How to develop to be compliant with OAuth 2.1 out of the gate
summary
OAuth 2.1 narrows OAuth 2.0 to concrete rules: PKCE is required for all authorization-code clients, wildcard redirect URIs are banned so authorization servers must do exact string matching, implicit and resource-owner password grants are removed, bearer tokens must not appear in query strings, and refresh tokens for public clients must be sender‑constrained or one‑time use. Demo uses .NET 5 and IdentityServer4 to switch an implicit flow to authorization code + PKCE, show exact redirect registration, obtain and use refresh tokens, and call an API with the access token.
AI-written summary · about
chapters (8)
- 0:00Start
- 5:59OAuth 2.0 Terminology
- 15:22Authorization Code Interception Attack
- 18:27Proof key for Code Exchange
- 23:00Implicit Grant
- 25:27Password Grant
- 27:40OAuth 2.1 Grant Types
- 28:19Refresh Token
related talks
58m“OAuth 2.1” and beyond
01h 02mOpenID Connect & OAuth 2.0 – Security Best Practices
01h 05mCommon mistakes and misconceptions in Web App Security using OAuth 2.0 and OpenId Connect
01h 00mOAuth – the good Parts
46mOAuth2/OIDC best practices conjugated in present, past simple and future
59mOpenID Connect & OAuth 2.0 – Security Best Practices
25mOAuth 2.1: The Future of API Security
01h 02mBuilding Clients for OpenID Connect/OAuth 2-based Systems