Authentication done right: consuming (and serving) Oauth2.0
summary
Describes building a shared authentication system (oneauth) for multiple web products using OAuth 2.0: both consuming external providers (Login with Facebook/Google/Twitter) and implementing an internal OAuth 2.0 authorization server to serve the brand’s apps. Focuses on doing this securely with minimal frontend JavaScript and recounts the author’s implementation journey and lessons learned, referencing Lastser as a prior reference.
AI-written summary · about
chapters (8)
- 0:00Start
- 5:12bcrypt
- 7:38Single UI
- 9:40Identification
- 12:21Authentication via Authorization
- 15:25Basic security hygiene We came a long way without taking care of these. You shouldn't
- 25:45Separation of Concerns
- 29:14Better mileage with existing standards (POLA) We found there is an ISO standard for a whole lot of things!
related talks
36mService Oriented Authenication
44mThe Art of Authentication for Web Apps
29mDemystifying Oauth2 Authorization framework
43mOAuth, IndieAuth, and the Future of Authorization APIs
01h 01mBuilding Clients for OpenID Connect/OAuth 2-based Systems
20mPass On Access: User to User Data Sharing With OAuth
01h 00mOAuth – the good Parts
45mModern API Authentication 101