Building Clients for OpenID Connect/OAuth 2-based Systems
summary
Overview of concrete choices for client types: server apps use client credentials and proactive or reactive token caching; native apps use browser-based login, PKCE/code flow and secure keychain storage with refresh tokens; traditional code flow is vulnerable to code substitution so prefer hybrid flow with c_hash or PKCE; SPAs avoid implicit flow, favor code+PKCE but must harden against XSS via CSP and consider a back-end for front-end (BFF) proxy and same-site cookies for safer token handling.
AI-written summary · about
chapters (28)
- 0:00Intro
- 1:57It's complicated!
- 3:03Objectives
- 4:06The Big Picture
- 6:00Client Credentials Flow
- 7:07Use Token
- 10:27Challenges for Clients
- 11:24User-Centric Clients
- 12:53Front-Channel: Authorization Code Flow Request
- 13:41Front-Channel: Authorization Code Flow Response
- 13:51Back-Channel: Retrieving Tokens
- 14:54Issues with Code Flow
- 16:15Hybrid Flow Request
- 16:42Hybrid Flow Response
- 21:32Issues with Hybrid Flow
- 23:54Public Clients
- 25:59Native/Mobile Applications
- 27:34Anti Pattern: Resource Owner Password Flow
- 29:36Using a browser for driving the authentication workflow
- 35:02Proof-Key for Code Exchange (PKCE)
- 36:10Client Libraries
- 36:36Browser-based Clients (aka SPAS)
- 38:55History (1)
- 42:47Problems with Implicit Flow
- 43:51Token Management for JS Apps
- 49:34Java Script Client Library
- 51:53The new kid on the block: SameSite Cookies
- 53:49"BFF" Architecture
related talks
01h 01mBuilding Clients for OpenID Connect/OAuth 2-based Systems
01h 02mBuilding Clients for OpenID Connect/OAuth 2-based Systems
57mBuilding Clients for OpenID Connect/OAuth 2-based Systems
58mBuilding JavaScript and mobile/native Clients for Token-based Architectures
58mOAUTH, OPENID CONNECT & .NET – THE GOOD PARTS
37mOAuth2 and OpenID Connect for Single Page Applications
01h 00mImplementing OpenID Connect and OAuth 2.0 – Tips from the Trenches
59mSecuring Web APIs from JavaScript/SPA Applications