OAuth – the good Parts
summary
OAuth has settled on a small set of practical rules: the ecosystem centers on two flows — client credentials flow for machine‑to‑machine and authorization code with PKCE for user interactions — tokens are opaque to clients and carried as Bearer in the Authorization header, refresh tokens renew 1‑hour access tokens without user interaction, and 401 vs 403 have distinct meanings. OAuth 2.1 trims legacy options, OpenID Connect supplies an id token (authentication response) for identity, and RFC 7009 defines revocation.
AI-written summary · about
chapters (22)
- 0:00Start
- 4:54Some History
- 12:19OAuth Architecture and Terminology
- 17:19Example: GitHub Scopes
- 19:47Client Credentials Flow
- 20:12Protocol Flow
- 21:15JWT Access Tokens
- 22:32Use Token
- 24:04Access Token Processing Rules
- 28:15Authorization Code Flow
- 29:10Overview
- 30:35Front-Channel Request
- 32:12Consent (if required)
- 35:48User-Centric Access Tokens
- 37:49Token Management
- 39:28Refreshing an Access Token (2)
- 41:41Token Revocation
- 42:32Application Architectures
- 44:13Not Browser-based Applications
- 47:12User Authentication - the Problem
- 50:49Authentication Response (id_token)
- 53:15Summary
