Day 18

Why is sharing your password directly with an app considered dangerous?

A password is an all-or-nothing master key, once shared, you can't limit what the other party can do with it, and you can't easily take that access back if the app is compromised.

How does the valet key analogy explain what OAuth does?

A valet key can start the engine and drive the car a short distance but can't open the trunk or glovebox; similarly, OAuth issues a limited-access token to an app instead of your real password, letting it do one specific job without full control.

What does OAuth stand for, and what is its one job?

OAuth stands for Open Authorization; its one job is authorization, deciding what an app is allowed to do, not logging someone in or proving who they are.

Who are the four players in every OAuth relationship?

The Resource Owner (the person who owns the data, i.e., you), the Client (the app requesting access), the Authorization Server (which verifies identity and issues the token), and the Resource Server (which stores the data and honors the token).

What is a scope in OAuth, and why does it matter?

A scope is a specific, named permission an app requests, like "view your photos"; scopes are what make the token "limited" instead of a master key, since they're effectively cut into the key itself, so even a hacked app can only access what it was scoped for.

What is OpenID Connect (OIDC), and how does it relate to OAuth?

OIDC is an identity layer built directly on top of OAuth that adds a new type of token, the ID Token, allowing an app to also confirm exactly who is logging in, not just what it's allowed to access.

What is the core distinction between OAuth's job and OIDC's job?

OAuth's job is authorization ("what is this app allowed to do?"), while OIDC's job is authentication ("who exactly is this person?"); most modern sign-in experiences use both together.

What is an ID Token, and how is it different from an OAuth access token?

An ID Token is a digitally signed token that proves identity, containing basic facts about who you are and which identity system vouched for you; an access token, by contrast, grants access to resources, they travel together but do very different jobs.

What is a claim in the context of an ID Token?

A claim is one piece of information written inside the ID Token, similar to a printed field on a driver's license, such as your name, email address, or a unique account identifier.

How does the movie ticket analogy explain token-based authentication?

You show your ID once at the box office to prove who you are, then simply hand over your ticket at the theater door afterward without proving your identity again; similarly, you prove who you are once and receive a token to present instead of retyping your credentials.

What is the difference between an Access Token and a Refresh Token?

An Access Token is the everyday "working ticket" presented for each approved action, with a short lifespan for safety; a Refresh Token is longer-lived and used only to quietly obtain a new Access Token once the old one expires, without forcing a fresh login.

Why do Access Tokens typically expire quickly while Refresh Tokens don't?

Short-lived Access Tokens limit the damage if one is ever stolen or intercepted, while the longer-lived Refresh Token lets the app quietly renew access behind the scenes so users aren't forced to log in repeatedly.

What is a JSON Web Token (JWT), and what does the "sealed envelope with a wax stamp" analogy describe?

A JWT is a popular, standardized, digitally signed format for writing tokens; the analogy describes it as a see-through envelope (the readable payload) with a wax seal (the signature) that proves nothing has been altered, even though the contents themselves are visible, not secret.

What are the three parts of a JWT, and what does each contain?

Header (describes the token's type and how it was signed), Payload (holds the actual claims, like user ID or expiration time), and Signature (a cryptographic seal proving nothing has been changed).

Why should sensitive secrets never be placed inside a JWT's payload?

A JWT is tamper-proof, not secret; because the payload is just readable text underneath the signature, anyone who obtains the token can read its contents, even though they can't alter it without breaking the signature.

What are the main advantages of tokens over passwords?

Tokens offer limited scope, built-in expiration, easy revocation without changing a master password everywhere, reduced exposure of the real password, and tamper-evidence through digital signatures.

What is an "authorization flow," and why do different apps need different flows?

An authorization flow is the exact step-by-step path an app follows to request and receive a token; different flows exist because different apps can be trusted with sensitive information to different degrees, such as a secure server versus a mobile app or smart TV.

How does the Authorization Code Flow work, using the coat-check claim stub analogy?

Instead of handing over a token immediately, the Authorization Server first returns a short-lived authorization code (the claim stub); the app then privately exchanges that code for the real token behind the scenes, keeping the token out of places like the browser address bar.

What is the difference between Client Credentials Flow and Device Authorization Flow?

Client Credentials Flow is used when two backend systems talk directly with no human involved, with the app proving its own identity; Device Authorization Flow is used by devices with no keyboard, like a smart TV, where the device displays a short code that the user approves on a separate device with a keyboard.