Building JavaScript and mobile/native Clients for Token-based Architectures
summary
Demonstrates building JavaScript and native clients that talk to IdentityServer using OpenID Connect/OAuth2, with concrete code using oidc-client.js for SPAs and a .NET native client library. Shows ID token validation steps (signature, exp, nonce, audience), access tokens delivered in the URL hash, additional profile via the userinfo endpoint, and silent renew using a hidden iframe for short-lived access tokens stored in sessionStorage. Explains native flow using the system browser, PKCE, custom URI schemes, refresh tokens stored in OS keychains, and why webviews are discouraged.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:55The big Picture
- 3:07Security Protocols (11)
- 5:13Token-based Clients...
- 10:47Modern/Pure JavaScript apps
- 11:17No more cookies for security
- 13:14Discovery
- 15:21Authentication in JS-based apps
- 19:02Validating id tokens
- 26:14More identity data with user profile
- 28:47Using access token to call user profile
- 29:42Calling other web APIs
- 31:24Token management
- 33:16Renewing tokens
- 37:08Native Clients
- 37:53Using a web server for driving the authentication workflow
- 38:20Browser types
- 48:49OpenID Connect Hybrid Flow
- 52:04Requesting the access token
- 53:05Refreshing an Access Token
related talks
57mBuilding Clients for OpenID Connect/OAuth 2-based Systems
59mSecuring Web APIs from JavaScript/SPA Applications
01h 01mBuilding Clients for OpenID Connect/OAuth 2-based Systems
39mSecuring your apps with OAuth2 and OpenID Connect
01h 02mBuilding Clients for OpenID Connect/OAuth 2-based Systems
01h 00mBuilding Clients for OpenID Connect/OAuth 2-based Systems
01h 02mModern Authentication
49mUnderstanding OAuth 2.0 & OIDC