Use Case of Oauth 2.0?

Sachin Singh

I have asked this question to many developers and even in stack overflow and CSharpCorner but never got a satisfactory answer. According to every developer there is only one use case of oauth2.0 and it is like stated below.

“hey, do you want to log into our website with other website’s login?

My question is if I am having a REST API which will be consumed only by my frontend clients(browser and mobile), and no third party apps involved. Is the OAuth2.0 the right tool? I know Form and Basic authentication is there. But is Social login the only use case of OAuth2.0

I politely request to answer my question from all oauth gurus here and please don't answer if you are only going to state

Oauth is an authorization protocol which allows one app to consume services of another app on user's behalf without actually knowing his password.

3 Replies

Know the answer? Post it — somebody with the same question will find it here.

Ehsan Sajjad6y ago
@aashima OAuth is a mechanism to make access to our APIs secure so that someone who is not allowed can't be able to access the API with different hacks.

i will suggest you to read about OAuth first before asking these very basic question. Read the following:

OAuth is an open-source authorization protocol currently in Version 2.0. OAuth controls access—it lets you decide who can access your API and only allows the people that you deem worthy into your API. OAuth sends the application a secure token, the application sends the secure token to the API, and then your authorized user is allowed entry.

You can read the complete post at below link":

https://developer.ibm.com/apiconnect/2017/07/13/securing-api-oauth/
0
Sachin Singh6y ago
@Ehsan ,so there is no second use of it ...and is only useful when there are 3 parties
My Application
My Client
OAuth Provider
Then what is meant by the statement "Secure your API with OAuth"?
0
Ehsan Sajjad6y ago
First of all let's get to the definition of OAuth.

Following is the definition from Wikipedia:

OAuth is an open standard for access delegation, commonly used as a way for Internet users to grant websites or applications access to their information on other websites but without giving them the passwords.^[1] This mechanism is used by companies such as Amazon,^[2] Google, Facebook, Microsoft and Twitter to permit the users to share information about their accounts with third party applications or websites.

The following should make it clear about when and why to use it.

You should only use OAuth if you actually need it. If you are building a service where you need to use a user's private data that is stored on another system

And for more cllarity on when to use it read the following detailed post :

https://stormpath.com/blog/what-the-heck-is-oauth#:~:text=When%20to%20Use%20OAuth,on%20another%20system%20%E2%80%94%20use%20OAuth.
-1