Skip to main content
116 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

Simple Terms OpenID is about verifying a person's identity (authentication). OAuth is about accessing a person's stuff (authorization). OpenID Connect does both. All three let a person give their ...
Shaun Luttin's user avatar
  • 1,503
79 votes

The most secure way to handle someone forgetting to verify their account?

What I see most commonly is allowing the authentication and signing the user in, but locking meaningful features away until the email is verified. You should bubble up an error reminding the user to ...
Buffalo5ix's user avatar
  • 2,716
48 votes

When do you use OpenID vs. OpenID Connect

I don't think either of the other previous responses answer the question, which is asking the difference between OpenID Connect and OpenID 2.0. OpenID 2.0 is not OAuth 2.0. OpenID 2.0 and OpenID ...
theferrit32's user avatar
35 votes

Is authentication using Facebook/Google considered good practice?

I am quite sure that there are some sites which require you to login with your facebook/google account on their site (so the URL shown is not facebook/google). I am sure there are some desktop ...
Out of Band's user avatar
  • 9,283
33 votes

Why is it a bad idea to use plain oauth2 for authentication?

Note: If you are looking for something like OAuth2, but for authentication, you should use OpenId Connect instead. OAuth2 is meant for a user to authorize an application to load the user's ...
Jacco's user avatar
  • 7,712
29 votes

Why isn't PKCE encouraged for Single-Page Apps?

While all the other answers are correct, the latest OAuth 2.0 for Browser-Based Apps Best Practices Doc (January 29, 2019) states that (emphasis mine): Overview For authorizing users within a ...
Eran Medan's user avatar
28 votes

Why use OpenID Connect instead of plain OAuth2?

This article is the best explanation I've found after a LOT of searching (h/t to @rickchristie for linking to it in a comment to another answer). Summary Relying on plain OAuth 2.0 for authentication ...
Nathan Wailes's user avatar
25 votes

Why isn't PKCE encouraged for Single-Page Apps?

@catanman makes excellent points regarding the technical considerations around PKCE in SPAs, however just recently the IETF Oauth working group has published a best current practice document (December ...
Brad J's user avatar
  • 351
19 votes

In Oauth what is the benefit of the access token being opaque

In OAuth, or any other protocol where the token can be opaque or transparent, the benefits and risks swing based on what your desired result is: If you want the client to be able to parse the access ...
Nick Steele's user avatar
19 votes

How secure are expiring tokens and refresh tokens?

Let's consider there is a server that validates and issues tokens to a client. Client (sends username & password) -> Server Server (validates the credentials and returns access and refresh ...
Pavan Vamsi's user avatar
19 votes

Does PKCE replace state in the Authorization Code OAuth flow?

The state is given back by the OAuth2 server in the redirected url, so the client app can verify that the request to open the authorization page was indeed triggered by itself. The code_challenge is ...
martinstoeckli's user avatar
17 votes

Why isn't PKCE encouraged for Single-Page Apps?

SPAs would not benefit from PKCE. PKCE solves a different problem than the one you're describing. First of all, for SPAs the current best practice is still to use the implicit flow, not the ...
el_tigro's user avatar
  • 704
16 votes

What is the difference between API keys and API tokens usages?

API keys are public, by intent. They are an authorisation mechanism, not an authentication mechanism (this is mentioned in your links). It does not matter how they are generated but it matters how ...
schroeder's user avatar
  • 131k
15 votes

OAuth2 and Authentication

1.What is the difference between authentication and authorization? Authentication is the process, by which a server checks if a user is indeed the user that it claims to be. This is usually done, ...
Dimos's user avatar
  • 266
15 votes

Why is it a bad idea to use plain oauth2 for authentication?

As explained by Jacco, a naive implementation of authentication on top of oauth2 has several vulnerabilities, the most common of which is CSRF. Given there's a perfectly good authentication protocol ...
GnP's user avatar
  • 2,279
14 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

We already have a diagram and a lot of good data so here is an example in case that helps. Let's say I want to post a comment to StackOverflow. StackOverflow only allows comments if a user has 50 ...
Pace's user avatar
  • 241
12 votes

What is the worst that can happen if your OAuth client secret is leaked?

Sometimes you have to share the OAuth client secret, which is the case for mobile apps. The real protection here is the whitelist of where the OAuth secrets can be used. Despite the name "secret" ...
rook's user avatar
  • 47.2k
11 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

In addition to the other responses: I think that a lot of confusion comes from inacurrate, or at least unusual use of the terms Authentication and Authorization OpenID Connect 1.0 is marketed as an ...
Guillaume's user avatar
  • 210
11 votes

How to do role-based authorization with OAuth2 / OpenID Connect?

The role concept can be used with access tokens in OpenID Connect (Oauth2). Consider that a scope is a request for claims about the user that should be included in the access token. The API ...
Geir Emblemsvag's user avatar
11 votes

Authentication for SPA

TL;DR Go with implicit... Check Which OAuth 2.0 flow should I use? for a visualization of the decision process. When it comes to authentication, the devil is on the details... I'll try not to forget ...
João Angelo's user avatar
11 votes

What are the advantages of using JWT over Basic Auth with Https?

First, as Steffen's comment points out, you don't send credentials (certainly not complete ones, suitable for authentication) in JWTs. I mean, you could, but that both completely misses the point of a ...
CBHacking's user avatar
  • 49.2k
11 votes

Why do big sites use cookies and not OpenID connect?

Hmm. I think there's a lot you don't understand, here. Tons of sites do use OAuth (and often OIDC) for initial authentication, StackExchance (optionally) being one of them. To answer the closest ...
CBHacking's user avatar
  • 49.2k
10 votes

Why are developers using embedded user agents for 3rd party auth? What are the alternatives?

Am I right to be concerned that this is a growing opportunity for phishing and MITM attacks (fake or hijacked browser in the middle which steals credentials and/or tokens in real time, also defeating ...
user196499's user avatar
  • 1,121
10 votes

IN OAuth 2.0, how is the client secret supposed to be kept secret?

OAuth2 specification defines two types of clients confidential Clients capable of maintaining the confidentiality of their credentials (e.g., client implemented on a secure server with ...
AGrzes's user avatar
  • 616
9 votes

Does the auth server have to be separate from the resource server when using OAuth 2.0?

OAuth is like any other auth scheme with regard to its functional purpose. You send creds to it, and it returns user info (even if it's only success/fail messages). Usually a standards based auth ...
Neil Davis's user avatar
9 votes

OAuth - What if the refresh token is stolen?

TL;DR: Yes refresh tokens are bearer token and so should be protected. Refresh tokens are powerful because in general they are: long term: meaning that they have long expiration times privileged ...
channel's user avatar
  • 401
9 votes

PKCE vs Client Secret

It boils down to whether there is a chance your authorization code might leak. PKCE is about preventing leaked "authorization code"s from being useful. When you ask for an authorization code,...
jnnnnn's user avatar
  • 191
8 votes

Why use OpenID Connect instead of plain OAuth2?

OpenID Connect is a profile of OAuth2... defining an architecture that enables a person to authorize an identity provider to release certain user claims to a client (website / mobile application). ...
Mike Schwartz's user avatar
8 votes

JWT vs. Client Certificates

For a bit of context, I have worked heavily with JWT token based authentication but have little experience with client certificates so my answer will weight biased (information and opinion-wise) to ...
dFrancisco's user avatar
  • 2,731
8 votes

Why CORS preflight is not available for POST requests when Content-Type is application/x-www-form-urlencoded

So my understanding of why this is allowed is so that the implementation of CORS wouldn't break existing and well understood functionality which was already allowed by browsers. This also means that ...
GreatSeaSpider's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible