4 ms·
Isn't it other way around? Authentication is about confirming one's identity and that's what oAuth is used for. Authorization is about giving proper permissions
by ancymon 6y ago
Isn't it other way around? Authentication is about confirming one's identity and that's what oAuth is used for. Authorization is about giving proper permissions and that's what happens after you get authenticated and has nothing to do with oAuth. Am I missing something?
- tenplusfive 6y agoOAuth 2.0 is meant for Authorization. Multiple parties used if for Authentication, which is why a standardized Authentication layer was built on top of OAuth which is called OpenID Connect.
- magicalhippo 6y agoNo, I believe you got it 100% backwards. See the diagram in the RFC[1] and section 1.3 just below it. Sure OAuth usually involves authentication, but OAuth doesn't really care how it's done. Then again, not my field of expertise so I might be wrong. [1]: https://tools.ietf.org/html/rfc6749#section-1.2 https://tools.ietf.org/html/rfc6749#section-1.2
- preommr 6y agoIt's really stupid because it is an authorization protocol that people use for authentication because if you have access to certain resources, it implies you're a particular user.