Authorization
How systems decide what a caller may do: OAuth flows and tokens, scopes, and policy-based models such as XACML and ABAC.
Topics: Authorization · Cloud computing · Events & community · General · Identity & access management · Federation · Information security · Mobile security · Social login · News · Technical · Archives
- Authorization
The State Parameter in OAuth 2.0: CSRF, PKCE and RFC 9700
Why OAuth 2.0's state parameter exists, the CSRF attack it stops, how to generate and check it, and how state, PKCE and nonce divide the work under RFC 9700.
- Authorization
XACML With OpenID Connect, SAML, OAuth and SCIM: Who Does What
Five identity standards, five jobs: SAML and OIDC authenticate, OAuth delegates API access, SCIM provisions accounts and XACML evaluates authorization policies.
- Authorization
OAuth 1.0a vs OAuth 2.0: What Still Matters Today
OAuth 1.0a signed every request; OAuth 2.0 relies on TLS and bearer tokens. How the two differ, where 1.0a survives and how to call a 1.0a API correctly.
- Authorization
Implementing Modern OAuth Techniques: PAR, DPoP and More
The OAuth 2.0 extensions worth adopting now: PKCE everywhere, pushed authorization requests, DPoP, issuer identification, resource indicators and token exchange.
- Mobile security
Integrating OAuth With Mobile Apps: The Native App Pattern
How native iOS and Android apps should use OAuth 2.0: system browser, PKCE, claimed HTTPS redirects, secure token storage and what to avoid (embedded webviews).
- Federation
Federation and Entitlement Management: How They Fit Together
Federation tells an app who the user is; entitlement management decides what they may do. How SAML, OIDC, SCIM and policy engines divide the work.