Introducing the OAuth 2.0 model
OAuth 2.0 basically allows a third party website to access a limited or selective set of user information on a particular website. There are different kinds of authorization flows used in OAuth 2.0. The main reason that OAuth exists is the fact that in the classic authentication model, the user's account credentials are generally shared with the third party website, which results in several problems; these are documented well in the OAuth 2.0 RFC 6749.
The third party can save the credentials in plain-text
The third party gets a large amount of access to users' data, typically full account access
There is no proper method to revoke access given to a third party without revoking all other third parties because the credentials are common to all third parties
If any third party is compromised, it will result in compromise of the credentials of the end user. Now, let's get started with OAuth 2.0.
OAuth 2.0 roles
There are primarily four kinds of roles present in OAuth...
