What is OAuth and why does it matter? - OAuth in Five Minutes

In this video we cover what OAuth is and why we even have it in the first place. OAuth in Five Minutes is a series where we deep-dive on various topics around OAuth in just five minutes!
Buy the book! amzn.to/2S6Uj4e
Check out our video course! The Nuts and Bolts of OAuth 2.0
oauth2simplifi...
Learn more about OAuth at oauth.net
--
Okta is a developer API service that stores user accounts for your web apps, mobile apps, and APIs.
Sign up for Okta for free at developer.okta...
For more info visit us at developer.okta...
Developer Blog: developer.okta...
Sign up for our monthly newsletter! a0.to/zeroindex
Follow us on Twitter: / oktadev
Follow us on FB: / oktadevelopers
Follow us on LinkedIn: / oktadev

[@jojojawjaw]

I don't think I've ever seen a tutorial this informative, clear, and helpful before!

[@WittCode]

I got more out of this 5 minute video than reading a ton of articles! Thanks so much!

[@charlesbevitt6727]

I’ve been wondering why the heck anyone would want to use OAuth in a strictly first party situation. You really explained it well and I’m finally convinced. Big thanks for a great video.

[@charlesopuoro5295]

Absolutely!!! Same. He sure did. It reduced the Attack Surface Area as explained.

[@ip2design]

A very clear and helpful introduction. Thanks for shooting this video

[@fijaisonjd]

Good explanation. Background music is a bit distracting.

[@Julian-tf8nj]

yeah, I kept saying "what the heck is that noise??"

[@shashvatshukla]

You made the world a better place by making this video.

[@안안재형-h8v]

This is the best introduction video for OAuth concepts. Thank you for the material.

[@joshbrolicwright]

Thank you for keeping it simple and to the point!

[@manjotsinghjuneja217]

the best 5 minutes of my entire day, thank you!

[@sachinmankotia2291]

Simple and clear explanation. I have used oauth before in my projects, but to be honest, I learnt its exact flow today :)

[@ryanjohnson4566]

Thanks, great to get a good human explanation. These things are not that complicated, but all the new terms that are introduced muddy the waters for me. Your explanation is excellent.

[@candiceerasmus5943]

I am extremely green in this space - this was such an amazing introduction to OAuth for me. Thank you thank you thank you

[@francisrafal]

Thank you, that explanation was exactly what I was looking for!

[@ericdavid890]

Just getting acquainted with oauth and this is a great intro!

[@AsifChauhan]

Very interesting point about companies' internal 1st part apps using OAuth as Authentication vs just for Authorization👌

[@charlesopuoro5295]

Thanks a whole lot for this video. It served its intended purpose.

[@alexshmalex]

Epic. Super helpful, thanks for posting.

[@pavanamancherla5039]

Nicely explained. Appreciate your efforts

[@user-or7ji5hv8y]

Concise and well explained.

[@alexandermoeller5299]

great explanation! Thanks for the video

[@befit_kw7762]

Graphical representation would be extremely beneficial. Great work👍 We need tutorials on Google fit api as well as other APIs.. Thanks

[@bdemers]

How about this one! developer.okta.com/blog/2019/10/21/illustrated-guide-to-oauth-and-oidc

[@NYYstateofmind]

Why is sms mfa insecure? Also, when you rely on Google for Oauth are you sharing application specific data? Or does Google only know that you use that service and when you log in

[@-Ncrypt]

SMS MFA is prone to SIM swap attacks. An attacker can also break into the cellular network and intercept SMS messages to your phone. However, it's still better to have SMS MFA on than no MFA at all.

[@gauravvarma3645]

Super insightful, thanks

[@danielelmuneco1994]

Wow! Very clear. Thank you :)

[@cloudguy4192]

Thank you for posting the video!

[@jims2507]

Thank you! I never understood giving up my twitter password to another website for authentication, but I see that option ALL the time.

[@KDOERAK]

a great talk: thx and keep them coming!

[@venky76v]

Awesome video tutorial guys ✌️✌️

[@dsulvadarius]

Wow! Beautifully explained.

[@harikrishnareddym]

Wow..Brilliant... too good... and all other good superlatives here.... :) ... thank you

[@AlphyGacheru]

Very useful, thank you!

[@barzanahmed7194]

OAuth IS AWESOME!!!

[@JACKSONANTO]

Really good one

[@johnhack67]

thanks

[@RajanieshKaushikk]

very nice video!!

[@mnite3842]

One word - Awesome!!!!

[@shilpashravge8083]

Thanks !!

[@OktaDev]

Welcome!

[@randommode3016]

4:47 reasons why you should use OAuth for everything

[@zaimcodes]

Basically, OAuth is a protocol that redirects user from the 3rd party application and authenticate themselves through the OAuth server (I got confused here so Google, Twitter, and other trusted applications have their own OAuth server?) while having the ability to understand what data the 3rd party application able and unable to access, right? 3:30 basically SSO isn't it? So, OAuth protocol allows 3rd party application (external) to access data/API of the trusted application securely while SSO allows the user to access various services of the same application (internal) without needing to login over and over again, isn't it?

[@WhiteSiroi]

thank you

[@abhinavraut3099]

very clear thanks!

[@chologhuribangladesh7792]

very helpful, described video. Like oAuth101.

[@gamerrana786]

how can we make our own? If we have our own brand

[@Cowglow]

!!! awesome video!

[@greendsnow]

what if they're working for an Intelligence Office?

[@JJovich]

Thanks great video

[@ChrisAthanas]

Rather than hand waving, and use of “the app”, why not give us some images so it’s very clear and not confusing

[@randommode3016]

4:18 people makes mistakes so true 🙈

[@sufyanshoaib]

awesome.. thanks... just need to slowdown a bit ...

[@aaronpk]

If I do that, then people are just gonna complain that I talk too slow!

[@sufyanshoaib]

@@aaronpk I am happy in both cases ... :) :+1:

[@mikexue5104]

me too. but it only means i need improve my listening skills.

[@williamroncallo7926]

I have seen his videos before, and have always been confused on something… I understand why he says third-party applications, when saying Oauth was created for accessing them from the client applications, so that the client application doesn’t have to ask the user for the password, but why does he call client applications first party? What is a second party application then?

[@taraleseena5321]

Yelp is third party.. for the app resource (Yelp content), they are also first party. Unfortunately, they want your Google password, for which they are a third party between you and Google)

[@muchirajunior]

why should we not use messages multi factor auth

[@OktaDev]

Hello, thanks for your question. Could you expand a bit more on what you mean by messages for MFA, please? Thanks!

[@muchirajunior]

@@OktaDev on the video you said its a bad idea to use messages for MFA

[@jarekwisniewski5468]

Simple and Easy.... Realy??? :)

[@ThePrachi19]

Nice explanation… but Next time please remove the BGM when you are explaining, I could hardly concentrate😢

[@byzantinethrive]

What happened to Justin

[@croooaaalagraula]

Good explanation, only guy speaks too fast for majority of audience, and would have been great to have some graphics illustrating his explanations.

[@rafadydkiemmacha7543]

He really wanted to make it 5 minutes 😅

[@vuufke4327]

when is the last time you blinked?

[@ilgioa]

The background music is quite distracting.

[@randommode3016]

4:19 lol when you discover that your application has logging password in a text file for months (? 🤣 I hope that never happens🙏 let's use OAuth

[@erensolmaz2435]

so github email

[@toohype8762]

Oh yeas, lets put one monolith point of failure in our application and let google run it. I'm sure they're doing this out of the goodness of their heart. Also if you want any support better hope the community addresses it cuz google corporate wilil not give AF. Better hope the project manager doesn't get promoted then google depreciates the service cuz no one wants to maintain code they want to create fancy products looking for a problem.

[@aaronpk]

To be clear, Google in this example is providing a service to Google itself.

[@darkpill]

You repeat yourself a lot. Video could have been 2:30

[@taraleseena5321]

Would help if you speak 50 words per minute instead of 200

[@Samikhadris]

Samikhadris

[@AntonioEugenioVida]

tante ciacoe

[@pradeepkumarreddykondreddy7048]

too fast

[@lllllllllIIIIIIIIIIl]

Dumb music. So annoying.