I have a quick questions

In your opinion, it makes sense to implement OAuth2 if all clients will be accessing their information via a trusted application?

My use case:

I have a mobile application, web application, and desktop application, all-consuming data from a 2 micro-services exposing a REST interface.

I want to secure them first at the application level, with authentication and authorization based on the users role. The application can consume data without any limitation but I want the users to be limited by their roles and permissions.

I implemented an authentication server using OAuth2 that authenticates the user and returns a token and user details(role and permissions) with password grand_type, and as an application, I'm using client_credentials grant_type. which they can use to access my resource server. And it's working fine

But now I really want to know if this should be the right approach for my use case, having in consideration that OAuth2 is more for access delegation

What are your thoughts on this

there is a simple and yet secure approach ? or Oauth2 totally fine?

New contributor
Afreeca is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

Afreeca is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.