Understanding OAuth 2.0 & OIDC
summary
Covers how to implement an OAuth client end to end with concrete tooling and commands: uses Auth0 sample app + Google APIs, shows the authorize code redirect, token exchange, and using the access token as a bearer header; demo successfully returns id and access tokens and shows refresh flow. Emphasizes ID token is always a JWT, explains JWT header/payload/signature and recommends the Authorization Code + PKCE flow for SPAs; notes implicit flow is deprecated and points to jose and jwt.io.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 2:10Open Standards
- 4:04Identity Authentication
- 7:37Login Forms
- 12:03Delegated Authorization
- 13:42Authorization vs Authentication
- 15:54Summary
- 17:09Roles
- 23:12Tokens
- 27:58Authorization Grants
- 33:29OAuth Connect Flow
- 38:18Demo
- 43:47Questions
related talks
28mOAuth 2.0 and OIDC
46mOAuth2/OIDC best practices conjugated in present, past simple and future
45mDemystifying OAuth2 and OIDC
57mBuilding Clients for OpenID Connect/OAuth 2-based Systems
44mThe Art of Authentication for Web Apps
36mTo Identity and Beyond
47mIntroduction to OAuth 2.0 and OpenID Connect
01h 00mOAuth – the good Parts