OAuth2 on a national level - how to secure extremely sensitive apis

on YouTube ↗59m

" summary

HelseID is a national OAuth-based token service in production since 2017 used across thousands of Norwegian health organizations; baseline OAuth is declared insufficient so a narrow security profile enforces confidential clients, rejects implicit/hybrid flows, mandates PKCE and signed client keys, and moves toward DPoP (with mutual TLS as an alternative) to bind tokens to clients. Every integration requires a code review, test and production onboarding, GitHub samples, and ongoing penetration testing; the service is live and actively trusted.

AI-written summary · about

" chapters (19)

1. 0:00OAuth2 on a national scale
2. 2:28Sensitive APIs?
3. 4:16The Norwegian health sector
4. 9:11But what is the problem?
5. 10:01alternatives
6. 11:25Securing an API is easy
7. 16:51The HelseID security profile
8. 18:42OAuth 2.1
9. 21:29FAPI 2.0 security profile
10. 23:19Standard web security
11. 25:22Only confidential clients
12. 29:46Keypairs only
13. 32:05Strict requirements regarding signing algorithms
14. 33:23Only one way to use the protocols
15. 46:42USE A LIBRARY!
16. 48:24code reviews
17. 49:50self-service setup
18. 51:25the core service
19. 52:40In summary

" related talks

• 01h 03mHelseIDRune Andreas Grimstad, Dag Helge Østerhagen · NDC Security 2022
• 01h 00mHelseID Introducing Modern Web Security in a Geriatric Health SectorRune Andreas Grimstad, Dag Helge Østerhagen · NDC Oslo 2021
• 57mDeath by downtimeRune Andreas Grimstad, Dag Helge Østerhagen · NDC Oslo 2022
• 01h 01mSharing Health Information Through APIsSteinar Noem · NDC Security 2022
• 54mOAuth – the good PartsDominick Baier · NDC Oslo 2021
• 28mBringing FIDO2 to National IdentityHeikki Palm Henriksen, Helge Tesdal · Authenticate 2022
• 59mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC Security Oslo 2020
• 27mIntegrating API Security Into A Comprehensive Identity PlatformPamela Dingle, Pam Dingle · Nordic APIs World Tour 2015