Geek Answers Handbook

What follows OpenID vs Oauth (v1 & v2)?

I noticed that all major websites use Openid instead of Oauth .

I have an Oauth implementation for Google and Facebook .

My requirement:

  • User Authentication with Google / Facebook
  • Manage simple user profiles for users on my website pre-populated by Google / Facebook.

What should I do for Oauth or Openid ?

When to follow Oauth ?

+4
source share
1 answer

They are used for different purposes.

OpenID is used to authenticate SomeUser on your site, requesting a different site to confirm the user's identity.

OAuth is used to give SomeOtherParty (for example, another site or application) permission to do something on behalf of SomeUser on your site (this means that SomeUser is already somehow authenticated on your site).

A few more comments for the author’s request:

You cannot select "OAuth for user authentication" because OAuth is not a user authentication protocol (despite the "auth" in its name).

With OpenID, you can authenticate a user with virtually any OpenID provider without any changes to your code.

If you decide to authenticate users using Facebook OAuth, you are not actually validating users. You ask users to get some access to your user profile on facebook from your application. You get access to Facebook services to get user information. This means that if you want to use another OAuth provider service to authenticate users, you can never do this without creating a new authentication code (unless new providers support APIs identical to facebook).

+7
source

More articles:


All Articles