Papers Please! A Non-Dystopian Look at Modern Authentication
summary
Covers concrete OAuth2 patterns for four real scenarios: server‑rendered web apps use the authorization code flow to exchange a code for tokens then issue a session cookie; API‑to‑API uses client_credentials with client_id and client_secret; single‑page apps historically use implicit with silent iframe renewal but the IETF now implicit flow deprecated; native and mobile use authorization code + PKCE. Explains access, refresh, ID tokens (JWTs or opaque), token lifetimes, and when to validate locally versus introspect.
AI-written summary · about
chapters (13)
- 0:00Introduction and speaker intro
- 1:47Modern authentication complexity
- 3:54OAuth 2.0 overview and roles
- 5:59Token types and their purposes
- 7:05OAuth 2.0 flows introduction
- 7:47Web apps authentication flow
- 9:15API-to-API authentication
- 10:48Single page app authentication
- 13:39Implicit flow security risks
- 14:43Native app authentication flow
- 15:51Choosing the right flow
- 16:54Benefits of OAuth 2.0
- 17:19Token validation and Q&A
related talks
44mThe Art of Authentication for Web Apps
59mSecuring Web APIs from JavaScript/SPA Applications
37mOAuth2 and OpenID Connect for Single Page Applications
46mOAuth2/OIDC best practices conjugated in present, past simple and future
46mA Deep Dive into the Past, Present & Future of OAuth
01h 00mOAuth – the good Parts
01h 01mBuilding Clients for OpenID Connect/OAuth 2-based Systems
58mOAUTH, OPENID CONNECT & .NET – THE GOOD PARTS