#Authorization
12 articles
What are Sender-Constrained Tokens? An Introduction to mTLS (RFC 8705) and DPoP (RFC 9449)
Explains sender-constrained tokens that address the weakness of bearer tokens, using mTLS (RFC 8705) and DPoP (RFC 9449) to bind a token to its sender, plus Resource Indicators (RFC 8707) that narrow the audience.
Access Token Validation and Revocation: Introspection, JWT AT, and Revocation
Compares the two access token approaches (opaque + Introspection / JWT access tokens) and how each is validated, plus revocation via Token Revocation. Covers RFC 7662, RFC 9068, and RFC 7009.
What is OAuth 2.1? Changes from OAuth 2.0 and the Security BCP (RFC 9700)
An overview of the changes from OAuth 2.0 to 2.1 and the security measures shown by RFC 9700 Security BCP and RFC 6819 threat model. Covers mandatory PKCE, deprecation of the Implicit grant, Mix-Up defenses, and more.
Everything About Digital Identity: Knowledge for Realizing a Secure and User-Centric Identity System
Everything About Digital Identity: Knowledge for Realizing a Secure and User-Centric Identity System
Introduction to Digital Identity: Essential Authentication, Authorization, and ID Management for Web Services
Introduction to Digital Identity: Essential Authentication, Authorization, and ID Management for Web Services
OAuth 2.0 Explained: Complete Guide to Flows, Tokens, and Implementation
Summary based on RFC 6749 (OAuth 2.0 Authorization Framework) and RFC 6750 (Bearer Token Usage).
Summary of OpenID Connect 1.0 Specifications
Understand OpenID Connect specification, JWT structure, ID tokens, claims, and authentication flow details.
SAML 2.0 Explained: How SSO and Federated Identity Work
Understand SAML 2.0 and how it enables Single Sign-On (SSO), the roles of Identity Provider and Service Provider, and how it compares to OAuth 2.0 and OpenID Connect.
Session-based and Token-based Authentication Methods
A comprehensive comparison and explanation of session-based and token-based authentication methods, covering technical details and implementation considerations.
Resources for Catching Up on OAuth2 and OIDC
Explore OAuth2, OIDC, JWT, and authentication standards through comprehensive specifications, books, and implementation guides.
A Book to Understand the Differences Between OAuth, OAuth Authentication, and OpenID Connect
A book to understand the differences between OAuth, OAuth Authentication, and OpenID Connect
Basics of Authentication and Authorization
Learn authentication and authorization fundamentals: identification, RBAC, ABAC, credential types, SSO, SAML 2.0, OAuth 2.0, and OpenID Connect with practical context.