1 / 7
OAuth 2.0 is not authentication
OAuth 2.0 answers can this app access my Google Drive? — not who is this user? Using OAuth alone for login is like using a hotel key card as proof of your identity.
- GAPAccess token proves permission, not identity
- GAPNo standard way to get the user's name or email
- GAPNothing prevents token substitution attacks
- RESULTEvery app invented its own
/meendpoint — incompatible, insecure
★
OAuth 2.0 grants access to resources; it says nothing about who the user is.
← → navigate · S recap