Home/ Questions/Q 9163119
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-17T14:22:08+00:00

I need to know how to handle protected resources with OAuth 1.0a. I have

  • 0

I need to know how to handle protected resources with OAuth 1.0a.
I have read the official documentation and seen some implementations but there some points I need to clarify.

1) At this point the Consumer has an approved Access Token linked to a user and the Provider server validates it.

  • What would happen if the Access Token is invalid?
  • What kind of status code would the Provider server issue?
  • If this happens should the Consumer server redirect the user to screen where he can authorize another Token?

2) If the validation of the Access Token is correct, the Consumer and the Provider will exchange information. For example the Consumer will ask the email address of the user and the Provider will provide it.

  • What protocol should be used to exchange this information? (Json?)
  • Should this information go in the body of the response or in another place?

3) Following the standard should the Access Tokens and the protected information provided be persisted by Consumer server.

Thanks

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You probably should have linked the official documentation. But in any case, here are quick answers to your questions.

    1. At this point the Consumer has an approved Access Token linked to a user and the Provider server validates it.

    What would happen if the Access Token is invalid? What kind of status
    code would the Provider server issue? If this happens should the
    Consumer server redirect the user to screen where he can authorize
    another Token?

    As per RFC 5849, a Provider should return a 401 (Unauthorized) status code in cases where any of the supplied tokens are invalid.

    The server SHOULD return a 401 (Unauthorized) status code when
    receiving a request with invalid client credentials, an invalid or
    expired token, an invalid signature, or an invalid or used nonce.

    1. If the validation of the Access Token is correct, the Consumer and
      the Provider will exchange information. For example the Consumer will
      ask the email address of the user and the Provider will provide it.

    What protocol should be used to exchange this information? (Json?)
    Should this information go in the body of the response or in another
    place?

    The term their should have been can, and not will. The spec does not mandate any particular information that is required to be transmitted between Provider and Requestor once authentication is complete. This determination is entirely up to the application provider

    1. Following the standard should the Access Tokens and the protected
      information provided be persisted by Consumer server.

    Once again, there is no requirement mandated by the specification. However it is common practice to store the access tokens retrieved from the Provider. I am not a lawyer (IANAL), but note that saving data retrieved from the Provider, into a third party system, may violate the law.

    • 0