What is the difference between OAuth based and Token based authentication?

前端 未结 3 1649
孤独总比滥情好
孤独总比滥情好 2020-12-22 16:50

I thought that OAuth is basically a token based authentication specification but most of the time frameworks act as if there is a difference between them. For example, as sh

3条回答
  •  轻奢々
    轻奢々 (楼主)
    2020-12-22 17:11

    OAuth is a specification for authorization not authentication

    OAuth 2.0 is a specification for authorization, but NOT for authentication. RFC 6749, 3.1. Authorization Endpoint explicitly says as follows:

    The authorization endpoint is used to interact with the resource owner and obtain an authorization grant. The authorization server MUST first verify the identity of the resource owner. The way in which the authorization server authenticates the resource owner (e.g., username and password login, session cookies) is beyond the scope of this specification.

    Only use OAuth if you want to give access to a third party service to your apis. Even when you are using OAuth you would need some kind of authentication (token based or session based etc) to authenticate the uses. OAuth is not designed for authentication.

    see this question.

提交回复
热议问题