CODEWITHSUNDEEP
authenticationoauthoauth-2.0
Ph0en1x
Ph0en1x

Reputation: 10067

oAuth2 server. Should I have single or different endpoints for different grant type

According the article oauth2 Simplified it could be 4 grant type for the oAuth server.

  1. Authorization Code for apps running on a web server
  2. Implicit for browser-based or mobile apps
  3. Password for logging in with a username and password
  4. Client credentials for application access

So the question is - should I have single endpoint for all of them and then choose which is used according the query string provided, or it will be better to implement single endpoint per each grant type?

Upvotes: 0

Views: 276

Answers (1)

flup
flup

Reputation: 27104

From the OAuth2 specs:

Protocol Endpoints

The authorization process utilizes two authorization server endpoints (HTTP resources):

o Authorization endpoint - used by the client to obtain authorization from the resource owner via user-agent redirection.

o Token endpoint - used by the client to exchange an authorization grant for an access token, typically with client authentication.

As well as one client endpoint:

o Redirection endpoint - used by the authorization server to return responses containing authorization credentials to the client via the resource owner user-agent.

Not every authorization grant type utilizes both endpoints.
Extension grant types MAY define additional endpoints as needed.

So the answer is: reuse the end points for multiple flows, but distinguish between the Authorization endpoint and the Token endpoint.

Upvotes: 1

Related Questions