OAuth2 and OIDC in one page

Spring Security · lesson 14 of 31 · 3 min read

Separate delegated access from login, and know which Spring Security role your app is playing.

Open this lesson in the learning hub

Key points

  • OAuth2 is about delegated access: a user lets your app call an API on their behalf. It is not a login protocol.
  • OIDC adds login on top of OAuth2: the same flow plus an id_token that states who the user is.
  • Browser apps use authorization code + PKCE. The token never appears in the URL bar. Implicit flow is obsolete.
  • oauth2Login makes you a client (log in with Google). oauth2ResourceServer makes you an API.
  • Providers are configuration, not code. Boot discovers endpoints and keys from the issuer.

Example

spring:
  security:
    oauth2:
      client:
        registration:
          google:
            client-id: ${GOOGLE_CLIENT_ID}
            client-secret: ${GOOGLE_CLIENT_SECRET}
            scope: openid, profile, email
      resourceserver:
        jwt:
          issuer-uri: https://accounts.google.com

# then in the chain: http.oauth2Login(Customizer.withDefaults());

Client logs users in, resource server checks their tokens — decide which one you are building.

Validating JWTs on every request Misconfigurations that bite

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the Spring Security course, and every lesson in it is listed on the Spring Security contents page.