Understanding the OAuth authentication process

OAuth allows users to grant applications access to their data without needing to provide their credentials to that application. During development, the developer registers their application with an OAuth authentication service and receives an ID that is used to identify the application to the service, as well as a secret that is used to sign and verify messages between the application and the service.

The registration process establishes the relationship between the application and the authentication service. Registration is done once and is performed before the application is deployed. Some degree of vetting may be required. The SportsStore application uses the Google OAuth service, which makes its basic features – such as the ones used in this chapter – available immediately, but reviews applications before more sensitive data can be accessed, and this can take days or weeks to complete.

Once the application is...