OAuth Vs JWT | What is the difference? | Tech Primers

This video covers the difference between OAuth and JWT.

📌 Related Playlist
================

🎬Video Editing: iMovie

🎼Background Music: Broke For Free - Day Bird
The Passion HiFi - What We Came To Do
Joakim Karud
---------------------------------------------------------------
🔥 Disclaimer/Policy:
The content/views/opinions posted here are solely mine and the code samples created by me are open sourced.
You are free to use the code samples in Github after forking and you can modify it for your own use.
All the videos posted here are copyrighted. You cannot re-distribute videos on this channel in other channels or platforms.
#OAuth2 #JWT #TechPrimers

[JasonPoley]

A JWT itself is typically base64 encoded and hash signed... not encrypted. And typically the server giving the JWT isn't the same server consuming its entitlements during use.

[ppvshenoy]

Awesome explanation. Thanks for your time. Much appreciated.

[rafalo]

Hi Ajay, I think A and B steps should be between Client and Authorization Server in oauth2 section, please correct me if I am mistaken (authentication logic/gateway should be located at Authorization/OAuth2 server, in case of multiple instances of resource server it avoid "duplicate authentication" gateway functionality), thanks in advance

[argiebarcena]

Very informative and clear information, it helps me a lot. Thanks, bro

[rafalo]

Ajay, greetings from Poland, you are doing outstanding job, the first step on the path is the most difficult, we lift up each other, but you are leading on the path, keep going...

[csangora]

Hi Nice simple and effective explanation, Really liked it!

[AbhishekKumar-ubco]

Login part that you are explaining is I guess OIDC because OAuth alone is just meant for Authorization, it is basically OIDC that enforces login and hence the Authentication

[Cdswjp]

Hi, thanks for putting your time into this. I appreciate it. I was wondering, what is the difference between a framework and a protocol?

[skybirdge]

Please explain the code implementation tutorial of oauth with angular and node is and angular and springboot

[shishirkumar]

Resource server and Authorization server here both reside in Google or Face book. Application glass door is not same as resource server

[ziedmiladi]

spring sécurity with Oauth2 and angular 2 plz . thanks

[czsokola]

Does the resource server need to communicate with auth server? Isn't the JWT token verifiable by itself?

[vikramb]

OAuth is for Authorization and not Authentication. Don't make videos with incorrect information.

[rafalo]

another thing about oauth2: the goal is delegate access to SUBSET of resources - not all, because if token is compromise you lost only some subset of cloud services/data not all (happen when your account is compromised), imagine google account: you got gemail and google drive, calendar etc...

[rafalo]

OAuth2 section: perhaps there is some misunderstanding: CLIENT should be THIRD PARTY APPLICATION relaying on "resource server" services (oauth2 is designed for applications that are using distributed services in the cloud - not for "me and service" scenario) the goal is to NEVER gives user/password credentials to third party potentially untrusted applications (CLIENT) - think of Client as mobile application doing some extra function build on existing basic "Resource Server" functionality. What is your option about it?

[atech_guide]

That's what an immaculate comparison looks like !!
Well done dude !!

May I know your name please :)

[kitakita]

OAuth is for both authentication and authorization

[skybirdge]

What is the difference between oauth 1&2?

[ericjonas]

If I want to achieve Single Sign On, can I use JWT?

e.g.

I have 5 apps
- core app (java spring - all users registrations / accounts are here, mysql)
- app 1 (java spring boot, mysql)
- app 2 (laravel, postgres)
- app 3 (asp.net, sql server)
- app 4 (java legacy, oracle)

Note: I have full control to these source codes of each app.

browser login to the core app. Once accessed, the user can navigate to any of the apps without a need to login again. Can JWT use for this case? But I do wonder, do i need to store each user profile into each app's database?

I won't go with oAuth, as each time accessing the app requires to ask for permission. My users are older demographics can poised a challenge.

Any tips for me?

Thanks.

[whatsmyname]

You are explaining OAuth authentication and not authorization, primary use of OAuth is authorization, its better to explain that flow first as authentication is just outcome of authorization service by OAuth.