OAuth - 401-advanced-javascript-billybunn/seattle-javascript-401d29 GitHub Wiki
OAuth 2
Example
Have you ever clicked "Log In" on a website and it gave you an option to sign-in using your account credentials from a different website? That's OAuth, an open-standard authorization protocol. Another example might be less obvious because of the work being done behind the scenes. When you attach a cloud-stored file to someone as an email attachment, OAuth could be used behind the scenes between the email system and storage host (maybe iCloud, Google Drive, or OneDrive) to authenticate and attach the files without the user needing a second log-in.
Roles
There are a few key players in an OAuth exchange.
- The Third-Party Application: "Client" - This is the application asking you for access to some other account. "This app would like access to your Facebook credentials to log in"
- The API: "Resource Server" - This is the server being used to access your account info.
- The Authorization Server - This is the server that actually presents the authorization interface (the "allow"/"don't allow" page) to the user where they approve or deny the request for access.
- The User: "Resource Owner" - You! The person that actually gives authorization, says "yes"/"no".