What do you think about this video? Let me know in the comments below. FYI: I had to re-upload this video because the old one had an audio issue. Sry for that.
Excellent video! Not verbose and tedious like many others, and very informative. The only small nit I have: at 4:45 you say "we will learn about the response type in a minute" but then I don't think you ever talk about it. You do talk about Grant Types which are related (I think?) but not response type.
Nice video and I think of using Oauth for the project am working on now but I want to ask a question. Did I need to pay or add my credit card before I can use it?
Dumb question not directly related to OAuth... if you can extract anything out of a mobile application for example, how would such an application communicate with its backend securely? Surely you could also just extract those authentication secrets?
In a mobile app you would not ship any credentials in the app itself when you put it on the app store. That's why you need a backend that the app communicates with that holds the client secret for the OAuth flow. The moment the app is used, of course then you can store cookies, tokens etc on each user's device. But the whole point is that you must not have any secret in your app when you submit it to the app store. Or you do dynamic client registration. But then every mobile app installation is its own third party which would be strange
How does Google know that the client has a backend ? What if Google issued client secret when there is no backend ? I got confused I think client credentials part needs more elaboration
When you register the third party app, you can register a confidential or public client. If you have a backend, you can keep a secret safe, i.e. you have a confidential client
Oh there are very long-winded debates about this 😅 It seems a bit fuzzy. So a framework is more composable, i.e. the spec does not stipulate every single detail (e.g. in OAuth 2 the spec does not say how exactly the access token has to look, it leaves it somewhat open). A protocol is a more stricter rule set that leaves little to no things open (e.g. HTTP or TCP)
was thinking about that. I am a bit time-crunched atm and also the new animated videos did not get that many views. So not sure if I will continue this format or focus on different content
Thank you a lot ! I have to implement an authorization code grant for my personal project and the service doc was really confusing. Great explanation, you saved me 🤗
2:37 "if the 3rd party application can keep data secret" what is that supposed to mean?? if it its trustworthy? if it stores data at all?? All the effort to make a video and then you throw things like that in there ... I don't understand video makers anyway
What do you think about this video?
Let me know in the comments below.
FYI: I had to re-upload this video because the old one had an audio issue. Sry for that.
this is brilliant
VERY helpful. The clearest explanation I’ve been able to find on the topic. Thank you!
Great stuff , thanks alot, please keep updating with new changes in oAuth,
Great slow and clear explanation without cutting any corners, thank you
Glad you liked it
Excellent video! Not verbose and tedious like many others, and very informative. The only small nit I have: at 4:45 you say "we will learn about the response type in a minute" but then I don't think you ever talk about it. You do talk about Grant Types which are related (I think?) but not response type.
It is really really good explanation. Thank you....
Glad you liked it!
Lopez Timothy Rodriguez Ronald Lewis Shirley
Wilson Betty Williams Thomas Rodriguez Margaret
Jones Melissa Gonzalez Timothy Clark Christopher
Johnson Jessica Rodriguez Richard Rodriguez Daniel
Jones Matthew Clark Charles Lopez Timothy
Lopez Dorothy Anderson Barbara Hall Thomas
Really clear explanation. Thanks a bunch!
Williams Betty Martin Jason Thompson Ruth
Williams Barbara Jones Kimberly Perez David
Miller William Jones Richard Thompson Brian
Good video but really bad EQ, I had to really crank down 125HZ cut to keep the floor from shaking :/
Clark Ruth Harris Donald Miller Christopher
Harris Michael Moore Anna Young William
Jones Jennifer Robinson Timothy Wilson Robert
Garcia Dorothy White Paul Clark Karen
Miller George Walker Gary Johnson Daniel
Martin Sarah Smith Elizabeth Garcia Linda
Brown Donna Hall Kevin Brown Dorothy
Brown Karen Gonzalez Jason Anderson Laura
Allen Michelle Harris Anna Miller Brenda
You are creating amazing content! Please keep doing it!
thx
Welcome back! May I ask what tool you used to illustrate this video?
I used After Effects for this
Really well explained ⭐⭐
Glad it was helpful!
Nice video and I think of using Oauth for the project am working on now but I want to ask a question. Did I need to pay or add my credit card before I can use it?
OAuth is just a standardized framework and quite a few Identity Providers offer it as a service. Whether or not that is free depends on the provider
@@jgoebel Thanks so much I just want to use user email for sign in, him or her into my express server. I have a full stack app, mern
Great video! Short and simple explanation to share with colleagues and not look like an alien trying to explain it.
Yooo welcome back !!!
thx
One of the best explanations about OAuth, thanks a lot!
Dumb question not directly related to OAuth... if you can extract anything out of a mobile application for example, how would such an application communicate with its backend securely? Surely you could also just extract those authentication secrets?
In a mobile app you would not ship any credentials in the app itself when you put it on the app store. That's why you need a backend that the app communicates with that holds the client secret for the OAuth flow.
The moment the app is used, of course then you can store cookies, tokens etc on each user's device. But the whole point is that you must not have any secret in your app when you submit it to the app store.
Or you do dynamic client registration. But then every mobile app installation is its own third party which would be strange
How does Google know that the client has a backend ? What if Google issued client secret when there is no backend ? I got confused I think client credentials part needs more elaboration
When you register the third party app, you can register a confidential or public client. If you have a backend, you can keep a secret safe, i.e. you have a confidential client
9:10 the client may get refresh token but did you miss access taken part ? When is access token granted by the authorization server ?
forgot to mention it, but you always get a refresh token and you optionally get a refresh token
Excellent explanation.
Glad it was helpful!
Question: what is the difference between a framework and a protocol?
Oh there are very long-winded debates about this 😅 It seems a bit fuzzy. So a framework is more composable, i.e. the spec does not stipulate every single detail (e.g. in OAuth 2 the spec does not say how exactly the access token has to look, it leaves it somewhat open).
A protocol is a more stricter rule set that leaves little to no things open (e.g. HTTP or TCP)
Great video!
Glad you enjoyed it
amazing video.. are you planning to redo the other grant types similar to your old playlist or this is a one off update
was thinking about that. I am a bit time-crunched atm and also the new animated videos did not get that many views. So not sure if I will continue this format or focus on different content
Thank you a lot ! I have to implement an authorization code grant for my personal project and the service doc was really confusing. Great explanation, you saved me 🤗
Great to hear!
Great content, as always!
Could you please share the name of the software you used to create these animations?
After Effects
thanks!
Welcome!
Thank you very much. Your video is amazing
thx
welcomee
Great stuff ! Thank you very much !
Glad you liked it!
This makes me believe I am not dumb.
Most explanations on the Internet are just overly complicated and don't explain the why
perfecta explanation
Glad it was helpful!
Hall Richard Wilson Jose Harris Joseph
Robinson Barbara Jones Larry Williams James
Hall Anthony Thomas Karen Gonzalez Jessica
2:37 "if the 3rd party application can keep data secret" what is that supposed to mean?? if it its trustworthy? if it stores data at all?? All the effort to make a video and then you throw things like that in there ... I don't understand video makers anyway
This is explained in the section confidential vs public clients at 3:06