Implementing OpenID Connect and OAuth 2.0 – Tips from the Trenches
summary
Covers concrete implementation choices for OpenID Connect and OAuth 2.0: use the OIDC subject as the canonical user ID, distinguish public vs confidential clients and map native/browser flows to the authorization code flow with PKCE, and prefer short-lived access tokens plus sliding refresh tokens for sessions. Discusses trade-offs between self-contained JWTs and reference tokens for caching and revocation, partitioning APIs by resource (using the resource indicators spec) to issue resource-specific tokens, keeping scopes coarse for features but fine-grained for write permissions, and planning token revocation and session synchronization.
AI-written summary · about
chapters (19)
- 0:00Start
- 6:29The Big Picture
- 9:28Who are your Users?
- 16:511st Approximation
- 23:41Pass-thru vs Identity Transformation (2)
- 26:53Protocol Flow
- 28:40Authorization Code Flow
- 29:28Identity Tokens
- 30:58Session Management
- 37:10Accessing Resources
- 39:03Example: GitHub Scopes
- 40:42Example: Google Scopes
- 41:33Only introduce Scopes when you need them!
- 45:00Example: Modeling API Resources with IdentityServer
- 46:47Example: Access Token
- 49:30Shared vs Resource-specific Access Tokens
- 51:29Token Lifetime and Revoking Access to Resources
- 54:11Access Token Type
- 59:22Summary
related talks
33mOAuth and OpenID Connect Deep Dive
01h 01mBuilding Clients for OpenID Connect/OAuth 2-based Systems
01h 02mOpenID Connect & OAuth 2.0 – Security Best Practices
58mOAUTH, OPENID CONNECT & .NET – THE GOOD PARTS
01h 02mBuilding Clients for OpenID Connect/OAuth 2-based Systems
45mMastering OAuth 2.0 and OpenID Connect
53mOpenID Connect & OAuth 2.0 – Security Best Practices
28mOAuth 2.0 and OIDC