{"repo":"LukasNiessen/oauth-explained","free":true,"listed":false,"github":"https://github.com/LukasNiessen/oauth-explained","clone":"git clone https://github.com/LukasNiessen/oauth-explained.git","description":"OAuth explained with code snippet","language":"JavaScript","stars":68,"topics":["authorization","iam","oauth","oauth2"],"license":null,"category":"auth-billing-email","readme_excerpt":"OAuth Explained The Basic Idea Let's say LinkedIn wants to let users import their Google contacts. One obvious (but terrible) option would be to just ask users to enter their Gmail email and password directly into LinkedIn. But giving away your actual login credentials to another app is a huge security risk. OAuth was designed to solve exactly this kind of problem. Note: So OAuth solves an authorization problem! Not an authentication problem. See [here][ref1] for the difference. OAuth is an abbreviation for Open Authorization. Super Short Summary - User clicks “Import Google Contacts” on LinkedIn - LinkedIn redirects user to Google's OAuth consent page - User logs in and approves access - Google redirects back to LinkedIn with a one-time code - LinkedIn uses that code to get an access token from Google - LinkedIn uses the access token to call Google's API and fetch contacts More Detailed Summary Suppose LinkedIn wants to import a user's contacts from their Google account. 1. LinkedIn sets up a Google API account and receives a client id and a client secret - So Google knows this client id is LinkedIn 2. A user visits LinkedIn and clicks \"Import Google Contacts\" 3. LinkedIn redirects the user to Google's authorization endpoint: https://accounts.google.com/o/oauth2/auth?client id=12345&redirect uri=https://linkedin.com/oauth/callback&scope=contacts - client id is the before mentioned client id, so Google knows it's LinkedIn - redirect uri is very important. It's used in step 6 ","default_branch":null,"files":null,"tree":[],"storefront":"/r/LukasNiessen","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/LukasNiessen/oauth-explained/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}