OAuth Notes

Page Contents

Intro

OAuth 2.0 is not backward compatible with 1.0. Do not use 1.0.

Ref: https://www.youtube.com/watch?v=996OiexHze0
     https://www.oauth.com/

MUST READS: https://oauth.net/2/oauth-best-practice/
                 -> https://tools.ietf.org/html/draft-ietf-oauth-security-topics-16
            https://oauth.net/2/browser-based-apps/
                -> https://tools.ietf.org/html/draft-ietf-oauth-browser-based-apps-07

Internet logins began with the standard "form login": username and password home-grown login on
a website that stashed session info in a cookie after successful login. The website and owner are
responsible for:
	1. Security: Have to be aware of best practices and how they change over time
	2. Maintenance: Testing auth system over time

OAuth and Open ID Connect are industry best practices at the time of writing to overcome the above
disadvantages.

Pre mobile era commonly identity use cases included
	1. Simple login (forms and cookies)
	2. Single Sign On (SSO) using a protocol called (SAML)

Now, post 2010, two more use cases arise:
	1. Mobile app login
	2. Delegated authentication.

The client should never get the resource owner's password. This is because the password is generally
the "keys to the kingdom". For example, an app that wants to share a post on my facebook page. If I
give it my FB password it can share the post, but it can also get my friends list, send them messages,
block them, make other unauthoized posts and critically access ANY other service which I access using
my FB credentials!

So, I must avoid giving any third party my password. This is where OAuth comes in.

DELEGATED AUTHENTICATION is where you allow a 3rd party access to your data/platform, probably in
a restricted manner, WITHOUT giving the 3rd party you password.
	Example of the "good old bad old days" were websites that asked for you email account password
	so that they could send invite emails to your friends. This was GIVING AWAY THE KEYS TO THE
	CASTLE! E.g. your bank password reset flow probably goes back there!!
	What we want to do is say "Email provider, I authorize ABC.com to send emails on my behalf from
	my account, as long as you authenticate them when they try to do this". This is delegated
	authentication, and is what OAuth came out of. So ABC can send emails from my account, but,
	importantly wouldn't be authorized to read my emails, for example, or add/delete contacts etc.

	ABC says login to your email account -> Redirect me to email account. I trust my email provider
	more than ABC so I am happy(er) to log into my email provider. The email provider then
	authenticates me (makes sure its me and not Stevil). It then should warn me about the permissions
	that ABC is seeking. If I say its OK it should then accept the instruction that it
	should authorise ABC to send emails. It then returns a token to ABC, which ABC can then use
	in requests to send emails that it sends to my email provider.

DELEGATED AUTHENTICATION is also known as IDENTITY FEDERATION:
	Identity Federation is the process of delegating an individual’s or entity’s authentication
	responsibility to a trusted external party. Each partner in federation plays the role of either
	an identity provider(IdP) or a service provider(SP). In identity federation, an IdP vouches for
	the identity of the users, and an SP provides services to the users.
	(https://dinika-15.medium.com/identity-federation-a-brief-introduction-f2f823f8795a)

Summary
-------
From Udemy Course https://www.udemy.com/course/learn-oauth-2:
    The OAuth standard ensures that there is no unintended leakage of information about the resource owner
	to the app. The app may access only specific resources with the explicit consent of the resource owner.
	The app does not get the resource owner's credentials, which would be wildcard access to all of the user's
	data. By protecting the resource owner's data, especially the personal and profile data of the resource
	owner, the OAuth standard can be used to ensure the privacy of the resource owner.

Nomenclature
------------
- Resource Owner - You - The person who owns the data that the application wants access to. e.g. You
	own your email resource - see above example.

- Client - Just refers to the application that wants access to your data.

- Authorization Server - System the resource owner uses to authorize the client - to say "yes".

- Resource Server - API that holds the data that the client wants to get to. Sometimes resource
	server and auth server are same but oftentimes they are seperate.

- Authorization Grant - The "thing" that prooves that the resource owner has consented to a certain
	level of client access to the resource. This authorization grant allows the client to go
	back to the resource server and get the access token. The authorization code is exchanged for
	the access token.

- Redirect URI - When auth server redirects back to the client application it redirects to the
	redirect URI

- Access Token - The client needs an access token - the key they use to get into the data resource
	owner granted access to.
	See also https://www.youtube.com/watch?v=BNEoKexlmA4:
	The access token is like the electronic RFID key card for a hotel room. You sign in at the front
	desk, which is where you validate using your credentials, and once you have the key you only
	need to present that to get into your room (the resource).

- Scope - The subset of permissions that the access token gives the client
	Auth server will have a list of scopes it understands, e.g. contacts.read. Any types of
	permissions that make sense for the particular resource being accessed.
	E.g. Google scopes tend to be really long URL strings.

- Back Channel - Highly secure channel. API req or HTTP req from my server to Google over HTTPS
	SSL/TLS encrypted - this is a back channel. From my backend server to another system. We
	completely trust our server and code.

- Front Channel - Less secure than back channel.
	E.g. Browser requested website. They can see my JS/HTML code or someone could look over my
		shoulder and see my password as I type it in. We don't completely trust the browser.


Why Exchange Access Code For Access Token - Why The Extra Step?
---------------------------------------------------------------
Why do we get a code rather than the token right away? The reason for the extra step is to take
advantage of the "best things about the front channel and the best things about the back chanell".

The authorisation code is returned to the browser, i.e., over the front end channel. You can
see the code openly in the redirect URL.

This code is then given to the client backend, which then gets the actual access token using this
code over the more secure backend channel. That is why there is the second step so that the thing
that really grants the client access to a resource is only ever communicated over the more secure
and thus more trusted channel.


One Downside To OAuth
---------------------
One downside to OAuth is that the login page can be easily "spoofed". Thus it is up to the user
to figure out whether the login page they are redirected to is genuine, e.g. by examining the
page address. But this can be harder/impossible if the login is embedded in another page.

From RFC6749 (The OAuth 2.0 Authorization Framework), section 9:
		An embedded user-agent poses a security challenge because resource
		owners are authenticating in an unidentified window without access
		to the visual protections found in most external user-agents.  An
		embedded user-agent educates end-users to trust unidentified
		requests for authentication (making phishing attacks easier to
		execute).

And also in section 10.11 (Phishing Attacks):
		Wide deployment of this and similar protocols may cause end-users to
		become inured to the practice of being redirected to websites where
		they are asked to enter their passwords.  If end-users are not
		careful to verify the authenticity of these websites before entering
		their credentials, it will be possible for attackers to exploit this
		practice to steal resource owners' passwords.

		Service providers should attempt to educate end-users about the risks
		phishing attacks pose and should provide mechanisms that make it easy
		for end-users to confirm the authenticity of their sites.  Client
		developers should consider the security implications of how they
		interact with the user-agent (e.g., external, embedded), and the
		ability of the end-user to verify the authenticity of the
		authorization server.

For an introduction to some of the VULNERABILITIES common in OAuth implementations see
https://portswigger.net/web-security/oauth


Flow In Brief
-------------

App wants to access my FB account
	* It asks the OAuth server for a token
	* OAuth asks me (the resource owner) if I want to give permission for a SUBSET of operations on
	  my resource (FB account)
	* I authorize by giving my user name and password to the OAuth servier
		OAuth servier validates this information either itself or by asking another third party
		(OAuth server and resource sever can be seperate)
	* Token is sent back to the app (client)
		Thus the client never sees our password. It only gets a "passport" or "permissions slip"
		that it can give to FB to access a SUBSET of the services that I can access on FB - only
		those services I want the client to access
	* Client asks the resource server for access to a service and gives token to resource server.
		Resource server doesn't know anything about the token.
		It contacts the Oauth server, gives it the token, and asks "is this token valid?".
			OAuth server looks it up - is it still active? has it been revoked? etc etc
			Tells the resource server whether it is valid or not, and WHAT TYPE OF ACCESS
			WAS GRANTED.
	* If token valid resource server gives client access to the requested service.


OAuth is used for DELEGATION and not authorization or authentication. It is the resource server that does
the authorization as to what resources can be accessed based on the OAuth token presented. Authentication
is done by the external component such as the login page - OAuth server triggers authentication but does
not do it itself. Thus everything is delegated.


SEE the RFC here: https://tools.ietf.org/html/rfc6749

The following is an annotated version of the abstract protocol flow from the RFC:

Authentication v.s. Authorization
---------------------------------
Authorization == WHAT you can do
Authentication == WHO you are



How To Prevent Oauth Authentication Vulnerabilities

From https://portswigger.net/web-security/oauth/preventing:
	For OAuth client applications
		1. Make sure you fully understand the details of how OAuth works before implementing it. Many
		   vulnerabilities are caused by a simple lack of understanding of what exactly is happening at
			 each stage and how this can potentially be exploited.
		2. Use the state parameter even though it is not mandatory.
		   The state parameter should ideally contain an unguessable value, such as the hash of
			 something tied to the user's session when it first initiates the OAuth flow. This value is
			 then passed back and forth between the client application and the OAuth service as a form of
			 CSRF token for the client application.
		3. Send a redirect_uri parameter not only to the /authorization endpoint, but also to the /token
		   endpoint.
		4. When developing mobile or native desktop OAuth client applications, it is often not possible
		   to keep the client_secret private. In these situations, the PKCE (RFC7638) mechanism may be 
			 used to provide additional protection against access code interception or leakage.
		5. If you use the OpenID Connect id_token, make sure it is properly validated according to the
		   JSON Web Signature, JSON Web Encryption, and OpenID specifications.
		6. Be careful with authorization codes - they may be leaked via Referer headers when external
		   images, scripts, or CSS content is loaded. It is also important to not include them in the
			 dynamically generated JavaScript files as they may be executed from external domains via
			 <script> tags.



Actors

Actor #1: OAuth Provider
	OAuth server has 3 components:
		Authentication component
			Login page etc. Identity provider Oauth is the front end of the IAM
		Consent component
			Get consent for the delegation of access rights to the client
			User is logged in. This page says "do you really want to provide this subset
			to the app
		Token management infra structure
			Basically the token DB

	The OAuth server generally provides 2 enpoints: their function is standard but the URL
	need not be.
		1. Authorization endpoint
			/authorize [GET]
				For "auth code grant" gives AUTHORIZATION CODE
				For "implicit grant" gives ACCESS TOKEN
		2. Token endpoint
			/token [POST]
			It is a protected enpoint so requires the client ID and secret, that would
			have been delivered to the client via the autorize process. Uses HTTP BASIC
			protection.

			Produces an ACCESS TOKEN and a REFRESH TOKEN for "auth code grant", "client
			credentials grant", "resource owner credentials grant".


Actor #2: Resource Provider (Server)
	Makes a protected resource available over HTTPS. Often via a RESTful API which ensures only allowed
	clents can access the data (access token), which it does via the OAuth token.

	Provides the resources owned by the resource owner, that are requested by the client (3rd party)
	using the access tokens provided by the Oauth provider.

	Provides the resource EP


Actor #3: Resource Owner
	Owner of the protected resource. S/he can access their data directly. Wih OAuth the resource owner
	is giving a client permissions to indirectly access their data via the OAuth authentication mechanism
	(owner delegates his access rights, or a subset of them, to the client) and can specify restricted
	access to the protected resource, i.e., only allow access to a subset of the resource or restrict the
	things that can be done with or to that resource.


Actor #4: Client
	Third party tring to access protected resources of the resource owner. E.g. an app trying to access
	my FB page etc.

	The OAuth server will provide the client with an ID and a secret by which the client can then
	identify itself.

	Client provides the redirect EP.

	Clients come in two types:
	   1. CONFIDENTIAL - Client can securely store client credentials or is capable of secure
        client authentication using other means.
	   2. PUBLIC - Incapable of maintaining the confidentiality of their credentials. E.g. client
		    app in web browser, and incapable of secure client authentication via any other means.


A component can have the role of several actors. Eg Words with friends wants access to my FB friends list.
"Words with friends" is the client. I am the resource owner, FB is both the resource provider and the
OAuth provider.

Another example. I want to login to PrintMyPhotos.com. FB is the OAuth provider. PrintMyPhotos.com is
both the client. But who is the resource owner? It is PrintMyPhotos.com... in this case the OAuth
provider is just authenticating that I am who I say I am. The protected resource is the photos stored
on PrintMyPhotos.com.



End Points

	1. Authorization EP (OAuth server): The authorization endpoint is used to interact with the
	   resource owner and obtain an authorization grant.
	      Verify identity of resource owner.
	      Because requests to the authorization endpoint result in user authentication and the
	      transmission of clear-text credentials (in the HTTP response), the authorization server MUST
	      require the use of TLS.
	2. Token EP (OAuth server): Used by the client to obtain an access token by presenting its
	   authorization grant or refresh token.
	3. Redirect EP (Client)
	4. Resource EP(s) (Resource server)



Tokens

CAUTION WITH OAUTH TOKENS: Tokens grant access but do NOT verify who the user is! So, if Bob has access
to Alice's token, he will be able to access everything Alice can, whether or not Alice has given him
permission or not (imagine Bob somehow stole the token, for example!).
	Thus it is important to keep any kind of token CONFIDENTIAL!
	This means USE TLS EXCLUSIVELY for any token transmission

	Access Tokens (AT):
		Used by client to access resources. AT valididty is time limited. Stored and sent
		by the client. Sent to resource server generally.
		The holder of the token has the access rights associated with the token BUT the token
		holder is not authenticated after the initial issue, so tokens must be kept
		confidential!

	Refresh Token (RT):
		Time limited validity, longer than AT validity. Used to request new AT after AT expired.
		When RT used the credentials of the resource owner do NOT have to be checked again.
		Stored and sent by the client. Never sent to the resource server, only to OAuth server.
		Thus, only used to refresh ATs and never used to actually access resources themselves.

	Authorization Code (AC):
		Send by auth server to client after authenticating the resource owner (i.e. getting
		the consent of the resource owner for delegating the access). The AC is just a code
		that represents the authentication and consent of the resource owner that the client
		should be able to access the resource. It is not, the AT! At AC validity is normally
		only valid for a couple of minutes. The AC can then be used to get an AT!



Client Registration

When new client wants access to resources. OAuth server needs some information about the client and
returns, in exchange, a client ID and a client secret.

When new client is registered, must provide
1. Redirect URI
2. Required scopes (what type/subset of resource is going to be used)


Dynamic client registration protocol: https://tools.ietf.org/html/rfc7591

Explanation taken from https://ldapwiki.com/wiki/OAuth%202.0%20Client%20Registration:

	OAuth Clients must register with the Authorization Server before any transactions
	may occur. Before an OAuth Client can request access to Protected Resource on a
	Resource Server, the OAuth Client must first register with the Authorization Server
	associated with the Resource Server.

	OAuth 2.0 Client Registration is typically a one-time task. Once registered, the
	registration remains valid, unless the OAuth Client registration is revoked.

	At OAuth 2.0 Client Registration the OAuth Client is assigned a Client_id and a
	Client Secret (password) by the Authorization Server.

	The Client_id and Client Secret is unique to the OAuth Client on that Authorization Server.

	If a OAuth Client registers with multiple Authorization Servers (e.g. both Facebook, Twitter
	and Google), each Authorization Server will probably issue a different and unique Client ID
	to the OAuth Client application.

	Whenever the OAuth Client requests access to resources stored on that same Resource Server,
	the OAuth Client needs to Authenticate itself by sending the Client ID and the Client Secret 
	to the Authorization Server.

	During the registration the OAuth Client also registers a redirect_uri. This redirect_uri is
	used when a Resource Owner grants Authorization to the OAuth Client. When a Resource Owner
	has successfully Authorized the OAuth Client via the Authorization Server, the Resource Owner
	is redirected back to the OAuth Client's redirect_uri.

	OAuth 2.0 Client Registration must be done outside of the The OAuth 2.0 Authorization
	Framework.



Flows Overview

OAuth Flows Overview
--------------------

From RFC:
	To request an access token, the client obtains authorization from the
	resource owner.  The authorization is expressed in the form of an
	authorization grant, which the client uses to request the access
	token.

1. Authorizaton Grant Flow
	A.k.a. "three-legged ouath"
	Most secure flow
	Client must be able to securley store client ID/secret and tokens

2. Implicit Grant Flow
  *** WARNING - IT IS NOT LONGER RECOMMENDED TO USE THIS FLOW - SEE PKCE ***
	*** WARNING - DO NOT USE ANYMORE! ***

	Used when client can NOT securley store client ID/secret or OAuth tokens
	E.g. When client written in client side JavaScript
	Cons: Short validity of tokens and refreshing AT very difficult

3. Client Credential Flow
	A.k.a "two-legged OAuth"
	Used when client is also the resource owner
	Uses ONLY the /token EP

4. Resource Owner Password Credentials Flow
	When resource owner can entrust password to client

5 ** SEE PKCE ** - Authorization Grange Flow WITH PKCE as a replacement for the implicit grant flow.

For a really good guide on choosing which flow to use see:
https://auth0.com/docs/authorization/which-oauth-2-0-flow-should-i-use


Authorization Grant Flow

Checks the identity of the 3 involved actors (why its called "3-legged"). The authorization code
grant type is used to obtain both access tokens and refresh tokens and is optimized for
confidential clients.

From RFC:
    The authorization code grant type is used to obtain both access
    tokens and refresh tokens and is optimized for confidential clients.
    Since this is a redirection-based flow, the client must be capable of
    interacting with the resource owner’s user-agent (typically a web
    browser) and capable of receiving incoming requests (via redirection)
    from the authorization server.


OAuth server authenticates the resource owner using his/her username/password that
are provided interactively via the login mechanism that the OAuth server provides.

OAuth server authenticates the client using its client ID and secret.

Identity of the Auth server is checked by its certificate.

Flow should only be used when CLIENT PROVIDES SECURE STORAGE FOR ID, SECRET AND
TOKENS!


Resource  ------------> OAuth  <----------- Resource -----------> Resources
 Owner    <------------ Server ----------->  Server  <----------/
                           |                   ^
                          / \                  |
                     /auth   /token            |
                         ^  ^                  |
                         |  |                  |
                         v  v                  |
                        Client <---------------+


Advantages:
	Relatively high security level
	AT does NOT flow through browser
	Username/pwd of resource owner not known to client
	Convenience - Use of RT allows access for longer periods of time without
		requiring re-authentication

		Identities of all 3 participants is ensured


Refresh tokens
--------------
Quicker renewal of AT than having to go through entire auth flow again...

The refresh token lasts for longer than the access token (AT). Refresh token (RT) used to get a new
access token and refresh tokens with new TTL. The AT has a TTL. The RT does not have an explicit
TTL, it is just set, by the system, to some time (much) longer than the AT with the assumption the client
uses it as soon as needed.

Only the /token EP is required and the authentication of the resource owner is not needed.


Implicit Grant Flow

*** WARNING THIS SHOULD NOT BE USED ANYMROE - SEE SECTION PKCE ***
*** From best practices RFC:
*** The implicit grant (response type "token") and other response types causing the authorization
*** server to issue access tokens in the authorization response are vulnerable to access token
*** leakage and access token replay ...
*** In order to avoid these issues, Clients SHOULD NOT use the implicit grant and any other
***  response type causing the authorization server to issue an access token in the authorization
*** response.
*** SEE https://medium.com/oauth-2/why-you-should-stop-using-the-oauth-implicit-grant-2436ced1c926

From the RFC:
   The implicit grant is a simplified authorization code flow optimized
   for clients implemented in a browser ...
	 ... In the implicit flow, instead of issuing the client
   an authorization code, the client is issued an access token directly
   (as the result of the resource owner authorization).  The grant type
   is implicit, as no intermediate credentials (such as an authorization
   code) are issued (and later used to obtain an access token).
	 ...
	 ...
   The implicit grant type does not include client authentication, and
   relies on the presence of the resource owner and the registration of
   the redirection URI.  Because the access token is encoded into the
   redirection URI, it may be exposed to the resource owner and other
   applications residing on the same device.

Used for clients that cannot securely store the client ID and client secret as well as the refresh
token: no refresh tokens are issued in this flow.

Use case is mainly client side JavaScript applications but also native apps as its relatively easy
to pull the app secret out of the binary.
From https://www.oauth.com/oauth2-servers/oauth-native-apps/:
     Like browser-based apps, native apps can’t maintain a confidential client secret after the
		 developer registers one, as that would require that the developer ship the secret in their
		 binary distribution of the application. It has been proven to be relatively easy to decompile
		 and extract the secret. As such, native apps must use an OAuth flow that does not require a
		 secret.

Does not used /token EP.

/auth EP gives the access token directly - dont need the token EP - but no refresh token.
The access tokens have a SHORT VALIDITY time. This is because the client has not been
authenticated and a short validity period tries to hedge against the danger this introduces.

Thus implicit grant has a REDUCED LEVEL OF SECURITY COMPARED TO THE AUTHORIZATION GRANT from
the previous section.


The OAuth RFC talks about the AT being dropped in the redirect because it is part of the URL
fragment. This appears to now be out of date as redirects of this nature can propogate the
fragment (bit after the # in the URL) through the redirect.
    See: https://trac.ietf.org/trac/httpbis/ticket/6
         https://stackoverflow.com/a/2305927/1517244

Further explanation about the insecurity of the access token and why it can't be refreshed
was excellently explained at:
https://www.scottbrady91.com/OpenID-Connect/Silent-Refresh-Refreshing-Access-Tokens-when-using-the-Implicit-Flow:
		When using the implicit authentication flow refresh tokens cannot be requested or used, since
		the client application cannot be explicitly or securely authenticated and therefore cannot be
		trusted with such a sensitive token. This also applies to any flow on a public client incapable
		of keeping a secret or making secure back channel requests. If a refresh token intended for a
		such a client was stolen, the thief could use it to request access tokens for that user, without
		their knowledge or consent.

		When using a client application running in the browser ... we expect the user to be present at
		the client application. They might be currently in a different tab ... but the session is still
		active. This means that if their access token expires, they should still be around to authorize
		another to be issued. ...

So, I wondered, how to web apps keep users signed in if they are not permitted to use refresh
tokens? The answer was also given in the above article by Scott Brady.
		Silent refresh uses the assumption that the user is still logged into the OpenID Provider to
		automatically make another OpenID Connect authorization request and receive new tokens. This is
		done behind the scenes without interrupting the user experience.

		This request is typically made in an iFrame, too small for the user to see, with the request
		looking very similar to the authorization request that the client application made to initially
		authenticate the user, albeit with a few tweaks.


Interestingly from here: https://auth0.com/docs/authorization/which-oauth-2-0-flow-should-i-use
		If the Client is a Single-Page App (SPA), an application running in a browser using a scripting
		language like JavaScript, there are two grant options: the Authorization Code Flow with Proof
		Key for Code Exchange (PKCE) and the Implicit Flow with Form Post. For most cases, we recommend
		using the Authorization Code Flow with PKCE because the Access Token is not exposed on the
		client side, and this flow can return Refresh Tokens.

Redirects For Apps

See: https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uris-native-apps/
^^^
The authorization endpoint normally redirects the user back to the client’s registered redirect URL.
Depending on the platform, native apps can either claim a URL pattern, or register a custom URL
scheme that will launch the application. For example, an iOS application may register a custom
protocol such as myapp:// and then use a redirect_uri of myapp://callback.


Book Of Face!

SEE: https://developers.facebook.com/
     https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow/

Register app at developers.facebook.com
    Things to record:
      1. App ID (a.k.a. Client ID)
      2. App SECRECT (do not expose this to anyone!!)

    Things to enter:
      1. Redirect URI. Note FB auto puts a slash at the end for you and the URI you send in your
         request must match the one FB has stored, so you must send it with a terminating slash.
         When you send the URI you will, of course, URL ENCODE it because it will be a parameter
         of your request.

The following is an AUTHORIZATION GRANT FLOW emulation as the secret app key is "stored securely"
by us at the command line (in fact to be super secure you read it in at command line so it wont
even be stored in the bash history - or just regenerate a secret after playing).

Auth EP
    Seems at time of writing its v10: https://www.facebook.com/v10.0/dialog/oauth?client_id={app-id}
                                                                                 &redirect_uri={redirect-uri}
                                                                                 &state={state-param}
    You will use your URL encoded redirect URI you entered when registering you app for
    {redirect-uri} and state, as we've learnt, can be any data you like.

    When your redirect URL is called it will have "code" as a URL parameter. This should be
    stored - it is the AUTH CODE.

    To test, visit that link in your browser... the browser will show the FB login and auth
    then redirect back to your redirect URI, from which you can extract the AUTH CODE.

Token EP
    The AUTH CODE must be exchanged for the ACCESS TOKEN.

    From FB Docs: To get an access token, make an HTTP GET request to the following OAuth endpoint:
        GET https://graph.facebook.com/v10.0/oauth/access_token?
            client_id={app-id}
            &redirect_uri={redirect-uri}
            &client_secret={app-secret}
            &code={code-parameter}
    This is a little no standard as it is a GET not a POST.

    NOTE: This is non-standard: it is a GET instead of a POST.

    Can do with CURL to SIMULATE USING THE BACK CHANNEL:
        curl -ik "https://graph.facebook.com/10.0/oauth/access_token?...." (see above link template)

           -i, --include
              Include the HTTP response headers in the output. The HTTP response headers can include
              things like server name, cookies, date of the document, HTTP version and more...
              To view the request headers, consider the -v, --verbose option.

           -k, --insecure
              (TLS) By default, every SSL connection curl makes is verified to be secure. This
              option allows curl to proceed and operate even for server connections otherwise
              considered insecure.

              The server connection is verified by making sure the server's certificate contains the
              right name and verifies successfully using the cert store.

        The response will look like:
            {"access_token":"... very long string ...","token_type":"bearer","expires_in":5183057}

        Notice there is no refresh token.

** NOTE IMPLICIT GRANT FLOW NO LONGER RECOMMENDED!! **
To do AN IMPLICIT GRANT FLOW note that the FB auth EP (https://www.facebook.com/v10.0/dialog/oauth)
has the following optional parameter:
    * response_type. Determines whether the response data included when the redirect back to the
                     app occurs is in URL parameters or fragments.
        * code.  Response data is included as URL parameters and contains code parameter (an encrypted
                 string unique to each login request). This is the default behavior if this parameter
                 is not specified. It's most useful when your server will be handling the token.
        * token. Response data is included as a URL fragment and contains an access token. Desktop
                 apps must use this setting for response_type. This is most useful when the client
                 will be handling the token.
^^
Set this to "token".

For the token EP, if it requires, as is standard, a POST request, you can change the curl command
to:
    curl -ik -X POST https://the/token/endpoint/address \
        -d grant_type=authorization_code \
        -d code={auth code as returned by auth server} \
        -d redirect_uri=... \
        -d client_id=... \
        -d client_secret=....


Proof Key For Code Exchange By Oauth Public Clients

SEE: https://tools.ietf.org/html/rfc7636
	QUOTE: OAuth 2.0 [RFC6749] public clients are susceptible to the
		authorization code interception attack.

		In this attack, the attacker intercepts the authorization code [WHAT you can do]
		returned from the authorization endpoint within a communication path
		not protected by Transport Layer Security (TLS), such as inter-
		application communication within the client's operating system.

		Once the attacker has gained access to the authorization code, it can
		use it to obtain the access token.

So why is it problematic that the authz code is intercepted? This just says WHAT the owner of the
token is allowed to do. It is not the authentication token (the app secret) which verifies WHO
the app is. It's problematic for flows that do not use the authentication EP - I.e. do not have an
app secret to act as the authentication mechanism.

SEE ALSO: https://auth0.com/docs/flows/authorization-code-flow-with-proof-key-for-code-exchange-pkce
          https://developer.okta.com/blog/2019/08/22/okta-authjs-pkce#:~:text=PKCE%20works%20by%20having%20the,is%20called%20the%20Code%20Challenge
          https://medium.com/identity-beyond-borders/what-the-heck-is-pkce-40662e801a76

Terms:
------
    CODE VERIFIER: A random value generated by the app. (RFC describes it as a "a dynamically
                   created cryptographically random key"). A UNIQUE code verifier must be used for
                   every authorization request.
    CODE CHALLENGE: A hash of the code verifier.





Openid Connect

OpenID Connect supersedes and obsoletes OpenId 2.0 * OpenId 1.0/

From https://portswigger.net/web-security/oauth/openid:
	OpenID Connect extends the OAuth protocol to provide a dedicated identity and authentication
	layer that sits on top of the basic OAuth implementation. It adds some simple functionality that
	enables better support for the authentication use case of OAuth.
	...
	OpenID Connect .. [adds] standardized, identity-related features to make authentication via OAuth
	work in a more reliable and uniform way.

SEE SPEC: https://openid.net/specs/openid-connect-core-1_0.html
	The primary extension that OpenID Connect makes to OAuth 2.0 to enable End-Users to be
	Authenticated is the ID Token data structure. The ID Token is a security token that contains
	Claims about the Authentication of an End-User by an Authorization Server when using a Client,
	and potentially other requested Claims. The ID Token is represented as a JSON Web Token (JWT).
	For JWT see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-json-web-token.

From nice big-picures tutorial: https://developer.okta.com/blog/2019/10/21/illustrated-guide-to-oauth-and-oidc
	OAuth 2.0 is designed only for authorization, for granting access to data and features from one
	application to another. OpenID Connect (OIDC) is a thin layer that sits on top of OAuth 2.0 that
	adds login and profile information about the person who is logged in. Establishing a login
	session is often referred to as authentication, and information about the person logged in
	(i.e. the Resource Owner) is called identity. When an Authorization Server supports OIDC, it is
	sometimes called an identity provider, since it provides information about the Resource Owner
	back to the Client.


Oauth And Jwt

https://stackoverflow.com/a/28503265
https://www.loginradius.com/blog/engineering/using-jwt-with-oauth2-when-and-why/