OpenID Connect & OAuth 2.0 – Security Best Practices

on YouTube ↗01h 02m

" summary

Overview of concrete fixes and attacks: RFCs and BCPs converge into OAuth 2.1 with implicit and password grants deprecated and PKCE mandatory for code flow; recommends asymmetric client auth (private_key_jwt), JWT hardening, refresh-token rotation or sender-constraining, and avoiding tokens in URLs. Walks through real incidents (an EA subdomain takeover example and referrer leakage to Facebook/GitHub), shows a BFF (Backend For Frontend) recommendation, and points to ASP.NET Core and browser features as practical mitigations.

AI-written summary · about

" chapters (34)

1. 0:00Intro
2. 1:05High Security OAuth
3. 5:36Some Context...
4. 11:51Relevant Documents
5. 12:16The Big Picture
6. 12:55Simplified
7. 13:57Attack Model (3)
8. 19:02Implicit Flow Request
9. 19:29Implicit Flow Response
10. 20:39No more Password Grant
11. 21:42Original Flows
12. 22:31Grand Unification
13. 22:58Machine to Machine
14. 25:32Client Authentication
15. 27:42Bearer Tokens
16. 29:30Interactive Applications
17. 31:03Redirect URI Validation Attacks
18. 35:26Credential Leakage via Referrer Heade
19. 36:44Authorization Code Injection
20. 38:07Mitigation: Proof key for Code Exchan
21. 39:38Cross Site Request Forgery
22. 41:15Countermeasures Summary
23. 41:45MixUp Attack (Variant 1)
24. 46:00Mix Up Countermeasures
25. 47:47Public Clients
26. 48:23Anti Pattern: Native Login Dialogs
27. 49:20Using a browser with Code Flow + PKG
28. 49:56Different Approaches
29. 51:24Token Storage & Management
30. 52:06Browser-based Applications aka SPA
31. 54:47Same-Site Architecture
32. 55:22Anti-Forgery Protection
33. 56:19Access Token Storage in Browsers
34. 58:25OAuth 2.1

" related talks

• 53mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC London 2020
• 59mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC Security Oslo 2020
• 01h 05mCommon mistakes and misconceptions in Web App Security using OAuth 2.0 and OpenId ConnectNahid Farrokhi · NDC Sydney 2020
• 01h 02mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier · NDC Security Oslo 2019
• 01h 00mOAuth – the good PartsAnders Abel · NDC Security 2023
• 29mFireside Chat About OAuth 2.0Aaron Parecki, Eric Johnson · GOTOpia February 2021
• 01h 00mImplementing OpenID Connect and OAuth 2.0 – Tips from the TrenchesDominick Baier · NDC Security Oslo 2020
• 47mHacking OAuthAaron Parecki · Developer Summit 2020