Why is there 3-legged OAuth2 when 2-legged works so well?
authentication, oauth, oauth-2.0
Solution
Three legged does not imply a certain type of app as in "browser based". Three legged means that an application acts on the direct behalf of a user. In the three legged scenarios there is
- an application (consumer),
- a user (resource owner) and
- an API (service provider).
In two legged scenarios there is no concept of a user. Typically this has to do with application-to-application solutions. There the application (consumer) acts on behalf of itself. So in two legged OAuth, there is:
- an application (consumer),
- an API (service provider)
The difference is simply that there is no need of a user authorisation step in the 2-legged approach.
Problem
2-legged OAuth2 is used for Browser based app, where no client credential can be hidden from public. 3-legged OAuth2 is used by "Web Server Apps" where there's a third call between servers. All well described here. The question: Why bother with 3-legs, when 2-legs seems to be fine? It's more work both for the provider and the client. Why didn't one of the big player make a move and removed 3-leg?