What does "offline" access in OAuth mean?
What exactly does the word "offline" mean with regard to the offline access granted by an OAuth server?
Does it mean that the resource server will return data about the user even when the user is logged out of the third-party application or when the user is logged out of the OAuth resource server such as Facebook or Google or Twitter?
Answer
Offline access is IMO a really bad name for it, and I think its a term only Google uses its not in the RFC for OAuth as far as I remember.
What is Google offline access?
When you request offline access the Google Authentication server returns a refresh token. Refresh tokens give your application the ability to request data on behalf of the user when the user is not present and in front of your application.
Example of an app needing offline access
Let's say I have a Super Awesome app that downloads your Google Analytics Data, makes it into a nice PDF file and emails it to you every morning with your stats. For this to work my application needs to have the ability to access your Google Analytics data when you are not around, to give me permission to do that. So Super Awesome app would request offline access and the authentication server would return a refresh token. With that refresh token Super awesome app can request a new access token whenever it wants and get your Google Analytics data.
Example of an app not needing offline access
Let's try Less Awesome app that lets you upload files to Google Drive. Less Awesome app doesn't need to access your Google drive account when you're not around. It only needs to access it when you are online. So in theory it wouldn't need offline access. But in practice it does, it still gets a refresh token so that it wont have to ask you for permission again (this is where I think the naming is incorrect).
Helpful quote from the OpenStack documentation:
If a refresh token is present in the authorization code exchange, then it can be used to obtain new access tokens at any time. This is called offline access, because the user does not have to be present at the browser when the application obtains a new access token.
The truth about offline access
The thing is that in a lot of cases the authentication server will return the refresh token to you no matter what you don't have to actually ask for anything it gives it to you. Giving you the ability to access the users data when they aren't around. Users don't know that you could access their data without them being there. It's only the JavaScript library and I think the PHP library that hide the refresh token from you but, it's there.
Example
By just posting (i.e. HTTP POST request):
https://accounts.google.com/o/oauth2/token code={AuthCode}&client_id={ClientId}.apps.googleusercontent.com&client_secret={ClientSecret}&redirect_uri=urn:ietf:wg:oauth:2.0:oob&grant_type=authorization_code
Here is the response:
{
"access_token": "ya29.1.AADtN_VSBMC2Ga2lhxsTKjVQ_ROco8VbD6h01aj4PcKHLm6qvHbNtn-_BIzXMw",
"token_type": "Bearer",
"expires_in": 3600,
"refresh_token": "1/J-3zPA8XR1o_cXebV9sDKn_f5MTqaFhKFxH-3PUPiJ4"
}
I now have offline access to this users data, and I never told them that I would have it.
More details be found in this short article: Google 3 legged OAuth2 flow.