Common mistakes and misconceptions in Web App Security using OAuth 2.0 and OpenId Connect

on YouTube ↗01h 05m

" summary

Covers concrete pitfalls: authorization code interception and injection attacks and why PKCE is required for public and recommended for confidential clients; avoid implicit and password grants, use client_credentials for server-to-server; prefer IdentityServer4 for demos and implementations; use JWT access tokens with short lifetimes and consider refresh-token rotation to allow revocation; enforce exact redirect_uri matching, HTTPS everywhere, and treat scopes as hints—APIs must combine scopes with user privileges before granting permission.

AI-written summary · about

" chapters (23)

1. 0:00Intro
2. 2:05Authentication and Authorization
3. 3:02OAuth and OpenId Connect
4. 7:52Terminology
5. 10:37Client Type
6. 12:15Public Client
7. 13:58Scopes
8. 17:36Access Tokens
9. 18:45JSON Web Token
10. 22:48OAuth endpoints
11. 26:12OAuth grant types
12. 28:09OAuth grant best practices
13. 34:12Authorization code injection
14. 36:06Pixi
15. 40:17URI
16. 41:13HTTP Header
17. 43:01Reference Token
18. 44:05Refresh Token
19. 46:58OpenId Connect
20. 48:30OAuth Scopes
21. 51:10OAuth Connect Endpoints
22. 52:37OAuth Connect Hybrid
23. 55:21Use Cases

" related talks

• 01h 02mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC Oslo 2020
• 53mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC London 2020
• 59mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC Security Oslo 2020
• 39mSecuring your apps with OAuth2 and OpenID ConnectRoland Guijt · Codemotion Rome 2015
• 01h 02mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier · NDC Security Oslo 2019
• 01h 00mImplementing OpenID Connect and OAuth 2.0 – Tips from the TrenchesDominick Baier · NDC Security Oslo 2020
• 45mMastering OAuth 2.0 and OpenID ConnectLeonardo Micheloni · Codemotion Madrid 2025
• 01h 00mOAuth – the good PartsAnders Abel · NDC Security 2023