#SpringSecurity: OAuth2 Implementation with Spring Boot

ALSO CHECK: Spring Interview Questions and Answers

In this tutorial we will learn to build an authorization server using oauth2 to authenticate user's identity to provide access_token. This access_token will be used to request data from resource server.

We will be creating an authorization server and embedding the resource server inside authorization server. Authorization server will generate the tokens and resource server will validate these token.

We will be having two services, first one would be authorization server (along with resource server) and the second one would be a client, from which we will be accessing the servers.

#SpringSecurity: What is the difference between access and refresh token?

ALSO CHECK: Spring Interview Questions and Answers

Access Token

• An access token is a string representing an authorization issued to the client. Tokens represent specific scopes and duration of access, granted by the resource owner, and enforced by the resource server and authorization server.
• An access token is put in the Authorization header of our request and it usually looks like 'Bearer h090Yuuyuiyv'. It is verified by the API, which the client is calling.
• Access token are usually in JWT format, but you can use any other format.
• Access tokens are usually short lived, because it is difficult (although not impossible) to centrally revoke access tokens.
• The responsibility of access token is to access data before it gets expired.

#SpringSecurity:Oauth 2.0 Roles

ALSO CHECK: Spring Interview Questions and Answers

OAuth 2 is an authorization method to provide access to protected resources over the HTTP protocol.

It enables a third-party application to obtain limited access to an HTTP service:
a). Either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service
b). Or by allowing the third-party application to obtain access on its own behalf.

#SpringSecurity: What’s the difference OAuth 1.0 and OAuth 2.0?

ALSO CHECK: Spring Interview Questions and Answers

 OAuth 2.0 is a completely new protocol, and this release is not backwards-compatible with OAuth 1.0.