2

Call me a newbie, call me dumb, rate down this topic. Do as you like, I'm just here to ask a question and hopefully learn something from it.

So I've been making an API for my website today (well attempting to) and I've noticed this "thing" on most popular sites API's such as Twitter, Foursquare, Tumblr called "OAuth". From my research today I have gathered that it's basically a way of giving the consumer a token to access restricted data from the provider depending on what the user chose without the user handing over their password and username.

But why do I have to use OAuth, why can't I just give out an API to the consumer key and they just use that? I will then see if the user has allowed access for the application, and they will have to grant access for the app to take information from their account, such as photos.

Something that also confused me is why the Tumblr API uses both. It seams on reading blog details they use a simple api key but posting on blogs you need an OAuth Signature.

Frank
  • 1,844
  • 8
  • 29
  • 44

1 Answers1

2

OAuth is a protocol and has a set of specification defined by some expert group to define how to share data. Basically what you are seeing is just a part of the OAuth mechanism,and there is a lot of communication and hand shaking mechanism to ensure the security of user data as well avoiding unauthorized access to data.

OAuth mechanism exits at 2 levels

  1. three-legged authentication
  2. Two-legged authentication

Both have their positives and negatives and there are a set of procedure which needs to be taken care for security and data integrity.

Allowing access only based on access_token/consumer key is really a very weak security mechanism and can easily be hacked by any one who happens to get access to your consumer key while OAuth system make sure by sharing a time bound access_token.

For details refer to this thread oauth-2-0-benefits-and-use-cases-why

Assil
  • 572
  • 6
  • 21
Umesh Awasthi
  • 23,407
  • 37
  • 132
  • 204