{"id":4,"date":"2026-08-24T13:20:36","date_gmt":"2026-08-24T13:20:36","guid":{"rendered":"http:\/\/createwithnaturalwisdom.com\/ajavadeveloperdetails\/?p=4"},"modified":"2026-09-06T20:19:59","modified_gmt":"2026-09-06T20:19:59","slug":"analytic-solutions","status":"publish","type":"post","link":"https:\/\/createwithnaturalwisdom.com\/ajavadeveloperdetails\/?p=4","title":{"rendered":"Application Security &#8211; OAuth 2.0"},"content":{"rendered":"<p class=\"p1\">Now a days web application is one of main component of digital network space. Due to its vast range and types of data it is important to secure web application in production environment. <strong>Auth2.0<\/strong> is a one of these application security protocol, which allows accessing the resources of the resource owner by enabling the client applications on <strong>HTTP<\/strong> services.<\/p>\n<p class=\"p1\">There are few main oAuth2.0 providers such as <strong>Google<\/strong>, <strong>Facebook<\/strong>, <strong>GitHub<\/strong>, etc. It allows sharing of resources stored on one site to another site without using their credentials. It uses username and password tokens instead direct credentials sharing over network.<\/p>\n<ul>\n<li class=\"p1\"><b>Resource Owner<\/b>: The user who owns the data.<\/li>\n<li class=\"p1\"><b>Client<\/b>: The third-party app requesting access.<\/li>\n<li class=\"p1\"><b>Resource Server<\/b>: The server hosting the protected user data<\/li>\n<li class=\"p1\"><b>Authorization Server<\/b>: The server that authenticates the user and issues tokens.<\/li>\n<\/ul>\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"683\" src=\"https:\/\/createwithnaturalwisdom.com\/ajavadeveloperdetails\/wp-content\/uploads\/2026\/08\/OAuth2.0-1024x683.png\" alt=\"\" class=\"wp-image-170\" srcset=\"https:\/\/createwithnaturalwisdom.com\/ajavadeveloperdetails\/wp-content\/uploads\/2026\/08\/OAuth2.0-1024x683.png 1024w, https:\/\/createwithnaturalwisdom.com\/ajavadeveloperdetails\/wp-content\/uploads\/2026\/08\/OAuth2.0-300x200.png 300w, https:\/\/createwithnaturalwisdom.com\/ajavadeveloperdetails\/wp-content\/uploads\/2026\/08\/OAuth2.0-768x512.png 768w, https:\/\/createwithnaturalwisdom.com\/ajavadeveloperdetails\/wp-content\/uploads\/2026\/08\/OAuth2.0.png 1536w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">OAuth 2.0 primarily defines two core token types, with a third commonly used via the OpenID Connect (OIDC) extension.<\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-block-group-is-layout-constrained\">\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-block-group-is-layout-constrained\">\n<p class=\"wp-block-paragraph\">1. Access Token<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Purpose: Grants the client temporary permission to access protected resources (APIs, files, data) on a resource server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Characteristics:<\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-block-group-is-layout-constrained\">\n<ul class=\"wp-block-list\">\n<li>Short-lived (typically minutes to a few hours) for security.<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Carries scopes (permissions) that define what the client can do.<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Presented by the client (usually in the Authorization: Bearer &lt;token> header).<\/li>\n<\/ul>\n<\/div><\/div>\n<\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Formats:<\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-block-group-is-layout-constrained\">\n<p class=\"wp-block-paragraph\">Opaque (reference) tokens: Random string; the resource server must call the authorization server (via Token Introspection \u2013 RFC 7662) or look it up to validate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Self-contained (JWT) tokens: Signed JSON Web Token that contains claims; the resource server can validate it locally without calling the authorization server (JWT Profile for OAuth 2.0 Access Tokens \u2013 RFC 9068).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Common subtypes \/ binding methods:<\/p>\n<\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Bearer tokens (RFC 6750) \u2013 most widely used; anyone who has the token can use it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Proof-of-Possession (PoP) \/ sender-constrained tokens \u2013 cryptographically bound to the client (e.g., DPoP \u2013 RFC 9449, or mTLS-bound tokens \u2013 RFC 8705) for higher security.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">2. Refresh Token<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Purpose: Allows the client to obtain a new access token (and optionally a new refresh token) when the current access token expires, without requiring the user to re-authenticate or re-consent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Characteristics:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Longer-lived than access tokens (hours, days, or longer, depending on policy).<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Highly sensitive \u2014 must be stored securely.<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Usually opaque.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Best practices include refresh token rotation (issue a new one each time it is used) and sender-constraining for public clients.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Issued optionally along with an access token (depending on the grant type and server configuration).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">3. ID Token (from OpenID Connect)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Purpose: Provides authentication information (who the user is) to the client application.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Characteristics:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Always a JWT.<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Contains claims about the user and the authentication event (e.g., sub, iss, aud, iat, exp, auth_time).<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Intended for the client application only \u2014 not sent to resource servers for API access.<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Used to verify identity, not for authorization.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Notes &#8211; The token_type returned by the authorization server is almost always &#8220;Bearer&#8221; in modern implementations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Authorization codes<\/strong> are temporary intermediate values (not long-lived tokens) used in the Authorization Code flow.<\/p>\n<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Web application using OAuth 2.0<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"pagelayer_contact_templates":[],"_pagelayer_content":"","footnotes":""},"categories":[1],"tags":[12,10,15,14,13,9,11],"class_list":["post-4","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-application-security","tag-oauth2-0","tag-open-id","tag-openid","tag-spring-security","tag-springboot","tag-web-application"],"_links":{"self":[{"href":"https:\/\/createwithnaturalwisdom.com\/ajavadeveloperdetails\/index.php?rest_route=\/wp\/v2\/posts\/4","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/createwithnaturalwisdom.com\/ajavadeveloperdetails\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/createwithnaturalwisdom.com\/ajavadeveloperdetails\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/createwithnaturalwisdom.com\/ajavadeveloperdetails\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/createwithnaturalwisdom.com\/ajavadeveloperdetails\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4"}],"version-history":[{"count":3,"href":"https:\/\/createwithnaturalwisdom.com\/ajavadeveloperdetails\/index.php?rest_route=\/wp\/v2\/posts\/4\/revisions"}],"predecessor-version":[{"id":181,"href":"https:\/\/createwithnaturalwisdom.com\/ajavadeveloperdetails\/index.php?rest_route=\/wp\/v2\/posts\/4\/revisions\/181"}],"wp:attachment":[{"href":"https:\/\/createwithnaturalwisdom.com\/ajavadeveloperdetails\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/createwithnaturalwisdom.com\/ajavadeveloperdetails\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/createwithnaturalwisdom.com\/ajavadeveloperdetails\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}