Securing an API Ecosystem with OAuth 2 0
summary
Concrete rules and tradeoffs: use the authorization code grant with PKCE for any user flows and the client credentials grant for machine-to-machine; prefer short-lived JWT access tokens and refresh tokens for long‑term access or use reference tokens plus introspection when immediate revocation matters; always validate signature exp issuer and aud and never accept identity tokens at the API; enforce function and object level checks using the sub claim and match tenant IDs in the token against URL or request parameters to avoid authorization bypass.
AI-written summary · about
chapters (21)
- 0:00Securing APIs with OAuth 2.0
- 1:06OAuth 2.0 for API security
- 3:52Secure API access with OAuth 2.0
- 5:55OAuth 2.0 in action
- 9:48OAuth vs OpenID Connect
- 12:16Machine-to-machine access
- 14:22User access with authorization code
- 17:53Refresh tokens for long-term access
- 19:57OAuth token misuse pitfalls
- 21:02Access tokens: reference vs self-contained
- 26:37Authorization with token claims
- 31:10OAuth scopes and permissions
- 36:01Fine-grained authorization claims
- 36:48Broken object-level authorization and how to fix it
- 40:23Multi-tenant authorization
- 43:14Avoiding authorization bypasses
- 46:23Secure OAuth 2.0 takeaways
- 47:51Additional resources
- 48:33Q&A: Machine-to-machine tokens
- 51:23Q&A: API gateways in token validation
- 53:07Q&A: When not to use OAuth 2.0
related talks
54mOAuth – the good Parts
25mOAuth 2.1: The Future of API Security
01h 00mOAuth – the good Parts
50mHow to develop to be compliant with OAuth 2.1 out of the gate
01h 02mOAuth in 2021 – What’s up?
59mOpenID Connect & OAuth 2.0 – Security Best Practices
58m“OAuth 2.1” and beyond
27mThe Nuts and Bolts of API Security: Protecting Your Data at All Times