Tag Info

New answers tagged

0

Security-wise, the two approaches sound like they are just as secure. They both authenticate both the resource owner and the client (using the names as they are defined by OAuth2, as you mixed that up a bit). However, the big difference is, that the OAuth2 protocol standardizes how to do this. This has some advantages: It is always better to use a known ...


3

It may be that you need to narrow the scope a little in order to get started. Which aspect of security are you interested in. From the list of standards, you seem more interested in application security & especially in authentication and authorisation? That would be a much easier set of targets to learn at least to begin with. Also, you may need to be ...


1

If an OAuth 2.0 token is compromised, you only need to concern yourself for the TTL of the token. If an HTTP Basic Auth header is compromised, the credentials do not expire. You would manually need to change your client_id and secret, and that's if you even knew or thought they were compromised. And it's likely you would need to change your client code ...


2

What I would say about the options that you outline is that HTTP Auth with SSL is a simpler but less flexible option and Oauth2 is more complex but has more flexibility in what you can achieve with it. One example, as you've noted in your ASCII art diagram, with OAuth2 it is possible to create a token which can be used in place of the password to ...



Top 50 recent answers are included