application/x-www-form-
urlencoded;charset=UTF-8 grant_type=authorization_code&code=ghijkl
HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 { "access_token“: "jklmno“, "expires_in“: 3600,
"refresh_token“: "qrstuvq“ }
GET /1/statuses/home_timeline HTTP/1.1 Host: api.twitter.com Authorization: Bearer jklmno
DEMO
https://github.com/bashofmann/oauth2_java_webapp_example http://code.google.com/p/google-oauth-java-client/
Refresh Token
POST /oauth2/token HTTP/1.1 Host: api.twitter.com Authorization: Basic mnopqrs Content-Type: application/x-www-form-
urlencoded;charset=UTF-8 grant_type=refresh_token&code=qrstuvq
Authorization Types
Bearer Tokens
http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer
GET /1/statuses/home_timeline HTTP/1.1 Host: api.twitter.com Authorization: Bearer jklmno
SSL not possible?
Signatures
http://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac
HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 { "access_token“: "jklmno“, "token_type“: "mac“,
"expires_in“: 3600, "refresh_token“: "qrstuvq“ "mac_key":"adijq39jdlaska9asud", "mac_algorithm":"hmac-sha-1" }
GET /1/statuses/home_timeline HTTP/1.1 Host: api.twitter.com Authorization: MAC id=“123456“, nonce=“274312:dj83hs“, mac=“.....“
timestamp\n nonce\n HTTP_METHOD\n HTTP Request URI\n Hostname\n Port\n (Authorization extension)
And JavaScript?
User-Agent Profile
http://twitter.com/authorize?&clientId=... Open Popup lanyrd.com
http://twitter.com/authorize?&clientId=... Open Popup lanyrd.com HTTPS GET twitter.co m/ authorize
http://twitter.com/authorize?&clientId=... Open Popup lanyrd.com Login twitter.co m/ authorize
http://twitter.com/authorize?&clientId=... Open Popup lanyrd.com Grant Permission twitter.co m/ authorize
lanyrd.com HTTPS Redirect RedirectURI#acces sToken twitter.co m/ authorize RedirectURI# accessToken
lanyrd.com
lanyrd.com RedirectURI# accessToken Parse Access Token from Fragment Send it
to opening window Close popup lanyrd.com
Same Origin Policy
lanyrd.com HTTPS Ajax Request to API Access Token twitter.com
Same Origin Policy
None
JSONP
Cross Origin Request Sharing (CORS)
Backend api.twitter.com Client lanyrd. com AJAX Access-Control-Allow-Origin: * http://www.w3.org/TR/cors/
GET /oauth2/authorize? response_type=token&client_id=abcdefg&stat e=xyz&scope=write HTTP/1.1 Host: api.twitter.com
HTTP/1.1 302 Found Location: http://example.com/ callback#access_token=gahorha&state=xyz&exp ires_in=3600
1.<script> 2. var fragmentString = location.hash.substr(1); 3. var fragment =
{}; 4. var fragmentItemStrings = fragmentString.split('&'); 5. for (var i in fragmentItemStrings) { 6. var fragmentItem = fragmentItemStrings[i].split('='); 7. if (fragmentItem.length !== 2) { 8. continue; 9. } 10. fragment[fragmentItem[0]] = fragmentItem[1]; 11. } 12. opener.setAccessToken(fragment['access_token']); 13. window.close(); 14.</script>
DEMO
https://github.com/bashofmann/statusnet_js_mashup_2nd
State
Scopes Optional parameter for provider specific implementations Additional return values
Access Control
http://openidconnect.com/ Scope: „openid“ With access token additional values are returned
UserID: URL to Portable Contacts endpoint Timestamp Signature
Mobile/Desktop
h"p://twi"er.com/Bas2anHofmann h"ps://profiles.google.com/bashofmann h"p://lanyrd.com/people/Bas2anHofmann/ h"p://speakerdeck.com/u/bas2anhofmann
[email protected]