Overview & Scope
OAuth 2.0 (RFC 6749) delegates user authentication and authorization without exposing user passwords to third-party clients. Coupled with PKCE (Proof Key for Code Exchange) and OpenID Connect, it forms the backbone of modern web single-sign-on (SSO).
Specification Table & Matrix
Instant client-side filter by keyword, status code, or directive name
| Key / Code | Definition & Details | GEO Semantic Hierarchy | Spec & Notes |
|---|---|---|---|
| Resource Owner | Resource Owner An entity capable of granting access to a protected resource (typically the human end-user). The human user logging into their account. | ●Resource Owner ↳OAuth role ↳identity principal ↳end-user authorization authority | RFC 6749 §1.1 Owns the data stored on the Resource Server. |
| Resource Server | Resource Server The server hosting protected resources, capable of accepting and responding to protected resource requests using access tokens. https://api.example.com/v1/photos | ●Resource Server ↳OAuth role ↳API backend ↳protected endpoint host | RFC 6749 §1.1 Validates access tokens before returning user data. |
| Authorization Server | Authorization Server The server issuing access tokens to the client after successfully authenticating the resource owner and obtaining authorization. https://accounts.google.com or Auth0 | ●Authorization Server ↳OAuth role ↳identity provider ↳token issuing authority | RFC 6749 §1.1 Presents the login consent screen to the user. |
| Authorization Code with PKCE | Authorization Code with PKCE The gold-standard OAuth grant type for SPAs, mobile apps, and servers, preventing code interception attacks. code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256 | ●PKCE ↳OAuth grant ↳authorization code flow ↳cryptographic proof-of-possession code exchange | RFC 7636 Mandatory for public clients (React, iOS, Android) that cannot securely hold client secrets. |
| Client Credentials | Client Credentials Grant Grant type used for machine-to-machine (M2M) communication where the client is the resource owner. grant_type=client_credentials&client_id=...&client_secret=... | ●Client Credentials ↳OAuth grant ↳M2M authorization ↳backend service-to-service auth | RFC 6749 §4.4 No human user is involved; used by background microservices, daemons, and cron jobs. |
| Refresh Token | Refresh Token A credential used to obtain a new access token when the current access token expires without user interaction. grant_type=refresh_token&refresh_token=rT_8941a... | ●Refresh Token ↳OAuth credential ↳token rotation ↳long-lived renewal credential | RFC 6749 §1.5 Long-lived; should be stored in secure HttpOnly cookies and rotated on every use. |
PKCE Code Verifier & Challenge Generation (JavaScript)
// 1. Generate random code_verifier string (43-128 chars)
const array = new Uint8Array(32);
crypto.getRandomValues(array);
const codeVerifier = btoa(String.fromCharCode(...array))
.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
// 2. Compute SHA-256 digest of code_verifier
const encoder = new TextEncoder();
const data = encoder.encode(codeVerifier);
const digest = await crypto.subtle.digest('SHA-256', data);
// 3. Base64URL encode digest to create code_challenge
const codeChallenge = btoa(String.fromCharCode(...new Uint8Array(digest)))
.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');PKCE binds the authorization request to the token request, preventing malicious apps from intercepting authorization codes.
Reference Standards Q&A
What is the difference between OAuth 2.0 and OpenID Connect (OIDC)?↓
References & Primary Sources
Every source below directly substantiates technical statements and protocol behaviors explained in OAuth 2.0 & OIDC Concepts Reference. Curious-Techie prioritizes official Internet standards (IETF RFCs, W3C Recommendations, WHATWG specifications) and established security bodies (OWASP, NIST). Zero sponsored or secondary links.
- [1]IETFPrimary SpecificationRFC 6749 • Section 1 & 4Verified Primary SourceTechnical Claim Supported:
Specifies delegated authorization protocol flows, client registration, token issuance endpoints, and scoped resource access tokens.
Source URI: https://datatracker.ietf.org/doc/html/rfc6749 - [2]IETFPrimary SpecificationRFC 7636 • Section 4 & 5Verified Primary SourceTechnical Claim Supported:
Mandatory standard preventing authorization code injection and interception attacks in public clients (SPAs and mobile apps) using SHA-256 code verifiers.
Source URI: https://datatracker.ietf.org/doc/html/rfc7636 - [3]IETFAuthoritative Security StandardRFC 6819 • Section 3Verified Primary SourceTechnical Claim Supported:
Analyzes attack surfaces including redirect URI manipulation, token leakage, and CSRF attacks on authorization flows.
Source URI: https://datatracker.ietf.org/doc/html/rfc6819
Related Technical Ecosystem & Next Steps
Related Developer Tools
Related Technical Guides
Ultimate Guide to JWT Authentication & Security
Master token issuance, asymmetric signing keys (RS256 vs HS256), refresh token rotation, and secure cookie storage.
Ultimate Guide to Web Authentication & OAuth
Architecting modern authentication systems: sessions, JWTs, OAuth 2.0, and OpenID Connect.
Related Technical Articles
What Is a JSON Web Token (JWT)?
Direct definition and architectural breakdown of stateless token exchange.
JWT vs Session-Based Authentication: Architecture & Performance
Compare database session lookups with stateless JWT verification across scalability and revocation.
Troubleshooting: JWT Works in Postman but Fails in Browser
Diagnose and remediate CORS header stripping, HttpOnly cookie constraints, and preflight authorization failures.
Related Questions
Can a JWT Be Decrypted by Anyone?
Answer: Yes, standard JSON Web Tokens (JWS) are signed, not encrypted. Anyone can decode and inspect the payload without the secret key.
Why Shouldn't You Store JWTs in LocalStorage?
Answer: Storing tokens in localStorage exposes them to instant exfiltration by any Cross-Site Scripting (XSS) vulnerability.
Can an Expired JWT Token Still Be Verified?
Answer: Yes, the cryptographic signature remains mathematically valid, but compliant libraries reject the token because exp is checked after signature verification.
Hands-On Diagnostic Labs
Continue Learning
JWT Interactive Tampering & Validation Lab
Put your theoretical understanding into practice by tampering with claims and testing signature rejection in the live sandbox.