How OAuth works
In a typical OAuth flow, an application redirects the user to the service that holds their data, such as an email or cloud platform. The user signs in there and approves requested permissions, called scopes. The service then issues an access token that the application presents to retrieve only that approved data.
Tokens are time-limited and can be revoked. OAuth is about authorization; authentication, proving who the user is, is commonly layered on top through OpenID Connect, which is what single sign-on often uses.
Why it matters for Canadian organizations
OAuth is everywhere in modern business software, so weaknesses in it have real consequences. Attackers abuse it by tricking users into granting access to malicious applications, stealing tokens, or exploiting misconfigured redirects, bypassing passwords and even MFA.
Overly broad application permissions can expose personal information held in email and cloud storage, creating privacy obligations under PIPEDA and Law 25. Reviewing which third-party apps hold access is part of good safeguards for cloud services. Use access scopes sparingly, since broad permissions give attackers more to steal if a token leaks.
How to defend against it
Govern which applications can request access. Require administrator approval for consent to high-risk scopes, review existing app grants regularly, and remove unused ones. Developers should use authorization code flow with PKCE, strict redirect URI matching and short-lived tokens.
Monitor for suspicious consent grants and token use, such as new applications with mail or file access, and train users to question unexpected permission prompts. Revoke tokens immediately when an account is compromised. Treat refresh tokens like passwords, storing them securely and rotating them where supported.
Frequently asked questions
Is OAuth authentication or authorization?
OAuth is an authorization framework: it grants an application limited access to resources. Authentication is handled by layers like OpenID Connect built on top of OAuth. Authorization defines what an application may do; authentication confirms who the user is.
What is the difference between OAuth and SAML?
Both support delegated sign-in. SAML is an XML-based standard mostly used for enterprise single sign-on to web apps, while OAuth is token-based and designed for API access and modern apps, including mobile. OAuth is more common for modern web, mobile and API use cases.
Is OAuth secure?
The standard is sound when implemented correctly, but mistakes such as loose redirect URIs, excessive scopes or leaked tokens create risk. Following current best practices, including PKCE, greatly reduces it. Regular reviews of third-party app permissions are advisable.
Related service: Identity and access management