Authentication interview question · Most asked
What are OAuth 2.0 and OpenID Connect, and how do they differ?
Summary
OAuth 2.0 is an authorization framework for granting an application limited access to an API on a user's behalf (access tokens); OpenID Connect (OIDC) is an identity layer on top of OAuth that adds authentication (an ID token describing the user) and standard user info.
Longer Answer
'Login with Google' is OIDC: the app receives an ID token (who the user is) and optionally an access token (to call Google APIs). Using a bare OAuth access token as proof of login is a classic mistake. Key roles: resource owner (user), client (your app), authorization server (IdP), resource server (API).
Key Points
- OAuth: delegated authorization
- OIDC: authentication + ID token
- Access token ≠ ID token
- Roles: client, authz server, resource server
More most-asked Authentication questions
- What is the difference between authentication and authorization?
- Compare session-based authentication with token-based (JWT) authentication.
- What are the most common JWT security pitfalls?
- Explain the OAuth 2.0 Authorization Code flow with PKCE.
- How do refresh tokens work, and how do you secure them?
- How should passwords be stored?
- What is multi-factor authentication, and which factors are strongest?
- How do you secure session cookies?