OAuth2/OIDC best practices in the present, past simple and future
summary
Covers current best practices for OAuth2, OAuth2.1 and OpenID Connect by tracing their origins, concepts and the problems they solve. Explains why Implicit Flow is now discouraged, how PKCE addresses certain attacks, which auth flows suit which client types, token storage recommendations, and reviews recent IETF and OWASP guidance plus the emerging GNAP approach.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 10:59OAuth2 origins and issues
- 21:26Secure flows and auth code
- 30:08Refresh tokens best practices
- 34:32OpenID Connect and JWT
- 42:02Security and key management
- 45:33Future: WebAuthn and evolutions
related talks
46mOAuth2/OIDC best practices conjugated in present, past simple and future
01h 02mOpenID Connect & OAuth 2.0 – Security Best Practices
01h 02mBuilding Clients for OpenID Connect/OAuth 2-based Systems
53mOpenID Connect & OAuth 2.0 – Security Best Practices
59mOpenID Connect & OAuth 2.0 – Security Best Practices
45mMastering OAuth 2.0 and OpenID Connect
01h 00mImplementing OpenID Connect and OAuth 2.0 – Tips from the Trenches
28mOAuth 2.0 and OIDC