Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something.

I understand that the client authorises with the OAuth provider (google for example) and allows the resource server to have access to the user's profile data. Then the client can send the access token to the resource server and be given back the resource.

But what does not seem to be covered in any of the documentation is what happens when the client app asks the resource server for a resource and passes it the access token. Everything I have read so far states that the resource server just responds with the requested resource.

But that seems like a huge hole, surely the resource server must somehow validate the access token, otherwise I could just fake up any old request and pass an old, stoken, fake, or randomly generated token and it would just accept it.

Can anyone point me at a simple to follow explanation of OAuth2 because so far the ones I have read feel imcomplete.

Thanks

share|improve this question

1 Answer 1

Found it. Buried in the spec. They say the resource server should validate the access token with the auth server but that it's outside the scope of the document. Pity, I would have thought that token validation was an important part.

share|improve this answer
1  
About important parts, it might be worth reading this blog post for some background on the priorities for OAuth2. –  Lars Viklund Aug 2 '12 at 7:18
1  
Thanks for that, an interesting read. My requirements are rather simple in that I want to allow an iOS app to authenticate with google, twitter, facebook, etc, pass some form of authorisation to my server and have my server validate it and enable access to resources. The problem has proved more complex than I anticipated due to the complexities of understanding how this works and what I have to do where. –  drekka Aug 3 '12 at 1:10
    
@drekka +1 I am also struggling with oauth 2.0, if you have found any solution/implementation please point me towards those. –  Gaurav Agarwal Jul 8 '13 at 17:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.