#oauth2

Ten years ago HTTPS wasn't as nearly as widespread as today. It is hard to believe that HTTPS was essentially opt-in, if available at all! Back then, people also had to get creative when inventing means to delegate access to someone else. One solution was OAuth 1, conceived by the IETF, later adopted by Tumblr in 2011.

Time went by, and here we are in 2021, with hardly any popular website not shielded with HTTPS (including your own blog!). Today, it wouldn't make much sense to adopt OAuth 1 as inconvenient as it is. Yet here we are, still asking people to use outdated protocols for their new fancy Tumblr apps. Not anymore!

Starting today, you have another option: we're officially opening up OAuth 2 support for the Tumblr API!

Get started

OAuth 2 flow requires you to know two key URIs:

For authorization requests, you should use /oauth2/authorize

To exchange authorization codes and refresh tokens, you'll need to use /v2/oauth2/token

If you're familiar with OAuth 2, register an application and check out our API documentation (specifically the section on OAuth 2) to get up and running.

The future of OAuth 1

There are no plans to shut down OAuth 1. Your app will continue to work as usual. But be sure to keep an eye on this blog just in case anything new pops up that would prevent us from serving OAuth 1 requests.

What's more, if you wish to adopt OAuth 2 in your app, given its superior simplicity, you don't have to migrate entirely to OAuth 2 at once. Instead, you can keep the old sign-up / log-in flow working, and exchange OAuth 1 access token to OAuth 2 tokens on the fly. There's only one catch: this exchange will invalidate the original access token, so you should be using only the OAuth 2 Bearer authentication for any subsequent requests.

Next steps

We'll be adding support for OAuth 2 to our API clients in the coming months. Follow this blog to learn firsthand when this happens.

Although we do support client-side OAuth 2 flow, we can't recommend using it unless absolutely required. We might harden it with PKCE someday, though.

How can refresh token rotation ensure that refresh tokens can be stored securely in single page web apps?

Some links for reference:

Why are Refresh Tokens considered insecure for an SPA? | SA

What is the purpose of a "Refresh Token"? | SA

What Are Refresh Tokens and How to Use Them Securely | auth0

Beyond the Perimeter: Implementing Zero Trust API Security Patterns in 2026

Traditional gateway security is shifting toward decentralized, identity-aware patterns. We analyze the trade-offs between mTLS, modern JWT rotation, and edge-side rate limiting for scalable software delivery.

The Modern Challenge of API Security

In today’s interconnected digital world, enterprise portals like Liferay DXP have evolved from simple content hubs into powerful integration platforms. They often communicate with mobile applications, external systems, and microservices through APIs. This flexibility enhances functionality but also increases the potential for security vulnerabilities if remote services are not properly secured.

Understanding Liferay Remote Services

Liferay’s remote services enable external systems to call internal portal logic, such as retrieving or updating data. These services are typically accessible through endpoints. When not adequately protected, these endpoints can expose sensitive operations and data, leaving your portal vulnerable to misuse.

The Role of OAuth2 in Securing APIs

OAuth2 provides a modern and secure way to manage authentication and authorization for remote access. Instead of using traditional credentials, OAuth2 issues access tokens that verify a client’s identity and permissions. These tokens can be restricted by scopes to define exactly which actions a client can perform. This ensures that even if multiple clients interact with your Liferay portal, each can only access what it is explicitly authorized to use.

Enforcing Authorization with Service Access Policies

Service Access Policies, or SAPs, are another powerful layer of security within Liferay. They allow administrators to define which specific service methods are accessible remotely. By configuring SAPs, you can whitelist only the necessary APIs, effectively blocking all unauthorized service calls. This combination of OAuth2 and SAPs provides both broad and fine-grained control over your remote service access.

How to Secure Liferay Remote Services

Start by enabling remote services in your Liferay module using the remote-service="true" attribute in your service configuration. Once deployed, move to the Liferay Control Panel and set up Service Access Policies for your desired endpoints. Disable the default open-access policy and define precise rules that grant access only to trusted clients. Next, configure OAuth2 by creating client applications under OAuth2 Administration. Assign specific scopes corresponding to the SAPs you’ve defined. When an external system requests access, it must first obtain a valid token using the OAuth2 credentials. This ensures that only authenticated and authorized requests can reach your services.

Best Practices for Maintaining Security

Always prefer OAuth2 over basic authentication or open endpoints

Whitelist only the essential service methods through SAPs

Regularly audit logs for suspicious activity

Periodically rotate OAuth2 client secrets

Enforce HTTPS for all API communication

Conclusion

Securing remote services is not just a technical necessity—it’s a strategic safeguard for your organization’s data and reputation. By combining OAuth2 authentication with Service Access Policies, Liferay administrators can confidently expose remote services without compromising security. This dual-layered protection ensures that only verified and authorized applications can access specific APIs, keeping your digital ecosystem both flexible and safe.

These 2 website illustrate the OAuth2 and openid connect flow so that you can explain it to anyone very simply!

https://developer.okta.com/blog/2019/10/21/illustrated-guide-to-oauth-and-oidc

https://engineering.backmarket.com/oauth2-explained-with-cute-shapes-7eae51f20d38

Securing Headless APIs with OAuth2 in Liferay DXP: A Complete Guide

 iOS 18.3.1

WOM: Restaurant Discovery app for iOS (version 2.4.0)

03/03/2025

Description:

The WOM: Restaurant Discovery app for iOS has a problem. The WOM: Restaurant Discovery app has a Google OAuth screen. 

Unfortunately, on this Google OAuth consent screen, the app name is incorrect. Instead of displaying an app name appropriate to the app, an app name of: "wom.auth.us-east-1.amazoncognito.com" appears.

Here's a screenshot of how it currently appears:

Steps to Reproduce:

1. Download and launch the WOM: Restaurant Discovery app for iOS

2. Select the app icon in the upper right of the screen

3. Select "Sign Up"

4. From the "Sign Up" pop-up menu, select "Google"

5. On the Google Sign in screen, note the app name of: "wom.auth.us-east-1.amazoncognito.com"

Result: The Google OAuth consent screen displayed by the WOM: Restaurant Discovery app displays an app name of: "wom.auth.us-east-1.amazoncognito.com"Expected: An app name of "wom.auth.us-east-1.amazoncognito.com" isn't user friendly and doesn't provide relevant information to the end user

After launching the iOS app, select "Sign Up"

Select the "Google" option...