A guide to Oauth 2.0 Grant types - Explained

Users have a secure way to access internet services without having to worry about their login credentials thanks to the OAuth authentication framework. The most recent version of an open standard, OAuth 2.0, was developed to enable generic apps to access internet services using your identity without needing to know your username and password for those services.

• We have a variety of ways to receive the Access Token from the Authorization Server using Client Applications thanks to Oauth 2.0 Grant Types.
• In OAuth 2.0, each grant type is tailored to a specific use case, whether for a web application, a native or React application, or a device that cannot run a web browser or server-to-server apps.

What are the Grant Types in Oauth 2.0

1. Implicit Grant Type

• In Oauth 2.0, this is the most basic grant type.
• Access tokens that are not kept on secure servers can be obtained via the authentication server using the implicit grant type.
• In this grant type, the access token is sent directly from the authorization server to the Client application. Although it does not need a web server, it is less secure because the access token must be kept on the user or client’s device.

2. Authorization Server Code  

• The authorization code grant type initially looks quite complicated, but it’s simpler than you think once you’re familiar with a few basics.
• Web and mobile applications both use the Authorization Code grant type. It is different from the other grant types.
• In this flow User or Resource, the owner gets the authorization code first from the authorization server and the user sends that authorization code to the authorization server in exchange for the access token.
• The Authorization Code flow is mostly used by Single Page Applications (SPA) and mobile/native applications.
• In this flow, the token is stored on the server side so it is more secure than the implicit grant type. 

3. PKCE Grant Type with Authorization Code Flow

• This grant type is similar to the authorization code but it has additional steps that make it more secure for mobile and native applications or single-page applications.
• It helps protect you against various code injection attacks.
• This grant type has mainly two parameters

1. code verifier: It is nothing but a random string between 43-128 characters. it is stored in our local system.
2. code challenge: It takes the code verifier as input and does hashing with different hashing techniques and generates the base 64 URL encode.

4. Device Flow

• It is a grant type that is primarily used to receive an access token on devices with restricted browser input capabilities, such as mobile phones. applications for TV. 

Originally published by: https://www.inexture.com/oauth-2-grant-types/