October 2012

OAuth 2.0 standardized

RFC 6749 defined the OAuthAn authorization framework — lets apps access user data without sharing passwords. 2.0 authorization framework in October 2012 — letting apps request limited access to user accounts without sharing passwords.

What it was for

OAuthOAuthAn authorization framework — lets apps access user data without sharing passwords. 2.0 is how you 'Sign in with Google/GitHubA platform for Git hosting, pull requests, and CI — the center of open-source collaboration.' and how APIs delegate access with bearer tokens. Authorization servers issue tokens after user consent; resource servers validate them. Every SaaSSoftware as a Service — applications delivered over the internet on a subscription basis. integration, mobile login, and third-party APIApplication programming interface — a defined way for programs to talk to each other or to a service. permission screen builds on these flows — authorization code, client credentials, and more.

Companies

  • IETF

Why it's here

OAuthAn authorization framework — lets apps access user data without sharing passwords. 2.0 replaced ad-hoc APIApplication programming interface — a defined way for programs to talk to each other or to a service. keys and password sharing with a standard consent model.

Why it mattered

It became the foundation for modern identity federation, APIApplication programming interface — a defined way for programs to talk to each other or to a service. security, and OpenID ConnectAn identity layer on OAuth 2.0 — standardized login with ID tokens and user profiles..

What it solved

Apps needed user data from other services without storing credentials or getting full account access.

Media

  • OAuth
    ImageOAuth

    Chris Messina, CC BY-SA 3.0, via Wikimedia Commons

Related