The state of OAuth
summary
OAuth now consolidates modern practice: it deprecates the implicit and password flows and snapshots best practices as oauth 2.1, recommending authorization code with pixi for all apps and using bearer tokens or JWT-formatted access tokens for interoperability. New RFCs add push authorization requests and JWT access token profiles; experimental work targets sender-constrained tokens (mutual TLS, DPoP, HTTP signatures) and richer scope expressions for payment-like actions. Expect incremental adoption, not an OAuth 3.
AI-written summary · about
chapters (7)
- 0:00Intro
- 0:33OAuth Origins
- 5:35OAuth 2 Core
- 11:44OAuth 21 Update
- 13:06OAuth Extensions
- 16:12Experimental OAuth
- 20:53OAuth 3 GNAP
