Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
2-legged OAuth2 is used for Browser based app, where no client credential can be hidden from public. 3-legged OAuth2 is used by “Web Server Apps” where there’s a third call between servers. All well described here.
The question: Why bother with 3-legs, when 2-legs seems to be fine?
It’s more work both for the provider and the client. Why didn’t one of the big player make a move and removed 3-leg?
Three legged does not imply a certain type of app as in “browser based”. Three legged means that an application acts on the direct behalf of a user. In the three legged scenarios there is
In two legged scenarios there is no concept of a user. Typically this has to do with application-to-application solutions. There the application (consumer) acts on behalf of itself. So in two legged OAuth, there is:
The difference is simply that there is no need of a user authorisation step in the 2-legged approach.