Editing Understanding OAuth 2.0: Token-Based Authorization (section)

== OAuth 2.0 Authorization Flows ==

OAuth 2.0 provides different grant types (flows) tailored to various use cases:

=== Authorization Code Flow ===

This is the most secure flow and is used for server-to-server communication. It involves an intermediate authorization code that the client exchanges for an access token.

'''Steps''':
# The user logs into an authorization server and grants permissions to the client.
# The authorization server redirects back with an authorization code.
# The client exchanges the authorization code for an access token using a secure request.
# The client uses the access token to make API requests on behalf of the user.
'''Enhancements''': This flow can be secured further using PKCE (Proof Key for Code Exchange) to prevent code interception attacks.

=== Implicit Flow (Deprecated) ===

Previously used for single-page applications (SPAs), this flow provided tokens directly but is now considered insecure due to the exposure of tokens in URLs. The Authorization Code Flow with PKCE is now recommended for SPAs instead.

=== Client Credentials Flow ===

Used for machine-to-machine (M2M) authentication where no user interaction is involved. The client authenticates itself directly with the authorization server and receives an access token.

'''Use Case''': This flow is common in microservices architectures where services communicate securely without user intervention.

=== Resource Owner Password Credentials (ROPC) Flow ===

Allows users to provide their credentials directly to the client application. It is less secure and should only be used in trusted applications where the client is highly trusted by the user.

'''Limitations''': This flow is discouraged as it requires users to share their passwords with applications, increasing security risks.

=== Device Authorization Flow ===

Used for devices with limited input capability, such as smart TVs, game consoles, and IoT devices.

'''Steps''':
# The device requests access and receives a user verification code.
# The user enters the verification code on a separate device (e.g., phone or computer) to authenticate.
# The authorization server issues an access token.