Using OAuth to secure service endpoints

OAuth is yet another token-based authentication strategy. Its wide acceptability, good coverage of the depth and breadth of web security concerns, and the flexibility of managing user sessions at both the client and server side make it an enterprise-grade authentication mechanism. OAuth dictates to use the token to establish the identity instead of passing usernames and passwords. A token can be obtained from an external identity provider and this token can then be passed to any subsequent requests to resume a session:

Figure 4.15 – Separating the concerns with OAuth

As shown in the preceding figure, in the OAuth token-based authentication strategy, the client obtains a token from the identity provider and uses this token in any API requests to the server. The server validates this token with the identity provider to return a proper response.

To learn how to secure a microservice using an OAuth and cloud-based...