What is Oauth (Open Autherization)

OAuth 2.0 is an authorization framework that allows a third-party application to access a user’s resources without exposing their password. It uses access tokens instead. The user authenticates with a trusted authorization server, grants permission, and the app receives an access token to access the user’s data securely.

Easy points to remember Oauth flow login with Google and Github.

How it works:

1. User wants to login into new app

   Instead of creating new account, user clicks login with Google/Github

2. App redirect user to Google authentication page

   The app doen’t ask for your password it sends you to google authentication page.

3. User approve access

   you log into google (if not already logged in)

   you see a message Allow this app to access you name and email

4. Google sends an authentication code

   After approval, Google sends a temporary code to the app

5. App exchange code for access token

   The app sends a code to google’s Token endpoint, google responds with an Access Token.

6. App uses token to fetch user data

   The app uses the token to ask google for your name, email etc.

7. User is logged in

   app receives basics info and logs you in

   your password is never shared with the App

Oauth lets you log into the apps uising your google or Github account without sharing your password it uses tokens to give safe, limited access.