OAuth2/OIDC best practices conjugated in present, past simple and future

on YouTube ↗46m

" summary

Covers practical OAuth2/OIDC implementation guidance: why Implicit Flow is deprecated and Authorization Code with PKCE should be used for SPAs, mobile apps and backends to prevent token/code theft. Recommends avoiding refresh tokens for public clients, requiring exact redirect_uri matches, using standard OAuth/OIDC libraries, publishing and rotating keys via JWKS, handling JWTs cautiously (they don’t automatically solve server-side authorization), and notes GNAP and WebAuthn as emerging technologies to watch.

AI-written summary · about

" chapters (15)

1. 0:00Start
2. 0:55The Starting Problem
3. 2:08Obtaining Access Authorization to Contacts
4. 5:33Security
5. 7:36Token
6. 9:10Client Authentication
7. 18:55Multiple Server Authorizations
8. 19:47Using Standard Libraries
9. 21:52Standard Fields
10. 23:48The GWT
11. 25:52Key Rotations
12. 27:27The JWT
13. 29:49The Future
14. 35:01Q&A
15. 43:22Conclusion

" related talks

• 50mOAuth2/OIDC best practices in the present, past simple and futureMathieu Humbert · Sunny Tech 2022
• 49mUnderstanding OAuth 2.0 & OIDCStephanie Chamblee · Connect.Tech 2021
• 01h 02mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC Oslo 2020
• 01h 00mOAuth – the good PartsAnders Abel · NDC Security 2023
• 01h 02mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier · NDC Security Oslo 2019
• 59mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC Security Oslo 2020
• 53mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC London 2020
• 25mOAuth 2.1: The Future of API SecurityRob Allen · phpday 2025