tag: oauth2
OAuth 2.0
OAuth 2.0 (RFC 6749) in detail: grant types, parameters, threats and the current security best practice in RFC 9700.
Articles
- Authorization
The State Parameter in OAuth 2.0: CSRF, PKCE and RFC 9700
Why OAuth 2.0's state parameter exists, the CSRF attack it stops, how to generate and check it, and how state, PKCE and nonce divide the work under RFC 9700.
- Authorization
OAuth 1.0a vs OAuth 2.0: What Still Matters Today
OAuth 1.0a signed every request; OAuth 2.0 relies on TLS and bearer tokens. How the two differ, where 1.0a survives and how to call a 1.0a API correctly.
- Authorization
Implementing Modern OAuth Techniques: PAR, DPoP and More
The OAuth 2.0 extensions worth adopting now: PKCE everywhere, pushed authorization requests, DPoP, issuer identification, resource indicators and token exchange.
- Mobile security
Integrating OAuth With Mobile Apps: The Native App Pattern
How native iOS and Android apps should use OAuth 2.0: system browser, PKCE, claimed HTTPS redirects, secure token storage and what to avoid (embedded webviews).
Guides
- Topic guide
OAuth security: what to get right
A practical OAuth 2.0 security guide based on RFC 9700: choose the right flow, use PKCE and state, validate redirects, limit tokens, protect refresh tokens and APIs.
- Topic guide
OAuth downgrade attacks
How attackers push OAuth flows to weaker options: PKCE downgrade, plain challenges, implicit fallback, server mix-up, and the checks that stop them.