Test your OAuth knowledge with a free interactive quiz — 20 questions with answers and explanations. No signup needed to play.
Question 1/5Score 0
What is "PKCE" (Proof Key for Code Exchange), and why is it particularly important for OAuth flows involving mobile apps or single-page applications (SPAs) that can't securely store a client secret?
Questions in this quiz
What is "PKCE" (Proof Key for Code Exchange), and why is it particularly important for OAuth flows involving mobile apps or single-page applications (SPAs) that can't securely store a client secret?
What is OpenID Connect (OIDC), and how does it relate to OAuth 2.0?
What is OAuth (2.0), at its core purpose?
What is the "Client Credentials" grant type in OAuth 2.0 typically used for, as distinct from flows involving an actual end user (like the Authorization Code flow)?
What is a "scope" in an OAuth 2.0 authorization request, and what does it let a user control?
What is a "userinfo endpoint" in OpenID Connect, and how does it relate to (and differ from) the information already available directly within an ID token?
What is a "JWT" (JSON Web Token), and why is it commonly used as the format for OAuth/OIDC tokens (like an ID token)?
What is "token revocation" in OAuth 2.0, and why might a service need this capability beyond simply letting tokens expire naturally?
What are the key "roles" defined in the OAuth 2.0 framework — the Resource Owner, Client, Authorization Server, and Resource Server?
What is the key difference between "authentication" and "authorization," and how does this distinction relate to what OAuth was originally designed to solve?
What is a reasonable general summary of why OAuth 2.0's design (delegated, scoped, token-based access rather than password-sharing) represented a meaningful security improvement over an older, now-discouraged pattern where a third-party app would directly ask a user for their actual username/password to a different service (sometimes called the "password anti-pattern")?
What is a "confidential client" versus a "public client" in OAuth 2.0 terminology, and why does this distinction matter for choosing an appropriate grant type/flow?