The Art of Authentication for Web Apps
summary
Covers concrete OAuth2/OIDC mechanics: why OAuth replaces credential sharing, the authorization code flow with authorization code with PKCE, ID tokens as JWTs with three segments and RS256 signatures, and access tokens + scopes for APIs. Shows cookie-based sessions for same‑domain server apps, token storage in memory for SPAs, and using refresh token rotation (with reuse detection) to safely support long sessions despite ITP blocking third‑party cookies. Dates and examples include OAuth 1.0 (Dec 2007) and the HireMe/MyCal scenario.
AI-written summary · about
chapters (11)
- 0:00Introduction to authentication
- 2:55Digital identity and authentication
- 4:40Why OAuth was created
- 7:11OAuth 2.0 delegated authorization
- 12:12OpenID Connect for authentication
- 14:18JSON Web Tokens explained
- 21:44Access tokens and scopes
- 28:25Authentication in traditional web apps
- 30:52Single page app authentication
- 37:56Token use in JavaScript apps
- 42:35Closing and resources
related talks
18mPapers Please! A Non-Dystopian Look at Modern Authentication
01h 00mOAuth – the good Parts
59mSecuring Web APIs from JavaScript/SPA Applications
58mOAUTH, OPENID CONNECT & .NET – THE GOOD PARTS
01h 01mBuilding Clients for OpenID Connect/OAuth 2-based Systems
49mUnderstanding OAuth 2.0 & OIDC
58mOAuth – the good Parts
46mA Deep Dive into the Past, Present & Future of OAuth