OAuth Vs JWT | What is the difference? | Tech Primers

[@JasonPoley71]

A JWT itself is typically base64 encoded and hash signed... not encrypted. And typically the server giving the JWT isn't the same server consuming its entitlements during use.

[@TechPrimers]

+Jason Poley thanks Jason

[@rafalo2323]

Ajay, greetings from Poland, you are doing outstanding job, the first step on the path is the most difficult, we lift up each other, but you are leading on the path, keep going...

[@TechPrimers]

+Rafal Otwinowski thank you rafal. cheers

[@AbhishekKumar-ub8co]

Login part that you are explaining is I guess OIDC because OAuth alone is just meant for Authorization, it is basically OIDC that enforces login and hence the Authentication

[@shishirkumar8335]

Resource server and Authorization server here both reside in Google or Face book. Application glass door is not same as resource server

[@shankarwannalwad4882]

glassdoor also can be resource server. By using Key cloak or amazon cognito you can create your own Auth server and Resource sever. Resouce server will decide what api i should expose to client on the basis of role configured in Auth server. If your application is fetching data of glassdoor and showing some reports. Then glassdoor can be resource server for your application. You can configure same in Auth server created by you.

[@rafalo2323]

Hi Ajay, I think A and B steps should be between Client and Authorization Server in oauth2 section, please correct me if I am mistaken (authentication logic/gateway should be located at Authorization/OAuth2 server, in case of multiple instances of resource server it avoid "duplicate authentication" gateway functionality), thanks in advance

[@argiebarcena9284]

Very informative and clear information, it helps me a lot. Thanks, bro

[@vikramb5864]

OAuth is for Authorization and not Authentication. Don't make videos with incorrect information.

[@david-tracy]

Hi, thanks for putting your time into this. I appreciate it. I was wondering, what is the difference between a framework and a protocol?

[@TechPrimers]

protocol is a standard. framework is a opinionated way of doing something/an implementation

[@Anonymous-pe5pp]

Very nice Explanation. thanks

[@raghavenderkuppireddy7158]

Very good explation ❤

[@ppvshenoy]

Awesome explanation. Thanks for your time. Much appreciated.

[@rafalo2323]

another thing about oauth2: the goal is delegate access to SUBSET of resources - not all, because if token is compromise you lost only some subset of cloud services/data not all (happen when your account is compromised), imagine google account: you got gemail and google drive, calendar etc...

[@TechPrimers]

HI Rafal, completely agree with your explanation.Thanks for the detailed explanation.

[@lincethomas2365]

Well done mate!

[@TechPrimers]

+Lince Thomas thanks lince

[@csangora]

Hi Nice simple and effective explanation, Really liked it!

[@rafalo2323]

OAuth2 section: perhaps there is some misunderstanding: CLIENT should be THIRD PARTY APPLICATION relaying on "resource server" services (oauth2 is designed for applications that are using distributed services in the cloud - not for "me and service" scenario) the goal is to NEVER gives user/password credentials to third party potentially untrusted applications (CLIENT) - think of Client as mobile application doing some extra function build on existing basic "Resource Server" functionality. What is your option about it?

[@phyoewaipaing6670]

Yes, same idea. Otherwise, there will be a confusion of 'Client' being a user or a user's browser.

[@iamdeveloper552]

You are so good my brother .

[@gautamtyagi8846]

really helpful video. thanks a lot

[@atech_guide]

That's what an immaculate comparison looks like !! Well done dude !! May I know your name please :)

[@TechPrimers]

+Kamran Ali my pleasure Kamran. I'm Ajay

[@czsokola]

Does the resource server need to communicate with auth server? Isn't the JWT token verifiable by itself?

[@ziedmiladi4320]

spring sécurity with Oauth2 and angular 2 plz . thanks

[@semikolon4229]

Thanks, helped a lot.

[@skybirdge]

Super. Thanks for the this video

[@skybirdge]

Please explain the code implementation tutorial of oauth with angular and node is and angular and springboot

[@vandolphreyes7207]

Wow, clearly explained. Thanks +1

[@kitakita5409]

OAuth is for both authentication and authorization

[@whatsmyname9742]

You are explaining OAuth authentication and not authorization, primary use of OAuth is authorization, its better to explain that flow first as authentication is just outcome of authorization service by OAuth.

[@kitakita5409]

JWT is for authorization

[@sbnighut]

A minor suggestion: Background noise is distracting.

[@skybirdge]

What is the difference between oauth 1&2?

[@david-tracy]

1 is a protocol, 2 is a framework. 2 is less secure.

[@arvindynr]

jwt token expires with server restart whereas OAuth doesn't.

[@sasuki479]

I think Rahu and Mangal are not in their lagna. Donate 10kg grass to Cow for 1 month and your issue should be resolved.

[@andrews13]

OAuth2 vs JWT

[@ericjonas6044]

If I want to achieve Single Sign On, can I use JWT? e.g. I have 5 apps - core app (java spring - all users registrations / accounts are here, mysql) - app 1 (java spring boot, mysql) - app 2 (laravel, postgres) - app 3 (asp.net, sql server) - app 4 (java legacy, oracle) Note: I have full control to these source codes of each app. browser login to the core app. Once accessed, the user can navigate to any of the apps without a need to login again. Can JWT use for this case? But I do wonder, do i need to store each user profile into each app's database? I won't go with oAuth, as each time accessing the app requires to ask for permission. My users are older demographics can poised a challenge. Any tips for me? Thanks.

[@TechPrimers]

+Eric Jonas Hi Eric, Your usecase is an awesome example of how enterprise firms handle authentication in their built in systems which are handled by multiple teams. If you go for JWT+https, you should be ok. However to solve the user namr password validation everytime, what you can do is create a token from ur auth server and use it. But its upto you to choose which ever best suits for ur usecase. I will tell the advantage of token based system in enterprise: Every app should connect to Auth server to create a token. All other server side apps can validate the token with AuthServer for every request provided by the client. The only downside of passing username n password everytime is the safety. Even if 1 request is hacked, your username is fully exposed. Drop me a mail @ [e-mail], i will add u to thr slack community. You will get suggestions from most of viewers of this channel

[@ericjonas6044]

Thanks for replying back. Yeah, also email you too. As for this "The only downside of passing username n password everytime is the safety. Even if 1 request is hacked, your username is fully exposed." How can someone hack a JWT token? Is that possible? And what do you recommend? I hope can custom build via Spring 4 instead of using some open source or paid 3rd party solution. Example, Keycloak... as most of my end users are still using IE8, based on the project contributor may not be able to support due to the JS library. Unfortunately they will still use IE8 for next few years. Any tips? Thanks.

[@ericjonas6044]

Noted

[@erencansinecan775]

I'm not gonna give a thumbs down but this was shallow and occasionally incorrect. Signing is not encrypting for instance. You're not fully familiar with these things yourself, and you don't have flash cards or smth to help you out. If I were you, I'd do an implementation of both of them (from scratch, not via a library) and do a second take of this video with that new understanding. And I'm gonna give a thumbs down too.

[@david-tracy]

I appreciate the video. I do however think the video should probably be removed after reading the rest of the comments here because unfortunately it does appear the knowledge gaps here are too much and in fact it appears that there's actually too much incorrect data being told here also. I still will give a thumbs up though and will subscribe to see if you put a new one out. Signatures - ensures the data wasn't modified during transfer. Encryption - prevents unauthorized parties from reading the data. Here's a .pdf I got my hands on a couple of days ago if anyone reading this comment is very interested in learning about JWT. I haven't gotten my hands on one for OAuth yet so can't help there :) assets.ctfassets.net/2ntc334xpx65/o5J4X472PQUI4ai6cAcqg/c0f09bd6d2ec494462ea684ab065781d/jwt-handbook-v0_14_1.pdf Good luck to everyone

[@gileneusz]

gada jak kaczka

[@Kingside88]

indian english is hard to understand. Sorry :-(

[@sasuki479]

I think Rahu and Mangal are not in their lagna. Donate 10kg grass to Cow for 1 month and your issue should be resolved.

[@ranjan098]

Atleast we speak english.. think this was in chinese:)

[@110177019]

It's absolutely impossible listening to such heavy accent. Almost non-understandable.