Getting to know your users
summary
Overview of concrete claims and practices: Basic Authentication is legacy, OAuth 1 is complex, OAuth 2 simplifies with bearer tokens but creates new attack surfaces; use expiring tokens and server-side mitigations. OpenID Connect builds an identity layer and adds session management and explicit logout endpoints. Use token-based headers with CORS instead of risking JSONP attack vector to secure APIs. Empirical note: password recovery churn is high — only 45 percent return after forced resets.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:54What does PayPal do at JSConf.eu?
- 3:23Do we always use the same identity?
- 3:50Should we always use the same identity?
- 5:23Basic Authentication
- 11:56OAuth 2.0 and the Road to Hell
- 18:28OpenID with OAuth Hybrid Extension
- 20:24Identity Providers Social vs. Concrete
- 23:51Where else should we use authentication?
- 24:03JSONP Cross-domain Request (XDR)
