LearnViz CompSci
Home / Learn / Web Development / OAuth 2.0

Advanced Topic 39 of 51 Web Development

OAuth 2.0

Delegated authorization framework.

How it works

OAuth 2.0 is an authorization framework that lets an application obtain limited access to a user's resources on another service without receiving their password. Roles are the resource owner, client, authorization server and resource server. In the authorization code flow, the client redirects the user to the authorization server, receives a code and exchanges it for an access token, with PKCE protecting public clients; scopes limit what the token can do. OpenID Connect adds an identity layer on top.

Step-by-step walkthrough

  1. The app sends the user to the auth server.
  2. The user logs in and approves access.
  3. The server returns an authorization code.
  4. The app exchanges the code for an access token.
  5. The app calls the API with the token and never sees the password.

Where it is used

Sign in with Google or GitHub, granting apps access to calendars or repositories, and API access for third-party integrations use OAuth.

Common pitfall

Using the deprecated implicit flow, skipping the state parameter, loose redirect URI validation and storing tokens insecurely lead to token theft and CSRF. OAuth is for authorization, not authentication, unless OpenID Connect is used. Request minimal scopes, use PKCE and verify tokens' audience and issuer.

Where it fits in the course

OAuth 2.0 is topic 39 of 51 in Web Development, rated Advanced. It follows JWT. The next topic is CORS.

Practice and explore

How to study this topic

  1. Read the explanation above and restate the definition in your own words.
  2. Open the interactive lesson and answer its mini quiz.
  3. Read the common pitfall, then write a short example that avoids it.
  4. Check your understanding in the Web Development quiz, and revisit the topic if you miss a question.

Frequently asked questions

What is OAuth 2.0?
Delegated authorization framework. It belongs to Web Development and is an advanced-level topic.
Where do people use OAuth 2.0?
Sign in with Google or GitHub, granting apps access to calendars or repositories, and API access for third-party integrations use OAuth.
What is the most common mistake with OAuth 2.0?
Using the deprecated implicit flow, skipping the state parameter, loose redirect URI validation and storing tokens insecurely lead to token theft and CSRF.
What should I learn before this topic?
Start with JWT, the topic just before it in Web Development.
How can I practice it?
Answer the mini quiz in the interactive lesson, then take the Web Development quiz.
Is OAuth 2.0 hard to learn?
It is an Advanced topic. Expect to read the explanation more than once and to connect it with earlier topics. Working through a small example by hand helps most.
How long does it take to learn OAuth 2.0?
Most learners can read the explanation and finish the interactive lesson in under an hour. Fluency comes from applying the idea, so plan a few short practice sessions with the quiz.
Which topics are related to OAuth 2.0?
JWT, CORS, Authentication Flows are closely connected. The full list is in the related topics section of this page.
What should I study after OAuth 2.0?
Continue with CORS, the next topic in Web Development.

Related topics