# OAuth2와 Authorization Server (Spring Boot)

> OAuth2와 Authorization Server, 플로우(authorization code, client credentials), resource server, scopes

- 20 면접 질문
- Senior
- [면접 질문: Spring Boot](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions.md)

## 1. OAuth2란 무엇인가요?

**답변**

OAuth2는 사용자의 credentials를 노출하지 않고도 서드파티 애플리케이션이 사용자를 대신하여 HTTP 서비스에 제한된 접근 권한을 얻을 수 있도록 하는 인가 프로토콜입니다. 비밀번호 대신 access token을 통해 작동합니다. OAuth2는 위임 인증(Google, GitHub 등을 통한 로그인)과 보안 REST API에 널리 사용됩니다.

## 2. 웹 애플리케이션에 가장 안전한 OAuth2 플로우는 무엇인가요?

**답변**

Authorization Code flow는 access token이 브라우저에 노출되지 않기 때문에 가장 안전한 플로우입니다. 백엔드 애플리케이션은 보안 채널(backend-to-backend)을 통해 임시 authorization code를 access token으로 교환합니다. PKCE(Proof Key for Code Exchange)를 사용하면 이 플로우는 가로채기 공격에 대해 더욱 안전해집니다.

## 3. Client Credentials flow는 어떤 경우에 사용해야 하나요?

**답변**

Client Credentials flow는 사용자 컨텍스트가 없는 machine-to-machine(service-to-service) 통신을 위해 설계되었습니다. 클라이언트 애플리케이션은 자체 credentials(client_id 및 client_secret)로 직접 인증하여 access token을 얻습니다. 배치 작업, 마이크로서비스 또는 자체 명의로 동작하는 백엔드 API에 사용됩니다.

## 17개 추가 질문 이용 가능

- OAuth2에서 PKCE(Proof Key for Code Exchange)란 무엇인가요?
- OAuth2에서 Implicit flow가 더 이상 권장되지 않는 이유는 무엇인가요?

무료로 가입하기: https://sharpskill.dev/ko/login

## 기타 Spring Boot 면접 주제

- [Spring Core - IoC & DI](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/spring-core-ioc-di.md): 22개 질문, Junior
- [Spring Boot Auto-Configuration](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/spring-boot-auto-configuration.md): 20개 질문, Junior
- [Spring Boot Starters](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/spring-boot-starters.md): 18개 질문, Junior
- [Application Properties & YAML](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/application-properties-yml.md): 16개 질문, Junior
- [SLF4J 및 Logback을 사용한 로깅](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/logging.md): 20개 질문, Junior
- [Spring Boot DevTools](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/spring-boot-devtools.md): 15개 질문, Junior
- [Spring MVC Basics](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/spring-mvc-basics.md): 20개 질문, Mid-Level
- [Spring REST Controllers](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/spring-rest-controllers.md): 20개 질문, Mid-Level
- [Request & Response Handling](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/request-response-handling.md): 20개 질문, Mid-Level
- [예외 처리](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/exception-handling.md): 25개 질문, Mid-Level
- [Bean Validation](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/bean-validation.md): 25개 질문, Mid-Level
- [Spring Data JPA 기초](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/spring-data-jpa-basics.md): 25개 질문, Mid-Level
- [JPA 엔티티 및 관계](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/jpa-entities-relationships.md): 30개 질문, Mid-Level
- [JPA 쿼리](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/jpa-queries.md): 30개 질문, Mid-Level
- [Spring Data Repositories](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/spring-data-repositories.md): 25개 질문, Mid-Level
- [Spring Security 기초](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/spring-security-basics.md): 25개 질문, Mid-Level
- [Spring Boot Actuator](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/spring-boot-actuator.md): 20개 질문, Mid-Level
- [JUnit과 Mockito를 사용한 단위 테스트](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/testing-junit-mockito.md): 30개 질문, Mid-Level
- [Spring Boot 테스트](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/spring-boot-testing.md): 30개 질문, Mid-Level
- [Profiles와 Environment](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/profiles-environment.md): 20개 질문, Mid-Level
- [RestTemplate 및 WebClient](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/resttemplate-webclient.md): 24개 질문, Mid-Level
- [Async와 스케줄링](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/async-scheduling.md): 25개 질문, Mid-Level
- [Spring을 사용한 캐싱](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/caching.md): 25개 질문, Mid-Level
- [Spring WebFlux (리액티브)](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/spring-webflux.md): 25개 질문, Mid-Level
- [Spring 트랜잭션](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/transactions.md): 30개 질문, Senior
- [고급 인증 및 인가](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/authentication-authorization.md): 30개 질문, Senior
- [JWT 및 스테이트리스 보안](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/jwt-stateless-security.md): 20개 질문, Senior
- [Spring Boot와 Docker](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/spring-boot-docker.md): 19개 질문, Senior
- [Spring을 활용한 마이크로서비스](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/microservices-basics.md): 25개 질문, Senior
- [Spring Cloud Config](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/spring-cloud-config.md): 19개 질문, Senior
- [성능 최적화](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/performance-optimization.md): 30개 질문, Senior
- [GraalVM Native Images](https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/graalvm-native-images.md): 20개 질문, Senior

---

Source: SharpSkill (https://sharpskill.dev), tech interview preparation for your real stack.
HTML version of this page: https://sharpskill.dev/ko/technologies/spring-boot/interview-questions/oauth2-authorization-server