Approaching OAuth2
summary
POC e‑commerce with a Koa.js client and services, an Express API gateway with http-proxy-middleware that enforces auth checks, and Nginx as reverse proxy runs in Docker Compose. Authentication and authorization use Auth0 OAuth2/OIDC with ID and access tokens and scopes; ID token blocks unauthenticated requests, scope check blocks unauthorized ones (access-token check is partially bypassed in the demo). Product service saves to MongoDB, publishes on NATS event bus, and the order service consumes the event to create orders—demo works end‑to‑end with a few noted bugs.
AI-written summary · about
chapters (19)
- 0:00Start
- 2:49Authentication versus Authorization
- 3:02Authentication of versus Authorization
- 5:12Authorization
- 5:32Scopes
- 8:15Authentication
- 8:34Api Gateway and Reverse Proxy
- 9:36Api Gateway
- 9:59The Reverse Proxy
- 11:46Solution Design
- 13:43Oauth and Oidc
- 18:27Reverse Proxy
- 19:47Docker Compose Configuration
- 21:28Compose Build
- 23:53Front End
- 29:42Redirect the Identity Provider Page
- 38:06The Api Gateway
- 41:26Authentication and Authorization Checks
- 47:17Break the Id Token Authentication
related talks
49mUnderstanding OAuth 2.0 & OIDC
18mMake Auth great again with Ory
45mAPI Security: Acting Now to Enable Security Controls
53mOAuth2/OIDC security weaknesses and pitfalls
37mOAuth2 and OpenID Connect for Single Page Applications
54mProtecting API Workloads Against OWASP and Programming Language CVE's
38mDesigning a composable API platform powered by open standards and open-source tools
57mBuilding Clients for OpenID Connect/OAuth 2-based Systems