What is OAuth 2.0 and how is it used to secure REST APIs?

Expected Interview Answer

Step-by-Step Explanation

1. Step 1

   Client registration

   The application registers with the authorization server and receives a client id and, for confidential clients, a secret.

2. Step 2

   User consent

   The user is redirected to the authorization server, authenticates, and approves the specific scopes the app requests.

3. Step 3

   Authorization code

   The authorization server redirects back with a short-lived code; PKCE protects public clients from code interception.

4. Step 4

   Token exchange

   The client exchanges the code (plus its PKCE verifier or client secret) for an access token and optional refresh token.

5. Step 5

   Call the API

   The client sends 'Authorization: Bearer <access_token>' to the resource server on each protected request.

6. Step 6

   Validate and enforce scopes

   The resource server verifies the token and checks its scopes before serving the requested resource.

Code Example

// Middleware on the REST API (resource server)
function requireScope(scope) {
  return async (req, res, next) => {
    const token = (req.headers.authorization || '').replace('Bearer ', '')
    try {
      // Verify signature, issuer, audience and expiry
      const claims = await verifyAccessToken(token, {
        issuer: 'https://auth.example.com/',
        audience: 'https://api.example.com'
      })
      const scopes = (claims.scope || '').split(' ')
      if (!scopes.includes(scope)) {
        return res.status(403).json({ error: 'insufficient_scope' })
      }
      req.user = claims
      next()
    } catch (err) {
      res.status(401).json({ error: 'invalid_token' })
    }
  }
}

app.get('/api/orders', requireScope('orders:read'), listOrders)

Follow-up Questions

• What problem does PKCE solve and which clients need it?
• How does OpenID Connect extend OAuth 2.0?
• When would you use the Client Credentials grant?
• What is the difference between an access token and a refresh token?
• How does the resource server validate a token issued by a separate authorization server?