Jump to content

OAuth: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
Luckas-bot (talk | contribs)
929,662 edits
m r2.7.1) (Robot: Adding hu:OAuth
Line 130: Line 130:
[[id:OAuth]]
[[id:OAuth]]
[[it:OAuth]]
[[it:OAuth]]
[[hu:OAuth]]
[[nl:OAuth]]
[[nl:OAuth]]
[[ja:OAuth]]
[[ja:OAuth]]

Revision as of 06:14, 16 May 2012

The OAuth logo, designed by Chris Messina

OAuth is an open standard for authorization. It allows users to share their private resources (e.g. photos, videos, contact lists) stored on one site with another site without having to hand out their credentials, typically supplying username and password tokens instead. Each token grants access to a specific site (e.g., a video editing site) for specific resources (e.g., just videos from a specific album) and for a defined duration (e.g., the next 2 hours). This allows a user to grant a third party site access to their information stored with another service provider, without sharing their access permissions or the full extent of their data.

OAuth is a service that is complementary to, but distinct from, OpenID.

History

OAuth began in November 2006 when Blaine Cook was developing the Twitter OpenID implementation. Meanwhile, Ma.gnolia needed a solution to allow its members with OpenIDs to authorize Dashboard Widgets to access their service. Cook, Chris Messina and Larry Halff from Ma.gnolia met with David Recordon to discuss using OpenID with the Twitter and Ma.gnolia APIs to delegate authentication. They concluded that there were no open standards for API access delegation. [citation needed]

The OAuth discussion group was created in April 2007, for the small group of implementers to write the draft proposal for an open protocol. DeWitt Clinton from Google learned of the OAuth project, and expressed his interest in supporting the effort. In July 2007 the team drafted an initial specification. Eran Hammer-Lahav joined and coordinated the many OAuth contributions, creating a more formal specification. On October 3, 2007, the OAuth Core 1.0 final draft was released.

At the 73rd Internet Engineering Task Force meeting in Minneapolis in November 2008, an OAuth BoF was held to discuss bringing the protocol into the IETF for further standardization work. The event was well attended and there was wide support for formally chartering an OAuth working group within the IETF.

The OAuth 1.0 Protocol was published as RFC 5849, an informational Request for Comments, in April 2010.

Since August 31, 2010, all third party Twitter applications have been required to use OAuth.[1]

OAuth 2.0

OAuth 2.0 is the next evolution of the OAuth protocol and is not backward compatible with OAuth 1.0. OAuth 2.0 focuses on client developer simplicity while providing specific authorization flows for web applications, desktop applications, mobile phones, and living room devices. The specification is being developed[2] within the IETF OAuth WG and is expected to be finalized by the end of 2010 according to Eran Hammer-Lahav.[3]

Facebook's new Graph API only supports OAuth 2.0 and is the largest implementation of the emerging standard.[4] As of 2011, both Google[5] and Microsoft[6] had added OAuth 2.0 experimental support to their APIs.

Security

On April 23, 2009, a session fixation security flaw in the 1.0 protocol was announced. It affects the OAuth authorization flow (also known as "3-legged OAuth") in OAuth Core 1.0 Section 6.[7] Version 1.0a of the OAuth Core protocol was issued to address this issue.[8]

There is a debate over security concerns of OAuth 2.0.[9][10]

Uses

OAuth can be potentially used as an authorizing mechanism to consume secured (i.e., authenticated) RSS/ATOM feeds. Consumption of RSS/ATOM feeds that requires authentication has always been an issue. For example; an RSS feed from a secured Google Sites can not be consumed using Google Reader. 3-Legged OAuth can be used to authorize Google Reader to the RSS feed from that Google Site.

List of OAuth Service Providers

Service Provider OAuth Protocol
bitly 2.0
Facebook 2.0
Foursquare 2.0
GitHub 2.0
Google 2.0
Instagram 2.0
Microsoft (Hotmail, Messenger, Xbox) 2.0
OpenTable 1.0a
LinkedIn 1.0a
MySpace 1.0a
Netflix 1.0a
StatusNet 1.0a
Tumblr 1.0a
Twitter 1.0a
Vimeo 1.0a
VK 2.0
Veevop 2.0
Yahoo! 1.0a

OpenID vs. pseudo-authentication using OAuth

The following drawing highlights the differences between using OpenID vs. OAuth for authentication. Note that with OpenID, the process starts by the application asking the user for their identity (typically an openid URI), whereas in the case of OAuth, the application directly requests a limited access OAuth Token (valet key) to access the APIs (enter the house) on the user's behalf. If the user can grant that access, the application can retrieve the unique identifier for establishing the profile (identity) using the APIs.

OpenID vs. pseudo-authentication using OAuth

See also

References

  1. ^ Chris Crum (2010-08-31). "Twitter Apps Go OAuth Today". WebProNews.com. Retrieved 2011-03-14.
  2. ^ "The OAuth 2.0 Authorization Protocol". 2011-02-16.
  3. ^ Eran Hammer-Lavah (2010-05-15). "Introducing OAuth 2.0". Retrieved 2011-03-14.
  4. ^ "Authentication - Facebook Developers". developers.facebook.com.
  5. ^ "Making auth easier: OAuth 2.0 for Google APIs". googlecode.blogspot.com. 2011-03-14.
  6. ^ Dare Obasanjo (2011-05-04). "Announcing Support for OAuth 2.0". windowsteamblog.com.
  7. ^ "OAuth Security Advisory: 2009.1". 2009-04-23. Retrieved 2009-04-23.
  8. ^ OAuth Core 1.0a
  9. ^ "Is OAuth 2.0 Bad for the Web?". 2010-09-20. Retrieved 2010-09-21.
  10. ^ "an unwarranted bashing of Twitter's oAuth". 2011-08-03. Retrieved 2011-08-03.

External links

Retrieved from "https://en.wikipedia.org/w/index.php?title=OAuth&oldid=492822037"