OAuth 2.0 and OIDC
summary
Explains that OAuth 2.0 is an HTTP-based authorization framework while OpenID Connect adds an identity layer that returns an ID token (JWT) containing user info; walks through a Yelp→Google sign‑in showing client_id, redirect_uri, scope, state and the header.payload.signature JWT shape. Covers flows: implicit for SPAs, authorization code with PKCE for mobile/server, refresh tokens, token revocation, and security tradeoffs. Uses OAuth 2.0 Playground and code examples to demonstrate access token vs ID token and when to use each.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:15NOT THE SOLUTION
- 1:56ISSUES WITH SITES SHARING PASSWORDS
- 2:26IDENTITY USE CASES IN 2007
- 3:49QUESTIONS
- 4:06SILOED AUTHENTICATION SOLUTIONS
- 5:02ENTER OAUTH 1
- 6:24ENTER OAUTH 2, BETTERI
- 8:46OAUTH 2, BETTER BUT NOT PERFECT
- 10:58OAUTH2-A REAL WORLD EXAMPLE: HOTEL ANALOGY
- 13:12DELEGATED AUTHORIZATION WITH OAUTH 2
- 14:28CREATING OAUTH 2 REQUEST
- 16:15WHAT IS JASON WEB TOKEN (JWT)
- 19:01Decode OAuth response (Access token)
- 20:55Identity Tokens A real world example: Driver's License
- 23:00OTHER TYPES OF FLOWS
- 23:50TOKEN LIFE
- 24:31IDENTITY USE CASES TODAY
- 24:50ANSWERS
- 25:29RESOURCES
related talks
49mUnderstanding OAuth 2.0 & OIDC
36mTo Identity and Beyond
45mDemystifying OAuth2 and OIDC
33mOAuth and OpenID Connect Deep Dive
47mIntroduction to OAuth 2.0 and OpenID Connect
19mOAuth and OpenID Connect in Plain English
01h 00mImplementing OpenID Connect and OAuth 2.0 – Tips from the Trenches
34mWho Are You? I Really Want to Know… the Magic Behind OIDC