OAuth – the good Parts
summary
OAuth history condenses to concrete advice: prefer OAuth 2.0 (2.1 consolidates bad options), use only two flows in most cases — client_credentials for machine‑to‑machine and authorization code + PKCE for interactive apps — issue short‑lived access tokens (demo shows ~1 hour and one case 200s), use refresh tokens for background renewal and revocation, validate JWTs (signature algorithm not “none”, issuer, audience, scope), avoid full SPA auth in the browser and instead use a BFF/server‑side approach, demos use IdentityServer, .NET/IdentityModel and jwt.io for token inspection.
AI-written summary · about
chapters (9)
- 0:00Start
- 10:48OAuth Architecture and Terminology
- 14:31Example: GitHub Scopes
- 18:04Access Token Processing Rules
- 25:28Token Management
- 28:05Overview
- 40:16Application Architectures
- 46:26Not Browser-based Applications
- 54:03Further Reading
