OAuth Cheat Sheet
|
This section documents OAuth 2.0 (RFC 6749) as amended by the OAuth 2.0 Security Best Current Practice (RFC 9700 / BCP 240), the OAuth 1.0 Protocol (RFC 5849) for historical context, and OpenID Connect Core 1.0, as published at the IETF Datatracker and the OpenID Foundation specifications — and, on the Spring pages, Spring Boot 4.1.x and Spring Security 7.1.x as published at the Spring Security reference documentation — which are the references these pages are written and verified against. OAuth 2.1 is still an Internet-Draft ( This content was generated with the assistance of AI and should be verified against those official specifications before being relied on in production. This section’s bibliography lists the reference material consulted while preparing these pages. |
A single-page, colour-coded summary of the OAuth essentials — the four roles and the protocol endpoints, the
authorization-request and token-request parameter tables, every grant type with its OAuth 2.1 status, the PKCE
two-liner, the token-response and error-code tables, the ID vs. access vs. refresh token comparison, JWT
anatomy and the resource-server validation checklist, introspection and revocation one-liners, the
client-authentication methods, an RFC index, the Security BCP checklist, the DPoP proof skeleton, the discovery
document’s key fields, acr/amr/auth_time and the step-up challenge, the passwordless primary methods and
the 2FA layers kept separate, and the protocol-concept to Spring-type mini-table — handy for quick memorization
or as a printable desk reference.
For the full explanation, every parameter, and additional examples, see the dedicated pages:
Foundations — Getting started, How OAuth evolved, OAuth 1.0a, and OAuth 1.0 vs. OAuth 2.0.
Tokens — Access & refresh tokens, ID vs. access tokens, JWT & the JOSE family, Opaque tokens, introspection & revocation, and Scopes, claims & permissions.
Flows — Choosing a flow, Authorization code & PKCE, Client credentials & client authentication, Device authorization grant, Token exchange & assertion grants, and Legacy grants: implicit & password.
App types — Native & mobile apps and Browser-based apps.
Security — Security best practices, Sender-constrained tokens: DPoP & mTLS, and PAR, JAR & hardened profiles.
OpenID Connect & identity — OpenID Connect, Discovery, metadata & client registration, Logout & session management, Social login & federation, and Authentication methods: passwordless & 2FA.
Operating — Testing & debugging OAuth.
Spring Boot integration — Integration overview, Flow recipes, and Authentication methods.