OAuth 2.0 overview in Rest API - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary purpose of OAuth 2.0?

OAuth 2.0 is widely used in web applications. What is its main goal?

A To provide a database for storing user credentials securely

B To encrypt all data sent between client and server

C To allow users to share their private resources stored on one site with another site without sharing credentials

D To replace passwords with biometric authentication

💡 Hint

Think about how apps let you log in using accounts from other services without giving your password.

OAuth 2.0 allows users to grant limited access to their resources on one site to another site without sharing their passwords. It acts as a secure authorization framework.

❓ Predict Output

intermediate

What is the output of this OAuth 2.0 token request response?

Given this JSON response from an OAuth 2.0 token endpoint, what is the value of the expires_in field?

Rest API

{
  "access_token": "abc123xyz",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "def456uvw"
}

A 3600

B "Bearer"

C "abc123xyz"

D "def456uvw"

💡 Hint

Look for the field that tells how long the access token is valid in seconds.

The expires_in field indicates the lifetime of the access token in seconds. Here, it is 3600 seconds (1 hour).

🔧 Debug

advanced

Why does this OAuth 2.0 authorization code flow fail?

Consider this simplified OAuth 2.0 authorization code flow snippet. Why does it fail to obtain an access token?

POST /token HTTP/1.1
Host: auth.example.com
Content-Type: application/x-www-form-urlencoded

client_id=abc&redirect_uri=https://app.example.com/callback&code=xyz123

A The <code>code</code> parameter is invalid because it is not URL encoded

B The <code>redirect_uri</code> should not be included in the token request

C Incorrect HTTP method; should be GET instead of POST

D Missing <code>client_secret</code> parameter in the token request

💡 Hint

Think about what the authorization server needs to verify the client identity during token exchange.

In the authorization code flow, the client must send its client_secret along with the client_id to authenticate itself when exchanging the code for an access token. Omitting it causes failure.

📝 Syntax

advanced

Which option correctly represents a valid OAuth 2.0 Bearer token HTTP header?

Choose the correct syntax for sending an OAuth 2.0 Bearer token in an HTTP request header.

A Authorization: Bearer abc123xyz

B Auth: Bearer abc123xyz

C Authorization: Token abc123xyz

D Bearer: Authorization abc123xyz

💡 Hint

The standard header name and scheme must be used exactly.

The correct header is Authorization with the scheme Bearer followed by the token. Other forms are invalid or non-standard.

🚀 Application

expert

How many scopes are granted in this OAuth 2.0 access token response?

Given this OAuth 2.0 token response, how many scopes does the access token have?

{
  "access_token": "token123",
  "token_type": "Bearer",
  "expires_in": 1800,
  "scope": "read write delete"
}

A 1

B 3

C 0

D 4

💡 Hint

Count the number of space-separated words in the scope string.

The scope field lists permissions separated by spaces. Here, there are three: read, write, and delete.