What is a Grant Type?
OAuth 2.0 Authorization Context
Within the framework of OAuth 2.0 Authorization, the term "Grant Type" pertains to the method through which an application procures an access token. Essentially, the grant type specifies the kind of authorization flow the application will use to access user data.
Different Grant Types in OAuth 2.0
OAuth 2.0 defines several grant types, tailored for distinct application scenarios. In a LoadFocus load test you pick one from the Grant Type list when Authorization Type is OAuth 2.0: Authorization Code, Implicit, Password Credentials, Client Credentials or Refresh Token:
- Authorization Code:
- Best for: Applications that can keep the client secret safe, often server-side applications.
- Flow: The user is first redirected to an authentication server. Upon successful authentication, they are redirected back to the application with an authorization code. The application exchanges this code for an access token.
- Implicit:
- Best for: Not recommended. It was designed for single-page apps, but current security guidance (RFC 9700) says it SHOULD NOT be used.
- Flow: Mirrors the Authorization Code flow, but the access token is delivered directly without an intermediate code. It is less secure than the Authorization Code method.
- Password (Resource Owner Password Credentials):
- Best for: Legacy setups only. RFC 9700 says this grant MUST NOT be used.
- Flow: Users directly input their username and password into the application. The application then uses these credentials to fetch an access token. Use it in a test only when the system under test still requires it.
- Client Credentials:
- Best for: Services or applications that need to access their own resources, not those of a user.
- Flow: The application authenticates using its own credentials (like client ID and secret) and gets an access token in return.
- Refresh Token:
- Use: It's not a standalone flow but complements other grant types. When the access token expires, a refresh token allows the application to get a new one without having the user log in again.
Why Are Grant Types Important?
Grant types offer flexibility for varying application contexts. The choice of grant type affects the interactions between the client, user, and authorization server, and some choices are much safer than others. For a load test, pick the grant type your application actually uses in production.