Section 4 Module 3 Part 3: OAuth 2.0 & the Password Grant Flow

preview_player
Показать описание

Рекомендации по теме
Комментарии
Автор

Nice summary. Impressed by the way you write backwards!

bp
Автор

Finally understood the way it works. Thank you.

AlexA-cdlz
Автор

How does validation of access token happen in a password grant type?Is it not required?

Glblub
Автор

I'm still very new to OAuth2. Forgive me if I'm asking a dumb question. So if Client_Secret is stored on server end, and the Client_secret passed via the header as a empty string, then that means once the server receives the id/"secret"/user/pass/grant, then the backend code of the server grabs the secret from the database and inserts it to replace the empty string, and returns a access token (assuming the info received from client is correct). Is my understanding correct?

ewliang
Автор

Hi,
Quite informative and a query from my end. In the above example when you say client(ClientID basically) authenticate itself using Authorisation: Basic xxyz64encodedstring in the body of the request, if there is clientID say "nameofclientID" whose endcoded 64 format is Im5hbWVvZmNsaWVudElEIg==, instead of username/pass suppose if its public grant_type, does the request will look like

In Hearder:
POST /grant HTTP/1.1
Host:xyz.com
Authorization: Basic Im5hbWVvZmNsaWVudElEIg==
Content-Type:

Body:


Looking for reply, and really helpful if answered.

rajeshav