Nobody Cares About OAuth or OpenID Connect

Nobody Cares About OAuth or OpenID Connect

It doesn’t change any of the OAuth behaviors, all it does is add some extra stuff to solve both authentication and authorization challenges that most web developers face. After all, there were two main problems on the web, authorization and authentication, and they were both solved by OAuth and OIDC. The OAuth and OIDC specs (and extensions) cover authentication and authorization for:

These use case scenarios are translated into a concept called grant types in the OAuth specification, and each one works differently and has different security profiles that the implementor needs to be aware of. The only thing developers are actually interested in is what OAuth and OIDC help with, authentication and authorization. With the state of tooling right now, web developers are essentially forced to learn about OAuth and OIDC and are burdened with the need to understand how these standards work and how to (hopefully) apply them properly to their application.

Source: developer.okta.com