OAuth2 and OpenID Connect for Single Page Applications

on YouTube ↗37m

" summary

Covers secure OAuth 2.0/OpenID Connect patterns for Single Page Applications: move away from implicit flow to Authorization Code Flow with PKCE, use short-lived access tokens (5–10 minutes), and implement browser-safe refresh logic including refresh token rotation. Demonstrates a restaurant-review SPA using an identity provider, recommended SDKs, and a Backend-for-Frontend proxy to keep secrets out of the browser while detecting and invalidating stolen refresh tokens.

AI-written summary · about

" chapters (9)

1. 0:00OAuth2 and OIDC intro
2. 5:03Implicit flow in SPAs
3. 8:55Authorization code with PKCE
4. 12:49OAuth2 and OIDC examples
5. 19:39Q&A
6. 23:13Refresh token risks
7. 28:14XSS and token protection
8. 32:09Storing tokens securely
9. 35:20Summary and tips

" related talks

• 59mSecuring Web APIs from JavaScript/SPA ApplicationsBrock Allen · NDC Oslo 2019
• 01h 01mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier · NDC Copenhagen 2019
• 57mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier, Brock Allen · NDC Porto 2019
• 39mSecuring your apps with OAuth2 and OpenID ConnectRoland Guijt · Codemotion Rome 2015
• 28mOAuth 2.0 and OIDCSara Daqiq · Silicon Valley Code Camp 2018
• 46mOAuth2/OIDC best practices conjugated in present, past simple and futureMathieu Humbert · Devoxx France 2021
• 01h 02mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier · NDC Security Oslo 2019
• 31mAuthentication with OpenID Connect in Angular ApplicationsPhilippe De Ryck · NG-BE 2019