การผสานรวม OAuth2 และการเข้าสู่ระบบด้วยบัญชีโซเชียล

OAuth2 is a protocol that lets users grant your app limited access to their identity at another provider, without sharing their password. It powers Login with Google, GitHub, and more.

Three players matter: the user (resource owner), your app (the client), and the authorization server (the provider). Spring orchestrates the handshake between them.

The most common flow redirects the user to the provider, who returns an authorization code. Your app exchanges that code for tokens behind the scenes.

• Redirect to provider
• User approves
• Receive code, exchange for token

Spring Security ships an OAuth2 client starter that handles the entire flow for you. Add the dependency to get started.

Configure your client ID and secret in properties. Spring already knows the endpoints for common providers like Google.

Call oauth2Login() in your security configuration to wire up the login page and callback handling automatically.

After login, inject the OAuth2User to access profile attributes like name and email returned by the provider.

Providers return their own attributes. You often map them to your application's authorities so your existing access rules still apply.

OAuth2 is about authorization, while OpenID Connect adds an identity layer with an ID token. Most social logins use OIDC under the hood for authentication.

On first login you typically create a local user record keyed by the provider's unique ID, linking the external identity to your own data model.

Always validate redirect URIs, keep client secrets out of source control, and request only the scopes you actually need.

You added OAuth2 client support, registered a provider, enabled oauth2Login(), and read the authenticated user. Social login lets you offload password handling to trusted providers.