Node.js Course
Node.js
/
Advanced

OAuth

Definition

Open Authorization. An open standard for access delegation, commonly used as a way for internet users to grant websites or applications access to their information on other websites but without giving them the passwords.

Explain Like I'm New

Logging in with the 'Sign in with Google' button. You don't give your app your Google password. Instead, you are redirected to Google. Google asks: 'Do you want to let this app see your email?'. You click Yes. Google redirects you back to the app with a secure temporary token. The app uses that token to prove to Google that you approved the access.

Real World Example

Using `Passport.js` in Node with the `passport-google-oauth20` strategy to allow users to bypass creating a new account and just sign in with their existing Google or GitHub accounts.

Common Use Cases

  • •Social logins (Google, GitHub, Facebook)
  • •Granting 3rd party apps access to APIs (like a budgeting app connecting to your bank)

Terminal Output

bash / terminal
// --- THE OAUTH 2.0 FLOW --- console.log("1. User clicks 'Login with GitHub' on your app."); console.log("2. Your server redirects the user to: github.com/login/oauth/authorize?client_id=YOUR_APP_ID"); console.log("\n3. User logs into GitHub directly (Your app doesn't see this)."); console.log("4. User clicks 'Authorize App'."); console.log("\n5. GitHub redirects the user back to your server: yoursite.com/callback?code=SECRET_CODE"); console.log("6. Your server secretly sends that SECRET_CODE back to GitHub behind the scenes."); console.log("7. GitHub verifies the code and replies with an Access Token."); console.log("\n8. Your server uses the Access Token to fetch the user's email from GitHub's API."); console.log("9. You save the user in your database and log them in!");

Interview Questions

basic

  • Does OAuth share the user's password with the third-party app?

intermediate

  • What is an OAuth Access Token?

Flash Cards

Question

Does it share the password?

Click to reveal answer
Answer

Never. That is the entire purpose of the OAuth protocol.

Question

What is the Access Token?

Click to reveal answer
Answer

A string granted by the Authorization Server (Google) to the Client (Your App). Your app attaches this token to API requests (like fetching the user's Google Calendar events) to prove it has permission.