OAuth in 2021 – What’s up?
summary
OAuth 2.1 consolidates best practices and removes legacy options: implicit and password flows removed, authorization code requires PKCE (proof key), redirect URIs require exact string match, refresh tokens must be rotated or sender‑constrained, and tokens must not appear in query strings. Use JWKS for automated key rotation and newer algorithms (PS256, EC). Adopt the JWT access token profile (iss, aud, sub, client_id, jti). For stronger front‑channel security use JAR/PAR; for token binding use mTLS or DPoP proof‑of‑possession.
AI-written summary · about
chapters (43)
- 0:00Intro
- 1:33IdentityServer
- 2:34Agenda
- 5:24Current BCPs & Security Considerations
- 5:59No more Implicit Flow
- 6:56Implicit Flow Request
- 7:12Implicit Flow Response
- 8:16No more Password Grant
- 9:31Original Flows
- 10:02Grand Unification
- 10:41Authorization Code Injection
- 11:36Mitigation: Proof Key for Code Exchange
- 12:43Redirect URI Validation Attacks
- 13:52OAuth 2.1
- 15:11OAuth/OpenID Connect Metadata
- 17:13Key Rotation & Algorithms
- 21:55Access Tokens
- 22:12Self-contained Tokens
- 22:38JWT Claim Types (all optional)
- 22:49Lessons learned with JWTS
- 24:31Other required claims
- 25:41Cross-JWT Confusion
- 26:44Example JWT per Profile
- 27:38Resource Isolation
- 28:34Example: GitHub Scopes
- 30:15Example: Google Scopes
- 31:16Problems with Scope Model
- 33:11Resource Indicators
- 34:40Authorize Request
- 35:12Redeeming the Code
- 35:55Getting access to other Resources
- 42:29Request Object
- 47:15Pushed Authorization Requests (PAR)
- 47:32Pushed Authorization Request & Respons
- 49:18Weakness of Bearer Tokens
- 53:36Mutual TLS
- 54:09Creating an X.509 Client Certificate
- 54:50Setting a Client Certificate
- 57:48Application Level Proof-of-Possession
- 58:10DPop Token Request
- 58:25DPop Proof Token (Token Request)
- 59:09DPop Token Response
- 59:51DPOP Proof Token (Resource Access)
