Building OAuth 2.0 Authorization Server

DZone Security Zone

Table of Contents

1. OAuth 2.0 framework overview
   • Authorization code flow
   • PKCE
2. Reference tokens vs self-contained  
   • Introspection endpoint
   • JWT validation
3. OAuth Authorization server frontend
   • /authorize path and parameters
4. OAuth Authorization server endpoints
   • /authorize
   • /token
5. OIDC and Authentication
   • User sign-in and registration

1.  OAuth 2.0 Framework Overview

“OAuth 2.0 is the industry-standard protocol for authorization.”

https://oauth.net

To start, I would like to draw your attention to the main goal of the OAuth framework: authorization delegation. It’s very important to understand it to not be confused with the use cases it covers. The most common confusion about it is thinking of it as an authentication solution, but it is not. Looking ahead, authentication might be implemented on top of OAuth 2.0 with OpenID Connect, which is an additional identity layer.