What is OAuth 2.0
OAuth 2.0 (RFC 6749) is a delegated-authorization standard: app A gains the right to act on behalf of a user in service B without receiving the user's password. Don't confuse with authentication — "sign in with Google" uses OpenID Connect on top of OAuth 2.0. Core flows: Authorization Code (web), PKCE (mobile/SPA), Client Credentials (service-to-service), Device (TV, CLI).
Below: details, example, related terms, FAQ.
Details
- Authorization Code: redirect → code → server exchanges for access_token
- PKCE (Proof Key for Code Exchange): for public clients, defends against stolen codes
- Client Credentials: service-to-service, no user, via client_id + client_secret
- Device Code: for devices without browsers — user confirms on phone
- Scopes: limit what the token can do (read:email vs write:all)
Example
Authorization: Bearer eyJhbGciOi...Related Terms
Why teams trust us
How it works
Enter site URL
Security headers analyzed
Get grade A–F
What Does the Security Analysis Check?
The tool checks HTTP security headers, SSL/TLS configuration, server info leaks, and protection against common attacks (XSS, clickjacking, MIME sniffing). A grade fromA to F shows overall security level.
Header Analysis
Checking Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and more.
SSL Check
TLS version, certificate expiry, chain of trust, HSTS support.
Leak Detection
Finding exposed server versions, debug modes, open configs, and directories.
Report with Recommendations
Detailed report explaining each issue with specific steps to fix it.
Who uses this
Security teams
HTTP header audit
DevOps
config verification
Developers
CSP & HSTS setup
Auditors
compliance checks
Common Mistakes
Strict-Transport-Security.Server: Apache/2.4.52 helps attackers find exploits. Hide the version.DENY or SAMEORIGIN.nosniff, browsers may misinterpret file types (MIME sniffing).Best Practices
Content-Security-Policy-Report-Only, monitor violations, then enforce.Server, X-Powered-By, X-AspNet-Version from responses.Get more with a free account
Security check history and HTTP security header monitoring.
Sign up freeLearn more
How-to
Frequently Asked Questions
OAuth 2.0 vs OpenID Connect?
OAuth 2.0 is authorization (what). OpenID Connect is a layer on top for authentication (who) via an id_token (JWT).
Is Implicit flow still used?
No — since OAuth 2.1 draft (2019) and most guides mark it deprecated. Replacement: Authorization Code + PKCE.
Is the access token a JWT?
Can be, not required. The OAuth spec does not mandate format. Many providers (Google, Auth0) return JWTs for client convenience.