Building Clients for OpenID Connect/OAuth 2-based Systems

on YouTube ↗01h 02m

" summary

Recommends using client credentials for server-to-server calls and code flow with PKCE for native and browser apps, citing OAuth 2 best practices and the IETF/OWIN guidance that deprecates implicit flow. Suggests ASP.NET Core OpenID Connect handler and oidc-client-js support code+PKCE, store refresh tokens in device keychain or DPAPI, and manage token lifetime either proactively (cache with TTL) or reactively (refresh on 401). Warns hybrid flow protects against code substitution with c_hash but can leak identity data over the front channel.

AI-written summary · about

" chapters (28)

1. 0:00Intro
2. 2:49Objectives
3. 4:08It's complicated!
4. 5:50The Big Picture
5. 7:40Client Credentials Flow
6. 8:30Use Token
7. 11:08Challenges for Clients
8. 13:52Front-Channel: Authorization Code Flow Request
9. 14:45Front-Channel: Authorization Code Flow Response
10. 15:01Back-Channel: Retrieving Tokens
11. 16:28Issues with Code Flow
12. 18:03Hybrid Flow Request
13. 18:30Hybrid Flow Response
14. 24:58Issues with Hybrid Flow
15. 26:49Public Clients
16. 28:45Native/Mobile Applications
17. 30:20Anti Pattern: Resource Owner Password Flow
18. 33:41Using a browser for driving the authentication workflow
19. 42:56Client Libraries
20. 43:11Browser-based Clients (aka SPAS)
21. 44:34History (2)
22. 46:22Implicit Flow Request
23. 47:09Problems with Implicit Flow
24. 49:04Token Management for JS Apps
25. 53:25Java Script Client Library
26. 53:56The new kid on the block: Same Site Cookies
27. 56:32"BFF" Architecture
28. 57:53Further Reading

" related talks

• 57mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier, Brock Allen · NDC Porto 2019
• 01h 00mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier · NDC London 2019
• 01h 01mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier · NDC Copenhagen 2019
• 01h 02mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC Oslo 2020
• 58mOAUTH, OPENID CONNECT & .NET – THE GOOD PARTSAnders Abel · NDC London 2024
• 59mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC Security Oslo 2020
• 01h 00mImplementing OpenID Connect and OAuth 2.0 – Tips from the TrenchesDominick Baier · NDC Security Oslo 2020
• 58mBuilding JavaScript and mobile/native Clients for Token-based ArchitecturesDominick Baier, Brock Allen · NDC London 2017