AuthN CS: clarify OAuth (authorization) vs OpenID Connect (authentication); replace legacy 'OpenId' subsection #1776

pankajtaneja5 · 2025-08-30T05:27:10Z

What

Clarifies that OAuth 2.0 is an authorization framework (not an authentication protocol).
Replaces the legacy “OpenId” subsection with “OpenID Connect (OIDC)” and an accurate, current description (ID Token, claims, RP validation).
Adds a See also link to the OAuth 2.0 Cheat Sheet for implementation guidance.

Why

The live Authentication CS still contains outdated “OpenId” text and language that can imply OAuth handles authentication, which is misleading for readers.

References

RFC 6749 — The OAuth 2.0 Authorization Framework (IETF)
OpenID Connect Core 1.0 — OpenID Foundation
OWASP OAuth 2.0 Cheat Sheet

You're A Rockstar

Thank you for submitting a Pull Request (PR) to the Cheat Sheet Series.

🚩 If your PR is related to grammar/typo mistakes, please double-check the file for other mistakes in order to fix all the issues in the current cheat sheet.

Please make sure that for your contribution:

In case of a new Cheat Sheet, you have used the Cheat Sheet template.
All the markdown files do not raise any validation policy violation, see the policy.
[x ] All the markdown files follow these format rules.
All your assets are stored in the assets folder.
All the images used are in the PNG format.
[ x] Any references to websites have been formatted as [TEXT](URL)
You verified/tested the effectiveness of your contribution (e.g., the defensive code proposed is really an effective remediation? Please verify it works!).
The CI build of your PR pass, see the build status here.

If your PR is related to an issue, please finish your PR text with the following line:

This PR fixes issue #1763 .

Thank you again for your contribution 😃

…tion); replace legacy 'OpenId' subsection

jmanico

This is fantastic. I can't say enough how happy I am that you fixed this.

jmanico · 2025-08-30T08:43:59Z

A small fix is needed...

/home/runner/work/CheatSheetSeries/CheatSheetSeries/cheatsheets/Authentication_Cheat_Sheet.md
308:295 ✓ error Incorrect term: “end-user”, use “end user” instead terminology

…DC; trim trailing spaces

…idy whitespace

pankajtaneja5 · 2025-08-31T05:30:38Z

Thanks! I’ve updated “end-user” → “end user” in both places and removed the legacy OAuth/OpenId blocks. Markdown lint is clean locally. Let me know if you’d like any further wording tweaks.

jmanico

nice job

randomstuff · 2025-08-30T08:33:15Z

cheatsheets/Authentication_Cheat_Sheet.md

@@ -303,21 +303,17 @@ Enable logging and monitoring of authentication functions to detect attacks/fail

 While authentication through a combination of username, password, and multi-factor authentication is considered generally secure, there are use cases where it isn't considered the best option or even safe. Examples of this are third-party applications that desire to connect to the web application, either from a mobile device, another website, desktop, or other situations. When this happens, it is NOT considered safe to allow the third-party application to store the user/password combo, since then it extends the attack surface into their hands, where it isn't in your control. For this and other use cases, there are several authentication protocols that can protect you from exposing your users' data to attackers.

-### OAuth
+### OAuth 2.0


What about "OAuth 2"? OAuth 2.1 is going to be around somewhat soon (?) and all of his applies to OAuth 2.0 as well as OAuth 2.1.

I think we should only mention 2.0 and 2.1

@pankajtaneja5 can you add that

randomstuff · 2025-08-30T08:33:38Z

cheatsheets/Authentication_Cheat_Sheet.md


-### OpenId


Maybe add something on this subsection explaining that OpenId is completely different from OpenID Connect? That is a frequent source of confusion ("We will integrate with ThirdPartySoftware, they do OpenID and we support it." two weeks later "Actually we don't support OpenID but OpenID Connect 😢 ")

Agree 100%. One is for delegation and one is for Federation

@pankajtaneja5 can you add that?

randomstuff · 2025-08-30T08:37:09Z

cheatsheets/Authentication_Cheat_Sheet.md


-Open Authorization (OAuth) is a protocol that allows an application to authenticate against a server as a user, without requiring passwords or any third-party server that acts as an identity provider. It uses a token generated by the server and provides how the authorization flows most occur, so that a client, such as a mobile application, can tell the server what user is using the service.
+**OAuth 2.0 is an authorization framework**, not an authentication protocol. It enables a client to obtain scoped, time-limited access to protected resources via access tokens issued by an authorization server. Use OAuth 2.0 for **authorization** (delegating access to APIs and resources). For end-user authentication/SSO, use **OpenID Connect (OIDC)** (see below).


"client" → "client application"?

jmanico · 2025-09-01T07:05:28Z

These are all excellent suggestions

pankajtaneja5 · 2025-09-01T21:45:23Z

✅ Follow-ups addressed:
• Updated heading to OAuth 2.0 and 2.1 and added a short note that guidance applies to both.
• Added a clarification that legacy OpenID 2.0 is not OIDC (and is obsolete).
• Fixed terminology to “end user”.
Thanks for the quick feedback! @randomstuff @jmanico @mackowski

AuthN CS: clarify OAuth (authorization) vs OpenID Connect (authentica…

9f06855

…tion); replace legacy 'OpenId' subsection

pankajtaneja5 requested review from kwwall, mackowski, jmanico and szh as code owners August 30, 2025 05:27

jmanico previously approved these changes Aug 30, 2025

View reviewed changes

Fix lint: remove legacy OpenId + old OAuth block; keep OAuth 2.0 + OI…

fd07d8f

…DC; trim trailing spaces

pankajtaneja5 dismissed jmanico’s stale review via fd07d8f August 31, 2025 05:24

Fix: use 'end user' (no hyphen); remove legacy OAuth/OpenId blocks; t…

81bb730

…idy whitespace

jmanico approved these changes Aug 31, 2025

View reviewed changes

randomstuff reviewed Aug 31, 2025

View reviewed changes

jmanico previously approved these changes Sep 1, 2025

View reviewed changes

docs(authn): mention OAuth 2.1; add note that legacy OpenID ≠ OIDC

4f850bd

pankajtaneja5 dismissed jmanico’s stale review via 4f850bd September 1, 2025 21:39

pankajtaneja5 added 2 commits September 1, 2025 14:56

docs(authn): OAuth 2.1 note + OpenID (legacy) vs OIDC clarification

3e1f66e

docs(authn): markdownlint fixes; OAuth 2.1 note & OIDC clarification

447e9bf

pankajtaneja5 force-pushed the fix/authn-oidc-clarify branch from e66829d to 447e9bf Compare September 1, 2025 22:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

AuthN CS: clarify OAuth (authorization) vs OpenID Connect (authentication); replace legacy 'OpenId' subsection #1776

AuthN CS: clarify OAuth (authorization) vs OpenID Connect (authentication); replace legacy 'OpenId' subsection #1776

Uh oh!

pankajtaneja5 commented Aug 30, 2025

Uh oh!

jmanico left a comment

Uh oh!

jmanico commented Aug 30, 2025

Uh oh!

pankajtaneja5 commented Aug 31, 2025

Uh oh!

jmanico left a comment

Uh oh!

randomstuff Aug 30, 2025

Uh oh!

jmanico Sep 1, 2025

Uh oh!

mackowski Sep 1, 2025

Uh oh!

randomstuff Aug 30, 2025

Uh oh!

jmanico Sep 1, 2025

Uh oh!

mackowski Sep 1, 2025

Uh oh!

randomstuff Aug 30, 2025

Uh oh!

jmanico commented Sep 1, 2025 •

edited

Loading

Uh oh!

pankajtaneja5 commented Sep 1, 2025

Uh oh!

Uh oh!


		Open Authorization (OAuth) is a protocol that allows an application to authenticate against a server as a user, without requiring passwords or any third-party server that acts as an identity provider. It uses a token generated by the server and provides how the authorization flows most occur, so that a client, such as a mobile application, can tell the server what user is using the service.
		OAuth 2.0 is an authorization framework, not an authentication protocol. It enables a client to obtain scoped, time-limited access to protected resources via access tokens issued by an authorization server. Use OAuth 2.0 for authorization (delegating access to APIs and resources). For end-user authentication/SSO, use OpenID Connect (OIDC) (see below).


		### OpenId

AuthN CS: clarify OAuth (authorization) vs OpenID Connect (authentication); replace legacy 'OpenId' subsection #1776

Are you sure you want to change the base?

AuthN CS: clarify OAuth (authorization) vs OpenID Connect (authentication); replace legacy 'OpenId' subsection #1776

Uh oh!

Conversation

pankajtaneja5 commented Aug 30, 2025

What

Why

References

You're A Rockstar

Uh oh!

jmanico left a comment

Choose a reason for hiding this comment

Uh oh!

jmanico commented Aug 30, 2025

Uh oh!

pankajtaneja5 commented Aug 31, 2025

Uh oh!

jmanico left a comment

Choose a reason for hiding this comment

Uh oh!

randomstuff Aug 30, 2025

Choose a reason for hiding this comment

Uh oh!

jmanico Sep 1, 2025

Choose a reason for hiding this comment

Uh oh!

mackowski Sep 1, 2025

Choose a reason for hiding this comment

Uh oh!

randomstuff Aug 30, 2025

Choose a reason for hiding this comment

Uh oh!

jmanico Sep 1, 2025

Choose a reason for hiding this comment

Uh oh!

mackowski Sep 1, 2025

Choose a reason for hiding this comment

Uh oh!

randomstuff Aug 30, 2025

Choose a reason for hiding this comment

Uh oh!

jmanico commented Sep 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pankajtaneja5 commented Sep 1, 2025

Uh oh!

Uh oh!

jmanico commented Sep 1, 2025 •

edited

Loading