A Deep Dive into the Past, Present & Future of OAuth
summary
Argument: OAuth is converging on a simpler baseline — OAuth 2.1 endorses authorization code + PKCE as the default and removes legacy shortcuts. Practical fixes covered: pushed authorization requests moves app parameters from the manipulable front channel into an authenticated back-channel, reducing scope tampering; DPoP and mTLS are presented as ways to make tokens sender-constrained; JWT access tokens let gateways validate locally but still require introspection for revocations. Real-world harm (cookie/token theft and channel-based account takeovers) motivates these changes; Chrome’s device session credentials prototype (behind a flag) aims to limit stolen-cookie reuse.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:29The password anti-pattern
- 2:05Why is this bad?
- 3:27Solution
- 5:13OAuth 2.0
- 12:38OAuth 2.1
- 13:36OpenID Connect
- 16:19Front channel vs Back channel
- 21:50Recent OAuth extensions
- 32:09Nearly-final specifications
- 36:15Sender-constrained access tokens
- 40:40Emerging themes
- 43:10Is your app enterprise-ready?
- 45:59Outro
