An Introduction to OAuth 2

Nice Job.

Really good, thanks!

This an awesome new feature. Thanks guys !!!

wow fabulos…thank for share buddy

Which flow is most suitable for system to system communication using REST APIs?

Good explanation of the Grant Types Re: Your diagrams for Grant Type: Authorization Code Link and Grant Type: Implicit. Step 1. User Authorization Request … is this truly the “User/Resource Owner” request or is this the Application/Client request. The arrow shows the source as Application/Client however the text on the arrow indicates User/Resource Owner. Also the detailed text indicates “User”

Awesome… Thanks man…

Great this helps alot.thanks!

@author @manicas Why are you sending sensitive data as Query parameters (in URL), even though it isn’t recommended by the OAuth2 specification itself ? See the last point.

Don’t pass bearer tokens in page URLs: Bearer tokens SHOULD NOT be passed in page URLs (for example as query string parameters). Instead, bearer tokens SHOULD be passed in HTTP message headers or message bodies for which confidentiality measures are taken. Browsers, web servers, and other software may not adequately secure URLs in the browser history, web server logs, and other data structures. If bearer tokens are passed in page URLs, attackers might be able to steal them from the history data, logs, or other unsecured locations.

Thank you guys. This tutorial really helped me understand how OAUTH works. I have a little question though I will like to ask what are the steps or how can I generate a signature for my OAUTH requests as I have read that requests without signature may not be so secured.

Thanks.