#SpringSecurity: OAuth2 Implementation with Spring Boot

ALSO CHECK: Spring Interview Questions and Answers

In this tutorial we will learn to build an authorization server using oauth2 to authenticate user's identity to provide access_token. This access_token will be used to request data from resource server.

We will be creating an authorization server and embedding the resource server inside authorization server. Authorization server will generate the tokens and resource server will validate these token.

We will be having two services, first one would be authorization server (along with resource server) and the second one would be a client, from which we will be accessing the servers.

#SpringSecurity: What is the difference between access and refresh token?

ALSO CHECK: Spring Interview Questions and Answers

Access Token

• An access token is a string representing an authorization issued to the client. Tokens represent specific scopes and duration of access, granted by the resource owner, and enforced by the resource server and authorization server.
• An access token is put in the Authorization header of our request and it usually looks like 'Bearer h090Yuuyuiyv'. It is verified by the API, which the client is calling.
• Access token are usually in JWT format, but you can use any other format.
• Access tokens are usually short lived, because it is difficult (although not impossible) to centrally revoke access tokens.
• The responsibility of access token is to access data before it gets expired.

#SpringSecurity:Oauth 2.0 Roles

ALSO CHECK: Spring Interview Questions and Answers

OAuth 2 is an authorization method to provide access to protected resources over the HTTP protocol.

It enables a third-party application to obtain limited access to an HTTP service:
a). Either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service
b). Or by allowing the third-party application to obtain access on its own behalf.

#SpringSecurity: What’s the difference OAuth 1.0 and OAuth 2.0?

ALSO CHECK: Spring Interview Questions and Answers

 OAuth 2.0 is a completely new protocol, and this release is not backwards-compatible with OAuth 1.0.

#JWT: Part 3 - Spring Boot project with Spring Security and JWT Example

ALSO CHECK: Spring/JWT Interview Questions And Answers

We will develop a Spring boot project with Spring security and JWt from scratch.

Objectives:
1). Create an API which will authenticate the user details and generate JWT token.
2). Functionality which will verify each request for the valid JWT.

#JWT: Part 2 - JWT Structure

ALSO CHECK: Spring/JWT Interview Questions And Answers

What is JWT token?
JWT (JSON Web Token) is a safe, compact, and self-contained way of transmitting information between multiple parties in the form of a JSON object. It is used for authorization.

#JWT: Part 1 - Authorization Strategies, Real Life examples of Session and JWT Token

ALSO CHECK: Spring/JWT Interview Questions And Answers

Authorization Strategies
HTTP is a stateless protocol that's why we need to send all the desired information each time, so that the server can authorize the request.

Let's say you are logged in tinder, while login you need to enter your user name and password. Tinder will verify if you are a valid user or not, if yes, it will start showing potential matches. Now if you right or left swipe on any profile, or do anything else on Tinder, it will send a request again to the Tinder server. Since HTTP is stateless, with each request you will asked to enter your credentials, which is quite irritating. To solve this problem, the session is managed.