Knock knock, who's there? Authenticating your single page apps using JSON Web Tokens
summary
Explains JWT structure as header.payload.signature (base64 JSON header, payload claims, signature) and shows a demo SPA that uses an ID token to display user info and an access token to successfully fetch protected cat pictures. Recommends OpenID Connect over raw OAuth2 for identity, avoids the implicit flow and uses authorization code + PKCE, stores tokens in memory with silent renewal via an HTTP-only cookie iframe, warns about token invalidation requiring blacklists, no sensitive data in JWTs, and suggests short access lifetimes (example: ~10 minutes) and refresh token rotation.
AI-written summary · about
chapters (12)
- 0:00Introduction and speaker intro
- 2:16Traditional web authentication
- 7:14What is a token
- 14:40JSON Web Token breakdown
- 19:53Live demo of token authentication
- 24:55Token-based auth for SPAs
- 29:11OAuth 2.0 and OpenID Connect
- 31:23Access tokens vs ID tokens
- 32:26Refresh tokens in SPAs
- 34:11Solving CORS and state issues
- 35:37Summary and best practices
- 36:22Q&A session
related talks
29mKnock knock, who's there? Authenticating your single page apps using JSON Web Token
22mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
37mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
40mKnock knock, who’s there? Authenticating your single page apps using JSON Web Tokens
34mAuthenticating your single page apps using JSON Web Tokens
25mHow JSON Web Tokens Work and Can be Used to Secure Your Single Page Apps
26mSecuring Single Page Applications with Token Based Authentication
24mA Token Walks Into a SPA