Web Security: OAuth and OpenID Connect (2019)

Course details

While many technical professionals claim to know and understand OAuth, reality often suggests otherwise. Implementing the proper grant types and the required flows while securely protecting your secrets is challenging at best and catastrophic at worst. Fundamentally, professionals often struggle with OAuth because they misunderstand what it is, what use cases it is particularly good and bad at, and how to integrate it smoothly and safely into their systems. In this course, Keith Casey reviews the basics of OAuth 2.0 and OpenID Connect and shows how to use them to authenticate your applications. He covers tokens and scopes; designing and building the key flows; common security considerations; and more.

Learning objectives
What is OAuth 2.0?
Making OAuth 2.0 useful with extensions
Extending OAuth 2.0 with OpenID Connect
OAuth tokens and their usage
Common security considerations
Resource owner password flow
Client credential flow
Configuring an OAuth server in PHP and Node.js

Concepts

Introduction

Using OAuth 2.0 and OpenID Connect
What you should know
What you will need

What Is OAuth

Describing OAuth 2.0
Making OAuth 2.0 useful with extensions
Extending OAuth 2.0 with OpenID Connect

Foundational Concepts

OAuth 2.0 fundamentals
Touring the OAuth endpoints
Designing and using OAuth scopes

OAuth Tokens

OAuth 2.0 tokens
Validating JWTs
Using access and refresh tokens
Parsing and using ID tokens
Handling tokens safely and securely

Grant Type - Authorization Code

Overview - Authorization code flow
When should I use this
PKCE Overview
When should I use PKCE
Build an example - Web app or Postman
Build an example - Native app or SPA
Security considerations

Grant Type - Implicit Hybrid

Overview - Implicit flow
When should I use this
Build an Example - SPA
Security considerations

Grant Type - Resource Owner Password

Overview - Resource owner password flow
When Should I use this
Build an example - curl
Security considerations

Grant Type - Client Credential

Overview - Client credential flow
When should I use this
Build an example - curl
Security considerations

Grant Type - Device Grant Type

Overview - Device flow
When should I use this
Build an example - Kiosk
Security considerations

Using an OAuth Architecture

OAuth recommended practices
Configuring an OAuth server in PHP
Configuring an OAuth server in Node.js
OAuth 2.0 as a service using Okta

State of the Industry

OAuth extensions
Industry specific OAuth extensions

Conclusion

Next steps