Supercharging OAuth 2.0 security
summary
Covers concrete upgrades: Resource Indicators for per-API access tokens and downscoping (one token per API), RFC 9101 JAR (JWT request objects) and PAR (pushed authorization requests giving a request URI) to protect authorization-request integrity, and sender‑constrained tokens via MTLS or DPoP (CNF claim with x5t#S256 or JWK thumbprint, jti and ath fields). Includes a small Node.js demo against IdentityServer; examples run and show PAR/JAR behavior.
AI-written summary · about
chapters (7)
- 0:00OAuth 2.0 security enhancements
- 9:15Resource indicators for token scope
- 16:54Securing authorization with JAR
- 27:46Pushed authorization requests benefits
- 35:56Bearer tokens to sender-constrained
- 42:31Sender-constrained tokens MTLS DPoP
- 53:10Key takeaways and recommendations
related talks
01h 00mSupercharging OAuth 2.0 Security
58m“OAuth 2.1” and beyond
46mA Deep Dive into the Past, Present & Future of OAuth
01h 00mOAuth – the good Parts
59mSecuring Web APIs from JavaScript/SPA Applications
46mBearer of Good News
01h 02mOpenID Connect & OAuth 2.0 – Security Best Practices
44mThe Art of Authentication for Web Apps