https://lesitedefrancois.be/en/tags/authorisation/Recent content in Authorisation on Le Site de FrançoisHugo -- gohugo.ioen© 2026 Françoishttps://lesitedefrancois.be/en/security/oauth2/Mon, 01 Jan 0001 00:00:00 +0000https://lesitedefrancois.be/en/security/oauth2/<p><strong>OAuth 2.0</strong> (RFC 6749, 2012) is an authorisation delegation framework — not an authentication protocol — that solves a specific problem: how does a user grant a third-party application access to their resources on a server, without giving that application their password? The canonical example is a user granting a calendar app access to their Google Drive files: OAuth 2.0 lets Google issue the calendar app a scoped, time-limited <strong>access token</strong> that permits it to read Drive files, without the app ever seeing the user&rsquo;s Google password. The distinction between authorisation and authentication is fundamental: OAuth 2.0 proves that a token was issued by an authorisation server for a specific scope — it says nothing about who the user is. Attempting to use OAuth 2.0 for authentication (treating token possession as proof of identity) is a well-documented anti-pattern with concrete exploits; <strong>OIDC</strong> (OpenID Connect) is the authentication layer built on top of OAuth 2.0 that addresses this correctly.</p>