Modern Authentication
summary
Explains why passwords fail (millions breached, incidents every few weeks), shows a working IdentityServer3 demo and a JavaScript client using the implicit flow with id_token, walks through the metadata endpoint and the jwks JSON web key used for JWT signature validation, and decodes a real ID token in the browser devtools to prove validation works. Covers token types (reference vs self‑contained), scopes, refresh tokens and server vs public client choices, and demonstrates the code/token exchanges against localhost endpoints.
AI-written summary · about
chapters (26)
- 0:00Intro
- 1:43Traditional application
- 2:05Modern application
- 5:00Identity vs Authn vs Authz
- 6:52Claims-based auth
- 9:09Terminology
- 10:27Tokens (vs Passwords)
- 16:34Token formats
- 17:04SAML 2.0 Tokens
- 18:37JSON Web Tokens (JWTS)
- 20:55Auth protocols
- 22:58Basic Flow
- 23:36WS Federation
- 27:08Fundamentals
- 32:32Standard scopes
- 34:23OpenID Connect JWT payload
- 35:15Endpoints
- 35:37Authorization Endpoint
- 38:28Token Endpoint An example
- 40:50Interactive flows
- 42:30Authorization code flow (3-legged OAuth)
- 43:12Token Endpoint Authorization code
- 43:40Implicit flow (2-legged OAuth)
- 47:28Client credentials flow (server-to-server calls)
- 47:41Resource-owner credentials flow (Password flow)
- 54:46Implementation
related talks
47mModern Authentication 101
39mSecuring your apps with OAuth2 and OpenID Connect
29mKnock knock, who's there? Authenticating your single page apps using JSON Web Token
37mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
58mBuilding JavaScript and mobile/native Clients for Token-based Architectures
30mInsecurity protocols: an overview of modern authentication
40mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
22mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens