Standards-based authentication for JavaScript sites

on YouTube ↗30m

" summary

Explains that browser apps must stop returning tokens in URLs and instead use the PKCE code flow; shows how an ID token (a signed JWT) and access tokens are issued, validated, and used to call APIs; demonstrates silent renew via an authorization-server session cookie and iframe and how the Auth0 SDK automates the steps; states 2019 best-current-practices reduce the attack surface and recommends greenfield adoption while advising pragmatic migration for existing apps.

AI-written summary · about

" chapters (8)

1. 0:00Intro
2. 2:32Terminology
3. 4:25OAuth history lesson
4. 7:08OAuth 20 delegated authorization
5. 13:25JSON Web Token
6. 17:28Recap
7. 18:23JavaScript Authentication
8. 20:19Browser Tokens

" related talks

• 59mSecuring Web APIs from JavaScript/SPA ApplicationsBrock Allen · NDC Oslo 2019
• 22mKnock knock, who's there? Authenticating your single page apps using JSON Web TokensSam Bellen · foss-north 2019
• 44mThe Art of Authentication for Web AppsKim Maida · Build Stuff 2022
• 29mKnock knock, who's there? Authenticating your single page apps using JSON Web TokenSam Bellen · AngularDay 2019
• 40mKnock knock, who's there? Authenticating your single page apps using JSON Web TokensSam Bellen · GrillJS 2019
• 01h 02mModern AuthenticationRob Moore · NDC Sydney 2016
• 01h 01mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier · NDC Copenhagen 2019
• 55mBuilding Perfect Authentication in Your JS ApplicationVladimir Rudyy · JS Fest 2019 Autumn