tag: oauth
OAuth
OAuth as a family of specs, from 1.0a to 2.0 and the 2.1 draft, and how it fits with everything else.
Articles
- Authorization
The State Parameter in OAuth 2.0: CSRF, PKCE and RFC 9700
Why OAuth 2.0's state parameter exists, the CSRF attack it stops, how to generate and check it, and how state, PKCE and nonce divide the work under RFC 9700.
- Events & community
Planning API Security Training for a Distributed Team
A practical curriculum for teaching API security to developers spread across offices and countries: modules, hands-on labs, formats and how to measure if it worked.
- Events & community
API Security Today: The OWASP API Top 10 in Practice
A talk-style tour of the OWASP API Security Top 10 (2023): broken object level authorization, authentication flaws, resource limits, and fixes that work.
- Social login
Social Login and CIAM Explained
How social login works with OpenID Connect, what customer identity and access management (CIAM) platforms add, and how to handle consent, linking and vendor exits.
- Authorization
XACML With OpenID Connect, SAML, OAuth and SCIM: Who Does What
Five identity standards, five jobs: SAML and OIDC authenticate, OAuth delegates API access, SCIM provisions accounts and XACML evaluates authorization policies.
- Cloud computing
Cloud Security Standards: Frameworks and Identity Specs
Which standards matter for cloud security: CSA Cloud Controls Matrix, ISO/IEC 27001, 27017 and 27018, SOC 2, plus the identity specs (SAML, OIDC, SCIM) behind them.
- Authorization
OAuth 1.0a vs OAuth 2.0: What Still Matters Today
OAuth 1.0a signed every request; OAuth 2.0 relies on TLS and bearer tokens. How the two differ, where 1.0a survives and how to call a 1.0a API correctly.
- Authorization
Implementing Modern OAuth Techniques: PAR, DPoP and More
The OAuth 2.0 extensions worth adopting now: PKCE everywhere, pushed authorization requests, DPoP, issuer identification, resource indicators and token exchange.
- Mobile security
Integrating OAuth With Mobile Apps: The Native App Pattern
How native iOS and Android apps should use OAuth 2.0: system browser, PKCE, claimed HTTPS redirects, secure token storage and what to avoid (embedded webviews).
- Identity & access management
OpenID to OpenID Connect: What Changed and Why It Matters
OpenID 2.0 gave way to OpenID Connect in 2014. What the newer protocol does differently, how ID tokens work and what is left of the old OpenID today.
Guides
- Topic guide
OAuth security: what to get right
A practical OAuth 2.0 security guide based on RFC 9700: choose the right flow, use PKCE and state, validate redirects, limit tokens, protect refresh tokens and APIs.
- IAM building block
Authorization: deciding what is allowed
How authorization works: role-based and attribute-based access control, XACML's PDP and PEP, policy-as-code engines, OAuth scopes, and where checks belong.
- Topic guide
Mobile app security and OAuth
Mobile security for identity teams: OAuth for native apps with PKCE, token storage, app attestation, device management, BYOD and conditional access.
- Topic guide
OAuth downgrade attacks
How attackers push OAuth flows to weaker options: PKCE downgrade, plain challenges, implicit fallback, server mix-up, and the checks that stop them.
- Topic guide
Social login, done properly
How to add social login to an app: choosing providers, OpenID Connect integration, what data to request, account linking, consent and handling provider changes.