0

I have just started learning Rest API from developer guide.

I'm not able to understand the difference in Web Server and User-Agent flow, both seem to be same, the only difference in Web Server is that it Exchange authorization code for an access token. But when I tested both in SOAP UI both seem to be same and both are asking for salesforce credentials to login in HTML response.

My questions are:

  1. What's the difference between these two and when to use what OAuth Authentication?
  2. My response body is in XML not in JSON as mentioned in the developer guide. In JSON I'm getting this message for both OAuth The content you are trying to view cannot be viewed as JSON
Improve this question
1
  • In most of the answer in StackExchange mentioned that WS uses consumer Secret and UA does not but in the example given in developer guide, I can't see the consumer secret as parameter Commented Apr 7, 2018 at 9:52

2 Answers 2

Reset to default
2

On your question 1) there is a helpful page to see the differences and make the choice Which OAuth 2.0 grant should I implement? and the site has further detail here:

The difference is that the User-Agent flow:

It is intended to be used for user-agent-based clients (e.g. single page web apps) that can’t keep a client secret because all of the application code and storage is easily accessible.

Secondly instead of the authorization server returning an authorization code which is exchanged for an access token, the authorization server returns an access token.

Improve this answer
1

Fundamentally the difference is the type of distribution platform for the app and the level of expected security.

User-Agent

In an environment where an app is distributed and security can't be gauranteed (for instance, on a mobile device), user-agent flow says to the app "I'm going to direct you elsewhere, somewhere trusted, so you can then securely access protected resources."

Web-Server

In an environment where an app is not distributed and security can (largely) be gauranteed (for instance, on a web server, hence the name), the server says, via web-server flow, to the app "I have trusted information already, so we can do the security exchange between us directly and give access to the protected resources."

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.