O auth with facebook and google using .net
-
Upload
sathyaish-chakravarthy -
Category
Engineering
-
view
190 -
download
4
Transcript of O auth with facebook and google using .net
OAuth allows you to give a third-party application the
permission to use some of your resources on a resource
server without giving the third party your user name
and password on the resource server.
“”
Implicit
Flow
Authorization
Code
Flow
Resource Server
Client Credentials
Flow
Resource Owner
Password Credentials
Flow
Authorization Code Flow Under the Covers
You
Resource Owner
Resource Server
Client
AuthorizationServer
2
1
4
5
3
Exchange auth code for access token
Authorization Code Flow Under the Covers
You
Resource Owner
Client
2
1
GET
client_id
Who is making this request?
scope
What do they want to know about the user?
response_type (reserved: code)
What do they want from me just now?
redirect_uri
Where should I send them this stuff?
state (optional but recommended)
CSRF token
1 2and
?
Authorization Code Flow Under the Covers
You
Resource Owner
Client
2
1
RESPONSE (302)
code
Authorization code
error
Location: client_redirect_uri?code=ljfvknfANB3454
Location: client_redirect_uri?error=access_denied
Or
2
state (CSRF token)
If you’d sent it
?
Authorization Code Flow Under the Covers
You
Resource Owner
Client
2
1
GET
code
Authorization code
error
client_redirect_uri?code=ljfvknfANB3454
client_redirect_uri?error=access_denied
Or
3
3
Authorization Code Flow Under the Covers
Client
AuthorizationServer4
Exchange auth code for access token
GET or POST
client_id
Who is making this request?
client_secret
What’s the password I gave you earlier? Prove your identity.
grant_type
What’s this flow? Oh, you’re a web server, so this must be the “authorization code” flow.
code
Okay, show us the authorization code?
state (optional but recommended)
CSRF token
4
Authorization Code Flow Under the Covers
Client
AuthorizationServer4
Exchange auth code for access token
RESPONSE (query string or request body)
access_token
state (optional but recommended)
CSRF token
4
Authorization Code Flow Under the Covers
Resource Server
Client
5
GET OR POST
Access_token
As querystring or request body or basic
authentication / bearer authentication
(HTTP authorization header)
5
Authorization Code Flow Under the Covers
You
Resource Owner
Resource Server
Client
AuthorizationServer
2
1
4
5
3
Exchange auth code for access token
Roles
• You, the resource owner
• Client, the server side web app
• Resource server
• Authorization Server
Limitations of OAuth 2.0
• No discovery
• Requires HTTPS
• Open redirectors – RFC 6819 – OAuth 2.0 Thread Model and Security Considerations
• Implementations differ widely
Further Reading
• RFC 6749 – The OAuth 2.0 Authorization Frameworkhttp://tools.ietf.org/html/rfc6749
• Google https://developers.google.com/identity/protocols/OAuth2WebServer
• Facebook (Facebook Login) -https://developers.facebook.com/docs/facebook-login/v2.3