Bearer of Good News
summary
OAuth 2.1 consolidates fixes: PKCE mandatory, exact redirect matching, one‑time refresh tokens and HTTPS only; DPoP binds access and refresh tokens to per‑client cryptographic keys so stolen tokens are useless; CIBA enables asynchronous backchannel approvals for IoT, call centers and high‑value transactions; authorization server metadata and client ID metadata remove manual config; Token Exchange issues narrowly scoped tokens for downstream services and Cross‑App Access (ID_JWT “ID Jack”) lets one IDP assert a user to another when both trust each other.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 0:44What we will cover in this talk
- 3:51OAuth 2.0 foundations
- 15:27OAuth 2.1 changes
- 17:13PKCE mandatory
- 20:02Deprecated flows
- 22:04DPoP proof
- 27:17CIBA authentication
- 29:44Server metadata
- 31:29Client registration
- 33:34Client metadata
- 35:40Token exchange
- 37:45Cross-app access
- 41:39Practical guidance
- 42:41Resources
- 43:43Q&A
