Gain insights into JWT, OAuth2, and OpenID Connect. Learn about HTTPS, encryption, and handshake techniques, and explore foundational concepts in web API security for enhanced application protection.

Web application developers are always on the lookout for ways to secure their applications. It has become the most fundamental part of any web application considering the rise in the number of cyber-attacks. This course will be your handy guide to the basic terminologies and frameworks related to web application security.

 In this course, you will learn what JWT is, how a JWT is created, and what benefits it provides in token-based authentication. You will learn about why HTTPS was introduced and how it revolutionized the way data is transferred using techniques like encryption and handshake. You will also dive deep into the most commonly used authentication and authorization frameworks called OAuth and OpenId Connect. This course will give you a taste of what web API security is all about and will give you the foundation so you can further your learning of application security.

Web Security and Access Management: JWT, OAuth2 & OpenId Connect

This grant type is used for machine to machine authorization. There is no user involved in this flow.
Suppose we have an application that follows the microservices architecture. The application is divided into small parts and each part is deployed on a separate server.

If one internal server needs to access some data from the other server, then they can use the client credentials grant type.

# Client Credentials grant type working

Now, we will look at the detailed working of Client Credentials grant type.


## Step 1 => Token request

In this flow, there is a direct token request. Since no user is involved, the client directly sends an HTTP Post request to the authorization server.

The query parameters sent with the request are:
1. `grant_type:` Since we are requesting the access token using the client credentials, this parameter will contain **client_credentials**.


2. `client_id:` The client id of the app.

3. `client_secret:` The client secret of the app.

4. `scope:` The optional parameter defining the resources being requested.

The complete request looks like this:

```
POST /token/endpoint HTTP/1.1

  Host: authserver.dummy.com

grant_type=client_credentials
&client_id=12345
&client_secret=gh5Gdkj743HFG45udbfGfs
&scope=images_read
```


This lesson discusses the Client Credentials grant type.

Getting started with Web Application Security

HTTPS Basics

JSON Web Token

OAuth

OpenID Connect

Conclusion

Client Credentials Grant Type