Building Clients for OpenID Connect/OAuth 2-based Systems
summary
Covers concrete choices and tradeoffs: recommends authorization code with PKCE for public clients, forbids no embedded login dialogs in native apps, and advises secure OS-backed storage on mobile rather than localStorage. For SPAs recommends a Backend-for-Frontend that keeps refresh tokens on the server and issues short-lived access tokens to the browser. Describes using SameSite/httpOnly cookies for cookie-based session refresh, outlines token lifetime and rotation strategies, and shows which patterns are practical and which lead to token leakage.
AI-written summary · about
chapters (17)
- 0:00Client challenges in OAuth 2
- 2:14OpenID Connect standards
- 6:00Client solutions for identity
- 10:14User sessions and management
- 15:03OIDC flow and tokens
- 19:14Token refresh strategies
- 24:03Public clients for mobile/web
- 28:00Native app login security
- 31:58Browser-based applications and user experience
- 37:08Web vs native client differences
- 40:28Security risks in browsers
- 44:55JavaScript security limits
- 48:15XSS risks in frameworks
- 51:28Browser security trade-offs
- 54:18Refresh tokens and sessions
- 58:22XSS and proxy risks
- 1:00:19Q&A
related talks
01h 00mBuilding Clients for OpenID Connect/OAuth 2-based Systems
57mBuilding Clients for OpenID Connect/OAuth 2-based Systems
01h 02mBuilding Clients for OpenID Connect/OAuth 2-based Systems
59mSecuring Web APIs from JavaScript/SPA Applications
58mBuilding JavaScript and mobile/native Clients for Token-based Architectures
01h 00mImplementing OpenID Connect and OAuth 2.0 – Tips from the Trenches
37mOAuth2 and OpenID Connect for Single Page Applications
58mOAUTH, OPENID CONNECT & .NET – THE GOOD PARTS