Fireside Chat About OAuth 2.0
summary
Quick, concrete take: OAuth 2.0 is about granting API access, not identity (OpenID Connect adds identity), JWT is a token format not OAuth, and OAuth 1 required awkward request canonicalization and signing that developers hated. OAuth 2 uses bearer tokens that require HTTPS, so token theft (XSS, third‑party JS) is the primary risk; mitigations include short access lifetimes, refresh tokens, reuse/verification heuristics (IP, client checks), and PKCE protects the redirect authorization flow. OAuth 2.1 mainly consolidates RFCs and standardizes these best practices.
AI-written summary · about
chapters (10)
- 0:00Intro
- 1:14What is OAuth?
- 2:07Difference between AuthZ & AuthN
- 4:55Is JSON Web Token (JWT) OAuth?
- 6:16The history of OAuth
- 17:37A good level of security
- 21:30Difference between timeout & verification of use
- 23:46Changes in OAuth 2.1
- 27:12What is PKCE?
- 28:50Outro
