The technology behind the Facebook third-party application (OAuth protocol)

In the early days, if we want to make some authorized actions for others account, we have to know others username and password. let's take Bob and Alice google calendar flow as an example.

If Bob wants to make an appointment for on Alice calendar, he should want to get Alice username and password. So Alice must provide his credentials to Bob. but if Bob will get the Alice credential, he can access Alice email and other stuff as well. this was being a major security issue for everyone at the earliest stage. so people were thinking about this problem and they came with a solution. it is called oAuth.

What is oAuth protocols?

• oAuth is a framework that allows for accessing third parties to the user resources with user permissions. but without sending user credentials( username and password) and also third parties can only access the user resources which are permitted by the resource owner.

Components of oAuth

• Third parties application
• Authorization server
• Resource servers

Flow of oAuth

oAuth endpoints and their functions 

Note: above image mentions only endpoints. it misses some oAuth flows so don't confuse with auth 1st image. 

• Authorization endpoint: it informs the owner request for authorization server.
• Redirection endpoint: where the resource owner is redirected to after having granted authorization.
• Token endpoint: where the client application exchange authorization code, clientId and client secret for an access token. 

Access Token validation
it has three main steps

1. token expired date 
2. is it already issued?
3. token accessible resources it called scopes.