OAuth2 v1.0与v2.0的差异及微软两个OAuth2端点的区别问询

Hey there, let's tackle your two OAuth-related questions clearly and directly:

The two versions are fundamentally different in design, security, and use cases—here's a breakdown of the most impactful gaps:

• Core Design Approach: OAuth 1.0 is a signature-heavy protocol, requiring every API request to be signed with HMAC-SHA1 or RSA. It’s secure but notoriously complex to implement. OAuth 2.0 prioritizes flexibility and developer experience, using bearer tokens and supporting multiple authorization flows tailored to different app types (web, mobile, native, etc.).
• Security Model: OAuth 1.0 doesn’t strictly require HTTPS (though it’s recommended) because signatures verify request integrity. OAuth 2.0 mandates HTTPS for all token exchanges and API calls, since bearer tokens are transmitted in plaintext—security relies entirely on TLS encryption. Signatures only come into play with extensions like signed JWTs.
• Authorization Flows: OAuth 1.0 has a single, rigid core flow (a three-step token exchange). OAuth 2.0 offers several standardized flows:
  • Authorization Code Flow (the gold standard for server-side apps)
  • Client Credentials Flow (for service-to-service communication)
  • Device Authorization Flow (for input-constrained devices like smart TVs)
  • Implicit Flow (once used for SPAs, now deprecated in favor of Authorization Code Flow with PKCE)
• Token Lifecycle: OAuth 1.0 uses long-lived access tokens with no built-in refresh mechanism—users have to re-authenticate once a token expires. OAuth 2.0 uses short-lived access tokens paired with refresh tokens, allowing apps to get new access tokens without user intervention, improving both security and usability.
• Adoption & Ecosystem: OAuth 1.0 is largely obsolete, supported only by legacy systems. OAuth 2.0 is the current industry standard, adopted by all major providers (Microsoft, Google, Facebook, etc.) and extended with protocols like OpenID Connect for identity management.

These are two distinct endpoints tied to Microsoft Azure AD's different application platforms:

Key Differences #

• Feature & Use Case Support:
  • The /oauth2/ endpoint is part of Azure AD v1.0, built for traditional enterprise apps using the ADAL authentication library. It only supports old Azure AD app registrations, limited OAuth flows, and access to legacy APIs (like older Office 365 endpoints or Microsoft Graph v1.0 with pre-assigned permissions).
  • The /oauth2/v2.0/ endpoint is Azure AD v2.0, Microsoft's modern, recommended platform. It supports all standard OAuth 2.0 and OpenID Connect flows, works with all app types (SPAs, mobile, native, server-side), uses the unified Azure AD app registration model, and allows access to both Microsoft Graph v1.0/beta and newer APIs. It also supports both work/school accounts and personal Microsoft accounts.
• Permission Model:
  • v1.0 uses resource-based scopes (e.g., https://graph.microsoft.com/.default) where permissions are pre-configured on the app registration.
  • v2.0 uses delegated scopes (e.g., User.Read, Mail.Send) that users can consent to individually, giving more control over data access.
• Library Support: v1.0 relies on the deprecated ADAL library, while v2.0 uses the actively maintained MSAL library (which offers better security and broader platform support).

Are Both Endpoints Currently Valid? #

Yes, both endpoints are still operational today. However, Microsoft strongly recommends using the v2.0 endpoint for all new applications. The v1.0 endpoint is in maintenance mode, and while there’s no immediate shutdown date, it won’t receive new features. Legacy apps using v1.0 can continue to operate, but new development should prioritize v2.0 and MSAL.

内容的提问来源于stack exchange，提问作者user3392493