OpenID Connect & OAuth 2.0 – Security Best Practices

on YouTube ↗59m

" summary

OAuth must drop risky flows: disable implicit & password grants and prefer authorization code + PKCE for all interactive clients. Require exact redirect URI matching and ban open redirects and third‑party code on callback pages; use state correlated to a signed cookie to prevent mix‑up attacks. For machine clients use sender‑constrained secrets (mutual TLS or signed client assertions). Treat browser tokens cautiously: consider same‑site cookies, short lifetimes, refresh‑token rotation, and adopt pushed authorization requests (PAR) where possible.

AI-written summary · about

" chapters (28)

1. 0:00Intro
2. 4:06Some Context...
3. 9:16Simplified
4. 9:56Attack Model (1)
5. 14:40Implicit Flow Request
6. 15:06Implicit Flow Response
7. 16:22No more Password Grant
8. 17:49Grand Unification
9. 18:34Machine to Machine
10. 18:57Client Authentication
11. 21:09Sender Constrained Access Tokens w/ MTLS
12. 24:47Interactive Applications
13. 26:36Redirect URI Validation Attacks
14. 29:19Credential Leakage via Referrer Headers
15. 29:58Authorization Code Injection
16. 30:58Mitigation: Proof key for Code Exchange
17. 33:09Countermeasures Summary
18. 33:59Mix Up Attack (Variant 1)
19. 38:46How does ASP.NET Core prevent Mix Up Attacks?
20. 40:35Public Clients
21. 41:49Anti Pattern: Native Login Dialogs
22. 43:33Using a browser with Code Flow + PKCE
23. 44:03Different Approaches
24. 48:05Anti-Forgery Protection
25. 51:58Refresh Token Storage in Browsers
26. 53:01What's next?
27. 55:18JWT Secured Authorization Requests (JAR)
28. 56:17Pushed Authorization Requests (1)

" related talks

• 53mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC London 2020
• 01h 02mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC Oslo 2020
• 01h 05mCommon mistakes and misconceptions in Web App Security using OAuth 2.0 and OpenId ConnectNahid Farrokhi · NDC Sydney 2020
• 01h 02mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier · NDC Security Oslo 2019
• 47mIntroduction to OAuth 2.0 and OpenID ConnectPhilippe De Ryck · GOTO Berlin 2018
• 54mOAuth – the good PartsDominick Baier · NDC Oslo 2021
• 46mOAuth2/OIDC best practices conjugated in present, past simple and futureMathieu Humbert · Devoxx France 2021
• 58mOAUTH, OPENID CONNECT & .NET – THE GOOD PARTSAnders Abel · NDC London 2024