The Nuts and Bolts of OAuth 2.0

Explore the five OAuth 2.0 roles—the resource owner, user agent, OAuth client, resource server, and authorization server—and how the authorization server issues access tokens for api access.

Examine confidential and public clients in OAuth 2.0, why credentials matter, and how client authentication influences consent and token lifetimes while reducing risk.

Explore how user consent and redirect-based OAuth flows protect data, replacing password grants with an authorization server that supports multifactor authentication and clear consent prompts.

Compare the front channel and back channel in oauth flows, highlighting secure back-channel delivery versus front-channel data, why implicit flow is discouraged, and the role of user consent and cors.

Understand application identity in OAuth 2.0, including client IDs, optional client secrets for confidential vs public clients, and the authorization code flow with PKCE and redirect URIs.

Explore how to build OAuth clients across web server, mobile, single-page apps, and devices without browsers, with practical flows and demos, and understand OpenID Connect differences for client developers.

Register your application on the OAuth server to obtain the client ID and possibly a client secret, configure redirect URLs, and prepare for the authorization code flow.

Explore the full authorization code flow for web apps with PKCE, front and back channel exchanges, code verifier and challenge, token exchange, and refresh tokens.

Examine the unique issues of native apps in OAuth 2.0, showing why mobile apps cannot safely use a client secret and that the solution is not to use one.

Learn how mobile redirect URLs differ from web redirects, including custom URL schemes and deep linking, and how PKCE and app-claimed URL patterns enhance security in OAuth 2.0.

Learn how mobile apps securely launch in-app browsers for OAuth 2.0, using SFSafariViewController and Chrome Custom Tabs to keep users in-app while preserving password safety and session sharing.

Explore the authorization code flow for native apps using PKCE to securely obtain access tokens via front and back channels, with a focus on mobile-specific considerations.

Leverage refresh tokens to keep mobile users logged in with short-lived access tokens. Post to token endpoint with grant_type=refresh_token, refresh token, and client id; native apps omit a client secret.

Explore browser-specific challenges for OAuth in single-page apps, including public clients, XSS risks, third-party scripts, and insecure storage, and learn PKCE's secretless flow.

Learn the authorization code flow for single-page apps with PKCE, using no client secret, front and back channels, and exchanging authorization codes for access tokens.

Learn how single page apps protect OAuth 2.0 tokens in the browser, including PKCE benefits and storage options like localStorage, sessionStorage, and cookies against cross-site scripting.

Move the OAuth flow and token storage to a dynamic backend to keep tokens out of the browser, using HttpOnly cookies and back-channel exchanges.

Learn the OAuth device flow for devices without browsers or keyboards, like smart TVs and IoT, using a code and url to authenticate on another device and poll for tokens.

Explore the OAuth device flow for browserless devices, detailing the roles, device and user codes, polling, login prompts, and token refresh to secure API access.

Explore the client credentials grant, a machine-to-machine flow that exchanges app credentials for an access token without user involvement, enabling scalable backend access.

Register your application with the OAuth server to obtain a client ID and secret for machine-to-machine use, then request an access token at token endpoint using the client credentials grant.

Explore how OpenID Connect adds the ID Token to OAuth, a JSON Web Token that carries user information with header, payload, and signature, including issuer, audience, iat, exp, and sub.

Differentiate access tokens from ID tokens in OAuth 2.0: access tokens are opaque to apps, while ID tokens are JWTs read and validated by the app.

Obtain an ID token with an access token via the authorization code flow by adding openid, then exchange the code on the back channel to receive the ID token.

Explore hybrid OpenID Connect flows and how code, id_token, and code+id_token responses affect security. Learn why PKCE strengthens the authorization code flow and mitigates front-channel token risks.

Validate ID tokens by verifying the signature and essential claims (issuer, audience, timestamps, nonce); front channel flows require checks, while the authorization code flow provides a trusted back channel.

Explore protecting an api with OAuth from the api perspective, focusing on access token formats, token lifetimes, and defining scopes for secure access.