Supercharging OAuth 2.0 Security
summary
Walks through concrete fixes: request objects become signed JWTs so parameters can’t be tampered (JAR), or the client pushes the whole request to the STS and receives a short-lived request_uri (response includes request_uri and expires_in ≈ 60s) so the browser carries almost nothing (PAR). Demo uses openid-client + IdentityServer and shows both patterns working. Also contrasts sender-constrained tokens: simple mTLS with x5t CNF and the newer DPoP using jkt fingerprints; recommends PAR + resource indicators per-API for safer, minimal-scope tokens.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:38Overview
- 2:22Baseline
- 6:29Terminology
- 6:59About Philippe
- 8:53Slides
- 9:45Reducing the power of access tokens
- 16:02Resource indicators
- 16:47Securing authorization request
- 25:14Demo
- 29:54Takeaway
- 30:26Barar
- 32:59Par
- 36:18Bar demo
- 39:59Takeaways
- 43:46Mutual TLS
- 46:15Extra claims
- 49:57Deop Proof
- 50:50Deop Header
- 51:59API Response
- 53:28API Request
- 54:09API Verification
- 55:19Summary
related talks
55mSupercharging OAuth 2.0 security
58m“OAuth 2.1” and beyond
01h 00mOAuth – the good Parts
46mA Deep Dive into the Past, Present & Future of OAuth
01h 02mOpenID Connect & OAuth 2.0 – Security Best Practices
59mSecuring Web APIs from JavaScript/SPA Applications
29mFireside Chat About OAuth 2.0
47mDeconstructing and Evolving REST Security