Web Security & OWASP (50 Qs)•Part 3: Authentication, Authorization & Cryptographic Standards (26 - 35)
OAuth 2.0 & OpenID Connect (OIDC): Roles, Authorization Code Flow, and Client Credentials.
Delegation vs. Authentication
- OAuth 2.0 is an authorization framework that delegates access to resources without sharing credentials (issues an
access_token). - OpenID Connect (OIDC) is an identity layer built directly on top of OAuth 2.0 that provides user authentication (issues an
id_tokencontaining user identity claims).
sql
+------------------+ +---------------------+ +----------------------+
| Resource Owner | | Client Application | | Authorization Server |
| (The End User) | | (Single Page App) | | (Auth0, Okta, IdP) |
+------------------+ +---------------------+ +----------------------+
| | |
| 1. Clicks "Sign in with..." | |
|----------------------------->| |
| | 2. Redirect to Login UI |
| |------------------------------>|
| 3. Enters Credentials & MFA | |
|<-------------------------------------------------------------|
| | 4. Redirect with Auth Code |
| |<------------------------------|
| | |
| | 5. Exchange Code for Tokens |
| |------------------------------>|
| | 6. Returns Access + ID Token |
| |<------------------------------|
Core Flows Comparison
| Flow Type | Use Case | Client Secret Required? |
|---|---|---|
| Authorization Code with PKCE | Single Page Apps (React/Angular), Mobile Apps. | No. Replaces secret with dynamic cryptographic code_verifier. |
| Client Credentials | Machine-to-Machine (M2M) background cron jobs, microservices. | Yes. Server-to-server; no human user involved. |
| Device Authorization | Smart TVs, CLI tools without a web browser. | Polls token endpoint while user approves on their phone. |