O'Reilly logo

RESTful Web Services Cookbook by Subbu Allamaraju

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

12.4. How to Use Two-Legged OAuth

Two-legged OAuth is similar to a client supplying its credentials to the server via the Authorization header using basic or digest authentication with no delegation involved. Note that the OAuth specification does not specify this style of authentication, but it is widely used as a means of authenticating a client with a server.

Problem

You want to know how to implement two-legged OAuth to authenticate client requests.

Solution

Two-legged OAuth involves the following steps:

  1. The client requests the server for a consumer key and a consumer secret out of band. The consumer key is an identifier for the client. The consumer secret is a secret shared between the client and the server.

  2. When making a request to access a protected resource, the client includes an Authorization header containing the consumer key, the signature method and signature, a timestamp, a nonce, and optionally the version of the OAuth protocol.

The server verifies the signature before granting access to the resource. This approach is called two-legged since there are just two parties involved in the authentication flow.

Use two-legged OAuth when the server needs to the authenticate the client to provide access control, logging, metering, rate limiting, metrics, etc.

Discussion

Two-legged OAuth is well suited for cases involving several clients accessing protected resources on a server. The server can issue a consumer key and a secret to each client and require that clients submit an Authorization ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required