Securing your apps with OAuth2 and OpenID Connect

on YouTube ↗39m

" summary

Explains why classic username/password pages fail for modern SPAs and native apps, demonstrates a .NET stack using IdentityServer3 and sample .NET clients, and shows tokens issued as JSON Web Token (JWT) with discoverable public keys, a revoke page and support for authorization code, implicit and hybrid flows. Covers refresh tokens (offline_access scope), token claims and scopes, how the resource server validates tokens, and a live demo calling a protected API.

AI-written summary · about

" chapters (7)

1. 0:00Introduction and speaker intro
2. 0:46Problem with current authentication
3. 10:50OAuth2 roles and token flow
4. 20:13OAuth2 flows explained
5. 25:36OpenID Connect benefits
6. 30:18Demo of IdentityServer
7. 36:26Q&A session

" related talks

• 59mSecuring Web APIs from JavaScript/SPA ApplicationsBrock Allen · NDC Oslo 2019
• 01h 05mCommon mistakes and misconceptions in Web App Security using OAuth 2.0 and OpenId ConnectNahid Farrokhi · NDC Sydney 2020
• 57mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier, Brock Allen · NDC Porto 2019
• 58mBuilding JavaScript and mobile/native Clients for Token-based ArchitecturesDominick Baier, Brock Allen · NDC London 2017
• 01h 02mModern AuthenticationRob Moore · NDC Sydney 2016
• 58mOAUTH, OPENID CONNECT & .NET – THE GOOD PARTSAnders Abel · NDC London 2024
• 37mOAuth2 and OpenID Connect for Single Page ApplicationsPhilippe De Ryck · OWASP Global AppSec Virtual 2020
• 01h 00mOAuth – the good PartsAnders Abel · NDC Security 2023