- Home>
- security
In this post, I’ll give a high-level overview of the Client Credentials Grant by example.
The Client Credentials Grant is for obtaining an access token based solely on a client’s credentials, without any user’s involvement. Simply put, the Client Credentials Grant is for machine to machine communication.
In this post, I’ll discuss the Resource Owner Password Credentials (ROPC) grant and when you should use it.
In a ROPC flow, the user gives the credentials directly to the client application, usually by mean of a login form over which the client application has complete control. In this flow, the client application does not redirect the user to an authorization server for authentication. However, the client application submits a request to the authorization server, passing over the user’s credentials to obtain an access token on behalf of the user. If the client is a confidential client or has been provided a secret key, the client also needs to authenticate against the authorization server using its client id and secret when requesting a token.
This is part of a series post about OAuth2. In this post, I go over the implicit grant type and how it relates and differs to the authorization code grant type.
Let’s look at a high-level only flow of the implicit grant flow via an example in which an application recommends a user movies based on the movies the user’s friends like on Facebook.
For comparison, here’s the flow using the authorization code grant.
As you can see at the surface level, the implicit flow is more or less similar to the authorization code flow except it does not have the step of authenticating the client. As we discuss when to choose the implicit grant type vs the authorization grant type , we’ll explore other differences between the two flows and see they are meant for different types of applications.
OAuth2 has become the de facto in modern web application security. If you are a front end, back end or mobile developer, chances are you have had to consume or secure protected resources with OAuth2. As such, having a good understanding of OAuth2 is invaluable. When implementing or using OAuth2 in your application, you typically face with four different grant types. Knowing the differences between the four grant types and which one to use can be quiet confusing. In this blog post series, I go over the different grant types by providing examples. This post is part of the series about OAuth2. In this post, I’ll cover the Authorization Code Grant and when it is appropriate to use it.
If you are not familiar with the jargons, this post may help.