Openid VS Oauth

Once upon a time in the vast world of the internet, there were two powerful warriors known as OpenID and OAuth. These mighty technologies revolutionized the way users interacted with various online platforms, ensuring their privacy and security. Let us delve into their epic tale and discover the difference between these two guardians of the virtual realm.

Our story begins with OpenID, a noble knight whose primary mission was to tackle the problem of managing multiple usernames and passwords across different websites. In a world where people had countless online accounts, OpenID emerged as a universal identifier that allowed users to log in to various websites using a single set of credentials. With OpenID on their side, users no longer needed to remember numerous passwords or create different accounts for each website they visited.

OpenID's journey began in 2005 when it was first introduced by Brad Fitzpatrick, an ingenious programmer. He envisioned a solution that would simplify the authentication process while maintaining user privacy. OpenID achieved this by acting as an intermediary between users and websites. When a user wanted to log in to a website using their OpenID, they would be redirected to their OpenID provider (such as Google or Yahoo) to authenticate themselves. Once verified, the provider would send back an approval token to the website, granting access without revealing any personal information.

As OpenID continued its valiant efforts, another hero emerged from the shadows - OAuth, a formidable warrior with a different mission. OAuth focused on granting access permissions rather than authentication itself. Its purpose was to enable users to grant limited access rights to third-party applications without sharing sensitive login information.

The tale of OAuth began in 2006 when Blaine Cook and Chris Messina recognized the need for a secure authorization framework that could be widely adopted across various platforms. OAuth worked by allowing users to grant access privileges directly to specific services or applications without divulging their username or password. It acted as an intermediary between users and service providers, ensuring that only the required information was exchanged.

OAuth's power lay in its ability to generate temporary access tokens, known as "bearer tokens" or "access tokens." These tokens acted as virtual keys that granted limited access to the user's account for a specific purpose and duration. By utilizing OAuth, users could authorize applications to perform actions on their behalf without exposing their login credentials or personal data.

As time passed, both OpenID and OAuth continued to evolve, adapting to the ever-changing needs of the digital landscape. In 2010, these two mighty warriors joined forces under a new banner known as OpenID Connect. This collaboration aimed to combine the strengths of OpenID and OAuth into a single protocol, providing both authentication and authorization capabilities.

OpenID Connect became the ultimate guardian of user identity and access control. It allowed websites and applications to authenticate users through OpenID providers while also providing access token issuance for authorized third-party applications. This unification brought convenience, security, and standardization to the world of online interactions.