What is OAuth 2.0?
OAuth 2.0 is an authorization framework. It lets a client obtain limited access to an HTTP resource on behalf of a resource owner or on its own behalf. The authorization server issues an access token for a resource, scope, and lifetime. OAuth does not define user authentication, and an access token is not an identity assertion.
Why it matters
OAuth lets a user or workload grant a client narrow access without giving the client the resource owner's primary credential. The client, authorization server, and resource server remain separate trust boundaries.
How it works
- The client asks the authorization server for access to a named resource and scope.
- For an interactive authorization-code flow, the client creates a Proof Key for Code Exchange (PKCE) verifier and sends its derived challenge with the authorization request.
- The authorization server authenticates the user, obtains authorization, and returns a short-lived code. The client sends the verifier when it exchanges the code for an access token.
- The client sends the access token to the intended resource server over TLS.
- The resource server validates the token, audience or resource, scope, expiry, and other required properties before it authorizes the requested operation.
Example
A deployment tool requests read access to one protected API. The user approves the requested scope. The authorization server issues a short-lived access token for that API, and the API rejects the token for any other audience.
Pomerium boundary
Pomerium uses OAuth 2.0 and OpenID Connect with configured identity providers. It can accept configured identity-provider tokens on protected routes and then apply route policy. An OAuth access token does not grant every upstream action.
Failure and residual risk
- OAuth is an authorization framework. OAuth alone does not authenticate a user.
- A bearer token can be replayed by a party that obtains it until it expires or is revoked.
- The implicit grant and resource-owner password grant are not suitable for new deployments under current OAuth security guidance.
- OAuth 2.1 is still an IETF draft. Do not describe it as a published RFC.
Evaluation checklist
- Name the client, authorization server, resource server, resource owner, intended resource, and required scope.
- Use the authorization code flow with PKCE for interactive public clients.
- Validate redirect URIs, issuer metadata, token audience or resource, scope, expiry, and authorization response state.
- Keep tokens out of URLs and logs, and define storage, rotation, refresh, and revocation behavior.
