OAuth 2.0 flow in HLD - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the main purpose of OAuth 2.0?

OAuth 2.0 is a protocol that allows a user to grant limited access to their resources on one site to another site, without sharing their credentials.

beginner

Name the four main roles in the OAuth 2.0 flow.

The four main roles are: Resource Owner (user), Client (app requesting access), Authorization Server (issues tokens), and Resource Server (hosts protected resources).

beginner

What is an access token in OAuth 2.0?

An access token is a credential issued by the authorization server that the client uses to access protected resources on behalf of the user.

intermediate

Explain the Authorization Code Grant flow in OAuth 2.0.

The client redirects the user to the authorization server to get an authorization code. Then the client exchanges this code for an access token to access resources securely.

intermediate

Why is the Authorization Code Grant flow considered more secure than the Implicit Grant?

Because the access token is never exposed to the user agent or browser directly; it is exchanged securely on the backend, reducing risk of token leakage.

Which OAuth 2.0 role is responsible for issuing access tokens?

A Resource Server

B Client

C Resource Owner

D Authorization Server

The Authorization Server issues access tokens after authenticating the user and client.

In OAuth 2.0, what does the client receive after the user authorizes access in the Authorization Code Grant?

A Access token directly

B Authorization code

C Refresh token only

D User credentials

The client first receives an authorization code, which it exchanges for an access token.

Which OAuth 2.0 flow is best suited for single-page applications without a backend?

A Implicit Grant

B Client Credentials Grant

C Authorization Code Grant

D Resource Owner Password Credentials Grant

Implicit Grant is designed for apps that cannot securely store client secrets, like single-page apps.

What is the main security risk if the access token is exposed in the browser?

A Client secret exposure

B User password theft

C Token replay or misuse

D Authorization code leakage

If an access token is exposed, attackers can reuse it to access protected resources.

Which OAuth 2.0 role hosts the protected resources the client wants to access?

A Resource Server

B Resource Owner

C Client

D Authorization Server

The Resource Server holds the protected data and validates access tokens.

Describe the step-by-step flow of the OAuth 2.0 Authorization Code Grant.

Think about how the client gets permission and then accesses resources.

Explain why OAuth 2.0 improves security compared to sharing user credentials directly.

Focus on how OAuth limits what the client can do and protects user passwords.