Search code examples
pythondjangoauthenticationoauth-2.0django-oauth

When to use OAuth in Django? What is its exact role on Django login framework?

I am trying to be sure that I understand it correctly:

Is OAuth a bridge for only third party authenticator those so common like Facebook, Google? And using it improves user experience in secure way but not adding extra secure layer to Django login framework? Or only Authorization Code grant type is like that? Can I take it like this?

Solution

  • What is OAuth?

    According to RFC 6749:

    The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf.

    Essentially, it is an authorization protocol used to share permissions between multiple applications.

    If you decide to implement OAuth, your application will be the one to allow other services to programmatically view your users' data and act on their behalf, if needed.

    Whenever an application requires access to another service that you use, it probably uses OAuth to perform those actions. (e.g. When games used to ask us to allow posting on Facebook on our behalf.)

    What OAuth is not?

    By looking at your question, I feel like there's a misunderstanding of OAuth.

    OAuth is not a bridge for third-party authentication methods. If you are looking for this type of authentication mechanism, you should take a look into Single Sign-On (SSO). For Django, you can use django-simple-sso.

    Does it enhance security?

    Depending on the use case, yes, it can enhance security. If your application needs to exchange information with other services, it is a good practice to limit what these third-party services are able to do in your app, feature and time-wise.

    Let's say, for example, that your user needs to give permission to another application to gather information from yours:

    • If you were to use the old-fashioned e-mail and password combination method, these credentials would be exposed in case of this third-party service had a data breach.
    • Using OAuth on the other hand is much more secure, as the credentials stored in the server would not contain the user's password and have very specific roles, apart from being easily revoked.