Bearer Authorization
Review, Research, and Discussion
- Write the following steps in the correct order:
- Register your application to get a client_id and client_secret
- Ask the client if they want to sign in via a third party
- Redirect to a third party authentication endpoint
- Receive authorization code
- Make a request to the access token endpoint
- Receive access token
- Make a request to a third-party API endpoint
- What can you do with an authorization code?
- The authorization code is a special password that authorizes the user to manipulate data within a security protected space.
- What can you do with an access token?
- The token authorizes the user within a specific app, to access certain data.
- What’s a benefit of using OAuth instead of your own basic authentication?
- Less liability, as it is relayed to OAuth, and generally Oauth is more secure than basic authentication.
Vocab
- Client ID - is an identifier associated with an application that assists, with client APIs.
- Client Secret - a secret known only to the app and auth server.
- Authentication Endpoint - an endpoint that is called to obtain an access token which can then be used in the subsequent password update callouts.
- Access Token Endpoint - where apps make a request to get an access token for a user
- API Endpoint - a point at which an API connects with the software program.
- Authorization Code - is a temp code that a client will exchange for an access token.
- Access Token - The token authorizes the user within a specific app, to access certain data.