JIYIK CN >

In this article, we will continue with the article on how OAuth2.0 issues access tokens and introduce several related knowledge points involving client credentials:

• Obtain end-user authorization
• Authorization Response
• Error Responses and Error Codes

Let’s take a look at each of them.

Obtain end-user authorization

The authorization endpoint is the URL that makes authentication requests on the authorization server. In fact, it is a corresponding authorization login interface where the resource owner logs in and allows access to the client application's data.

The authorization endpoint can be defined in three ways −

• Authorization endpoint
• Redirect endpoint
• Token endpoint

Authorization endpoint

The authorization endpoint can be used to interact with the resource owner. First, the user accesses the resource owner's resources by using a client application. Before performing an authorized login, you need to register a redirect URI (actually what we call a callback address) in the authentication service. During the registration of the redirect URI (Uniform Resource Identifier), the authentication service will provide the client application with a client ID and a client secret, which are used to uniquely identify a client application. Next, the user can log in through the client application on the authorization server. It contains the authorization endpoint. After a successful login, the authorization endpoint redirects the user to the URI (Uniform Resource Identifier) ​​and provides the user with an authentication code.

Redirect endpoint

The user visits the page located at the redirection URI (Uniform Resource Identifier) ​​in the client application. The client application then sends the client ID, client secret, and the authentication code obtained in the previous step to the authorization server.

Token endpoint

At this point, the client application sends the authentication service the client ID, client secret, and authorization code to obtain an access token.

The client application sends these credentials together with the token to the user. After the user receives the token, he can send it to the resource service he wants to access, such as Google, WeChat, etc., to access the resources in the system related to the logged-in user.

Authorization Response

The authorization response can be used to obtain an access token that uses the authorization code to access the owner's resources in the system. The access token is provided by the authorization server to the client upon receiving the client ID, client secret, and authorization code sent by the client application.

The authorization code will be issued by the authorization server, allowing access to the request with the following parameters

• Code - This is a required parameter that specifies that the authorization server generates an authorization code. The authorization code is valid for up to 10 minutes and cannot be used multiple times. If the client application uses the authorization code multiple times, the authorization server rejects the request and cancels all tokens previously issued based on the authorization code.
• State - If the authorization code is available in the authorization request, state is a required parameter.

The authorization server provides an authorization code and grants access to the client application using the following format

application/x-www-form-urlencoded

It is the default MIME type for outgoing requests. It must be encoded in such a way that control names and values ​​are escaped, space characters are replaced with '+' signs, key-value pairs are separated by '&' etc.

Error Responses and Codes

The authorization server responds with an HTTP 400 or 401 status code. Here, if an error occurs during authorization, there are two possible errors that can occur. In the first case, the client was not identified or it was identified but something else was wrong. In the second case, although the client was accurately identified, something else failed. In this case, an error response is sent back to the client as shown below

• error_description - is an optional human-readable description of the error in the language specified by the Content-Language header, intended for developers rather than end users.
• error_uri − It is an optional link to a readable web page along with the error information that can help in resolving the issue.
• error − It is a set of predefined error codes.

400 Error

The following table shows the 400 errors and their descriptions.

401 Error

The following table shows the 401 errors and their descriptions

The above error responses and codes are defined in the documentation. There may be discrepancies in the actual implementation, but there should be corresponding documentation.