OAUTH, OPENID CONNECT & .NET – THE GOOD PARTS

on YouTube ↗58m

" summary

Covers which OAuth2 pieces are actually useful today: use authorization code flow with PKCE for all interactive apps, use client credentials for machine-to-machine, issue short-lived access tokens (5–60 minutes) plus server-stored refresh tokens for renewal, and restrict access with scoped tokens. OpenID Connect adds an ID token for authentication and distributed session/logout. Recommends the back-end-for-frontend pattern (keep token handling on the server), validate JWTs via the provider’s /.well-known discovery and JWKS, and avoid implicit/browser-stored secrets.

AI-written summary · about

" chapters (12)

1. 0:00Introduction
2. 1:09History of web auth
3. 5:14Why OAuth exists
4. 8:31OAuth architecture
5. 12:09Scopes and tokens
6. 16:45Client credential flow
7. 26:57Auth code flow
8. 34:28Refresh tokens
9. 36:28Application types
10. 41:30OpenID connect
11. 44:26Summary and resources
12. 49:38Q&A session

" related talks

• 01h 00mOAuth – the good PartsAnders Abel · NDC Security 2023
• 58mOAuth – the good PartsDominick Baier · NDC Porto 2022
• 54mOAuth – the good PartsDominick Baier · NDC Oslo 2021
• 01h 02mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier · NDC Security Oslo 2019
• 01h 02mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC Oslo 2020
• 01h 00mImplementing OpenID Connect and OAuth 2.0 – Tips from the TrenchesDominick Baier · NDC Security Oslo 2020
• 47mIntroduction to OAuth 2.0 and OpenID ConnectPhilippe De Ryck · GOTO Berlin 2018
• 57mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier, Brock Allen · NDC Porto 2019