“OAuth 2.1” and beyond
summary
OAuth 2.1 consolidates BCPs: implicit and password grants removed, PKCE required for authorization code and redirect URIs must match exactly; public clients use refresh token rotation and tokens never go in query strings. New specs add structured scope data via authorization_details (RA), signed JWT request objects (request parameter / JAR or CHAR) and a back-channel request_uri valid for 90s (PAR). Client auth moves to private_key_jwt and mTLS, with access tokens bound via x5t#S256 in the cnf claim; demos run on IdentityServer, ASP.NET Core and nginx and work end-to-end.
AI-written summary · about
chapters (32)
- 0:00Intro
- 1:21High Security OAuth
- 3:53Relevant Documents
- 4:19OAuth 2.1
- 7:42Rich Authorization Requests (RAR)
- 12:40Example (2)
- 12:58Example Authorization Request
- 15:15JWT Secured Authorization Requests
- 17:23Enabling JAR in IdentityServer
- 22:04Pushed Authorization Requests PAR
- 22:42Pushed Authorization Request & Respo
- 23:36Authorization Request using request_
- 26:16Shared Secrets
- 28:07Recommendations
- 31:30Sending a private_key_jwt
- 37:13"Proof-of-Possession" History
- 40:33Weakness of Bearer Tokens
- 40:54Proof of Possession using MTLS
- 41:12Mutual TLS
- 42:41Sender Constrained Access Tokens w
- 44:49Creating an X.509 Client Certificate
- 45:14Setting a Client Certificate
- 45:28Calling the Token Endpoint
- 48:23MTLS Endpoints
- 49:10Server Metadata
- 49:31Choice of Web Server / Proxy
- 50:06Example: Sub-domains with Nginx
- 50:56Reading Certificate from Header
- 51:22Certificate Authentication Handler
- 51:35Enabling MTLS in IdentityServer
- 51:52Verifying Access Token Ownership at Rese
- 54:30Summary
