OAuth and beyond: Modern auth not only for the web
summary
Live demos show a pure HTML/JavaScript client talking to an open‑source Quarkus authorization server (playground available but not for production), implementing OAuth2 authorization code with PKCE, refresh tokens and short‑lived access tokens, plus a device code flow that polls a token endpoint using a device_code and user_code (examples use 180s expiry and configurable interval). A trusted‑device enrollment pattern for printers/IoT reduces phishing by issuing device tokens and sender‑constrained credentials. Passwordless is demonstrated via WebAuthn / passkeys using Windows Hello and Android syncing.
AI-written summary · about
chapters (9)
- 0:00Introduction and setup
- 3:03Problems with passwords
- 7:59Authorization code flow
- 12:38Security of OAuth flows
- 13:19Device authorization grant
- 21:45Trusted device enrollment
- 26:01Passwordless authentication
- 31:22WebAuthn and passkeys
- 41:22Summary and Q&A
related talks
18mPapers Please! A Non-Dystopian Look at Modern Authentication
46mOAuth for Java Developers
40mGoing passwordless with Web Authentication
21mNo browser, no password, no problem
55mYou Shall Not Password: Modern Authentication for Web Apps
44mThe Art of Authentication for Web Apps
39mZen and the art of edge authentication
30mStandards-based authentication for JavaScript sites