27

The steps for Web Server flow, Username-Password Flow, and User-Agent Flow are different, so which occasions are these three used in and how do I select any particular method for different applications. My guess is standalone applications suit Web Server Flow, browser or mobile applications suit for User-Agent Flow and Username-Password flow is used for testing purposes. Is that correct? Any different views?

1 Answer 1

45
  • Web server flow (In OAuth spec terms, Authorization Code Grant) tends to be used for web applications where server-side code needs to interact with Force.com APIs on the user's behalf, for example DocuSign:

DocuSign Authorization

Tokens are sent directly from the Authorization Server to the OAuth Client app, providing a high level of security.

Mobile SDK Authorization

Tokens are returned to the Client app via a 'hash fragment' on a URL.

  • Username-Password flow (Resource Owner Password Credentials Grant) can be used for testing, or for apps that operate non-interactively, such as legacy integrations, without a user to actively give authorization:

     $ curl -d 'grant_type=password&client_id=3MV_CLIENT_ID&client_secret=1234&[email protected]&password=password' \
     https://login.salesforce.com/services/oauth2/token
    
     {
       "id":"https://login.salesforce.com/id/ORG_ID/USER_ID",
       "issued_at":"1385271368428",
       "instance_url":"https://na15.salesforce.com",
       "signature":"Vcz4TlGBQJCwJzNtH3AHT/kUFLM4N/sFrJODX2ZNuyE=",
       "access_token":"00D_ACCESS_TOKEN"
     }
    

Username-password is generally discouraged and should be used only where no other alternative is available, due to the inherent problems with passwords.

8
  • Can you suggest the practical use for each flow? Nov 22, 2013 at 19:31
  • I thought I did.
    – metadaddy
    Nov 22, 2013 at 19:34
  • I mean examples Nov 22, 2013 at 19:44
  • I don't understand - do you mean actual applications, like 'Salesforce1', and 'DocuSign'?
    – metadaddy
    Nov 22, 2013 at 19:55
  • 1
    @techtrekker - the FB Auth Provider uses Web Server flow - you can try it out at authtest-developer-edition.na14.force.com
    – metadaddy
    Jan 24, 2014 at 18:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .