Service provider (server)

If you want to allow other sites and programs to get your site's data, just as Flickr allows other sites to get photos, you will be a Service provider (or Service Server). Using modules like Services or Web Services, you might select what kind of service you want to provide.

However, as you start to think about Web Services, you might wonder about security. Drupal has its own security system: the user permission. When an user tries to access a given page, Drupal checks if the user has the permission to do so.

But What about Web Services, when the user doesn't access the site directly. Instead, a third party tries to get the user resources in his behalf? The most common solution is to give to this third party site the login and password, so it can access your site just like the user himself. But it might be a very deep security problem, because you are asking your users to share their login and password with strangers.

So how to check if the external site was allowed by the user to get his photos, user details or any other service you offer? OAuth might be the solution!

Basically, it creates some special keys that link the user, the consumer (the third party site), service that the user authorized the consumer to perform and the duration. That way, you might let a site that print photos to get the Flickr photos for just two days for example. Flickr you not allow the site to delete any photo or to get photos after the duration. It adds an extra layer of security.

OAuth is used by giants like Google, Yahoo, Flickr and Twitter. And you might use the same level of security as they use! Its an international standard and constantly developed.