1

As I understand it, zero-legged OAuth is where the normally temporary token/secret codes are decided on beforehand and are made to not expire, so there's no authentication step needed before you make "actual" requests of the backend REST API. To me, that seems to go against the standard. Am I right in thinking this?

  • Say more about what it violates? The authentication is in practice no different- the same secret is used as in other flows by the client to create a signature or otherwise provide proof of their possession of the secret. The difference is on the service providers side, every service provider endpoint participating in zero-legged auth needs to know how to access the providers form of the client secret to be able to directly validate requests signed with the secret. This is a less capable, more monolithic and potentially less secure architecture. – Jonah Benton Sep 3 '16 at 15:04
  • @JonahB Can you make that comment an answer? – slim Sep 6 '16 at 13:41
  • sure thing, comment now an answer. – Jonah Benton Sep 6 '16 at 14:36
2

The authentication is in practice no different- the same secret is used as in other flows by the client to create a signature or otherwise provide proof of possession of the secret.

The difference is on the service providers side. Every service provider endpoint participating in zero-legged-auth needs to know how to access the provider's form of the client secret, to be able to directly validate requests signed with the secret.

This is a less capable, more monolithic and potentially less secure architecture- less secure because of the need to distribute the actual shared secret, rather than a limited-use token.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.