Building Clients for OpenID Connect/OAuth 2-based Systems
summary
Walks through concrete client patterns: use authorization header for API calls, prefer code flow with PKCE over implicit, store access tokens in secure OS storage or session/localStorage with refresh token or iframe silent renew, revoke tokens at sign-out, and expect hybrid flow only where libraries implement it. Demonstrates demos using IdentityServer/ASP.NET Core, oidc-client-js, and a reverse-proxy sample for a BFF (back-end for front-end) that issues SameSite HTTP-only cookies to protect SPAs.
AI-written summary · about
chapters (25)
- 0:00Intro
- 1:01Objectives
- 1:30It's complicated!
- 3:55Client Credentials Flow
- 4:36Use Token
- 8:03Front-Channel: Authorization Code Flow Request
- 8:28Back-Channel: Retrieving Tokens
- 9:08Issues with Code Flow
- 10:47Hybrid Flow Request
- 11:04Hybrid Flow Response
- 13:36Issues with Hybrid Flow
- 15:24Public Clients
- 16:47Native/Mobile Applications
- 17:46Anti Pattern: Resource Owner Password Flow
- 19:45Using a browser for driving the authentication workflow (aka AppAuth)
- 22:54Requesting the access token
- 27:48Client Libraries
- 29:20Browser-based Clients (aka SPAS)
- 31:52History (1)
- 36:05Implicit Flow Request
- 38:40Problems with Implicit Flow
- 39:49Token Management for JS Apps
- 46:42Java Script Client Library
- 49:12The new kid on the block: SameSite Cookies
- 51:21"BFF" Architecture
related talks
01h 02mBuilding Clients for OpenID Connect/OAuth 2-based Systems
01h 01mBuilding Clients for OpenID Connect/OAuth 2-based Systems
58mBuilding JavaScript and mobile/native Clients for Token-based Architectures
59mSecuring Web APIs from JavaScript/SPA Applications
01h 00mBuilding Clients for OpenID Connect/OAuth 2-based Systems
39mSecuring your apps with OAuth2 and OpenID Connect
49mUnderstanding OAuth 2.0 & OIDC
58mOAUTH, OPENID CONNECT & .NET – THE GOOD PARTS