Understanding the OAuth 2.0 Directly from the IETF RFC 6749

Currently Playing: 1. Introduction Section - OAuth 2.0 Directly from the IETF RFC 6749 Specification

In this video, I cover the introduction section of the IETF RFC 6749 Specification, "The OAuth 2.0 Authorization Framework". https://tools.ietf.org/html/rfc6749#section-1 In the video, I discuss how passwords were once used to give 3rd party access to your 1st party application. I talk about how it is not a good idea to give your password to 3rd party application and the reasons why, as indicated by the IETF RFC 6749 Specification. o Third-party applications are required to store the resource owner's credentials for future use, typically a password in clear-text. o Servers are required to support password authentication, despite the security weaknesses inherent in passwords. o Third-party applications gain overly broad access to the resource owner's protected resources, leaving resource owners without any ability to restrict duration or access to a limited subset of resources. o Resource owners cannot revoke access to an individual third party without revoking access to all third parties, and must do so by changing the third party's password. Here is the link to the "OAuth 2.0 and OpenID Connect (in plain English)" video I discussed: https://www.youtube.com/watch?v=996OiexHze0 This video is part of a series: https://www.youtube.com/playlist?list=PLjuQOVlnQv2UUmUuq_ZuwFyVEXanuGh9v