OpenID Connect & OAuth 2.0 – Security Best Practices

on YouTube ↗53m

" summary

Overview of concrete security changes and fixes for OAuth 2.0 / OpenID Connect: recommends deprecate implicit and resource owner password grants, keep only client credentials for machine clients and authorization code for interactive clients, and always use PKCE and exact redirect URI matching; warns about real attacks seen — referer leakage, subdomain takeover, authorization code injection, mix‑up attacks — and prescribes fixes: typed JWTs and mutual TLS, invalidate one‑time codes, enforce content security and Referrer‑Policy, prefer system/browser callbacks and pushed authorization requests.

AI-written summary · about

" chapters (26)

1. 0:00Intro
2. 3:27Some Context...
3. 9:46Simplified
4. 10:21Attack Model (3)
5. 14:18Implicit Flow Request
6. 14:39Implicit Flow Response
7. 16:47Grand Unification
8. 17:34Machine to Machine
9. 18:16Client Authentication
10. 20:44Sender Constrained Access Tokens w/ MTLS
11. 24:30Interactive Applications
12. 26:28Redirect URI Validation Attacks
13. 29:01Credential Leakage via Referrer Headers
14. 29:50Authorization Code Injection
15. 30:43Mitigation: Proof key for Code Exchange
16. 31:54Countermeasures Summary
17. 32:49Mix Up Attack (Variant 1)
18. 35:54Mix Up Countermeasures
19. 36:24How does ASP.NET Core prevent Mix Up Attacks?
20. 38:23Anti Pattern: Native Login Dialogs
21. 38:48Using a browser with Code Flow + PKCE
22. 40:42Different Approaches
23. 41:33Browser-based Applications (aka SPAs)
24. 44:14Anti-Forgery Protection
25. 47:02Refresh Token Storage in Browsers
26. 47:21What's next?

" related talks

• 59mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC Security Oslo 2020
• 01h 02mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC Oslo 2020
• 01h 05mCommon mistakes and misconceptions in Web App Security using OAuth 2.0 and OpenId ConnectNahid Farrokhi · NDC Sydney 2020
• 01h 00mImplementing OpenID Connect and OAuth 2.0 – Tips from the TrenchesDominick Baier · NDC Security Oslo 2020
• 01h 02mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier · NDC Security Oslo 2019
• 46mOAuth2/OIDC best practices conjugated in present, past simple and futureMathieu Humbert · Devoxx France 2021
• 47mIntroduction to OAuth 2.0 and OpenID ConnectPhilippe De Ryck · GOTO Berlin 2018
• 29mFireside Chat About OAuth 2.0Aaron Parecki, Eric Johnson · GOTOpia February 2021