29

I'm learning OAuth and I have a question in head I can't find an anwser..

I understood request token to authorize or not an application to use the API. But once the user got an access token, what happens if someone steal his access token?

Imagine that we have something like http://www.example.com/api/article/1?access_token=******access_token******

If I give this url to another user, the other would have my access and so the API isn't protected anymore?

Damien_The_Unbeliever
  • 234,701
  • 27
  • 340
  • 448
Julien
  • 401
  • 1
  • 5
  • 12
  • You should clarify whether you're referring to OAuth 1 or OAuth 2. Version 1 of the protocol uses a shared secret, the token secret, which is never transferred over the wire. Hence stealing an access token is like stealing a key without a key bit. It won't fit any lock. – mxk Jul 09 '11 at 09:22
  • I was reading about oAuth 2 and just wondered the same thing. Wish there were an answer here..sigh..the search continues. – Aishwar Dec 10 '11 at 21:28

1 Answers1

14

Short answer: Yes, for OAuth2 - whoever has a valid access_token would have access to resources designated by that token. For how long depends on OAuth2 the implementation of provider.

Long answer, about both OAuth1 and 2:

When it comes to OAuth 1 an access token is not enough. You would also need the access token secret and also consumer key and secret. It is still good to keep the access tokens confidential, and to limit their scope and time of validity but you cannot use the access token without client and token secrets. OAuth 1 doesn't require that you use SSL, because cryptography is built right into the specification.

OAuth 2 is different - it is arguably more important that access tokens are kept confidential. Therefore the API provider should ensure that access tokens, which in OAuth2 are also known as Bearer tokens, are valid only for as short time as possible. These tokens work like passwords, and if intercepted can be used immediately by an attacker. Therefore the OAuth2 (with bearer token) specification requires that all communication takes place over SSL - since no cryptography is built into the specification. Typically access tokens have a short validity, which can be refreshed with a "refresh token" which has longer validity but is only transfered when the initial bearer token is received by the consumer, and when a bearer token is refreshed.

Jon Nylander
  • 8,743
  • 5
  • 34
  • 45
  • 2
    OAuth 2.0 itself doesn't actually define any access token types. This is done by other specifications dealing with token authentication. Currently there are two proposals, one for bearer tokens which must be used over TLS and work like passwords, and the other for MAC tokens which are very much like OAuth 1.0 HMAC-SHA1. – Eran Hammer Jul 11 '11 at 05:36
  • Thanks, I included those statements in the answer above. – Jon Nylander Mar 16 '17 at 09:04