OAuth2 protocol
summary
Explains that OAuth2 is a loosely specified framework not a strict protocol, shows a working demo that boots an authorization server on Spring Framework in seconds and actually issues access and refresh tokens, and enumerates concrete pitfalls: token validation between resource and auth servers is unspecified, refresh tokens must not live with client secrets, implicit/JS flows leak tokens to third-party scripts (Google Analytics example), and credentials and tokens need short expiry and rotation.
AI-written summary · about
chapters (12)
- 0:00OAuth2 introduction
- 2:08Client credentials problem
- 7:09OAuth evolution 1.0 to 2.0
- 12:25How OAuth2 tokens work
- 16:47OAuth2 flows
- 22:51Token storage security flaws
- 26:45Mobile client flow
- 29:15Machine client flow
- 32:28OAuth2 open source implementations
- 33:38Demo: Spring auth server
- 42:09OAuth2 pros and cons
- 43:54Q&A
related talks
58mOAuth – the good Parts
29mDemystifying Oauth2 Authorization framework
01h 02mGetting Started with Spring Authorization Server
01h 31mSecurity for Microservices with Spring and OAuth2
01h 00mOAuth – the good Parts
54mOAuth – the good Parts
01h 26mSecuring Rest-ful Web Services with OAuth2
45mDemystifying OAuth2 and OIDC