#OAuth
16 articles
8 Books for Learning Web Application Security (Auth and Secure Design)
A staged reading list of 8 books for learning web application security, from authentication and authorization to secure design: OAuth-based authorization, digital identity, and secure design and implementation. Each entry links to its full review.
What are Sender-Constrained Tokens? An Introduction to mTLS (RFC 8705) and DPoP (RFC 9449)
Explains sender-constrained tokens that address the weakness of bearer tokens, using mTLS (RFC 8705) and DPoP (RFC 9449) to bind a token to its sender, plus Resource Indicators (RFC 8707) that narrow the audience.
What is Dynamic Client Registration (DCR)? An Introduction to RFC 7591 and 7592
Explains Dynamic Client Registration (RFC 7591) and Client Registration Management (RFC 7592), which register and manage OAuth clients via an API. Covers the registration endpoint, registration access token, and security considerations.
Access Token Validation and Revocation: Introspection, JWT, and Token Revocation (RFC 7009)
Compares the two access token approaches (opaque + Introspection / JWT access tokens) and how each is validated, plus revocation via Token Revocation. Covers RFC 7662, RFC 9068, and RFC 7009.
OpenID Connect Discovery and Metadata: Auto-Configuration and jwks_uri Key Retrieval
Explains the role of the OpenID Connect ID Token and how Discovery (OpenID Connect Discovery / RFC 8414 AS Metadata) enables auto-configuration and public key retrieval, including key rotation via jwks_uri.
OAuth 2.1 and the Security BCP: RFC 9700 and RFC 6819 (Changes from OAuth 2.0)
An overview of the changes from OAuth 2.0 to 2.1 and the security measures shown by RFC 9700 Security BCP and RFC 6819 threat model. Covers mandatory PKCE, deprecation of the Implicit grant, Mix-Up defenses, and more.
Three Uses of a Public Key: Signing, Encryption, and Key Exchange
A public key has just three uses: signing, encryption, and key exchange. This article sorts real-world applications such as SSH public-key auth, WebAuthn, mTLS, private_key_jwt, code signing, and container signing into these three, and clarifies how they differ from shared-key schemes such as HMAC, with primary sources.
Everything About Digital Identity: Knowledge for Realizing a Secure and User-Centric Identity System
A review of a comprehensive book on digital identity. It explains everything from concepts to implementation systematically and broadly, covering OAuth 2.0, OpenID Connect, SAML, zero trust, and decentralized identity, giving engineers who design and operate authn/authz platforms a wide perspective.
Introduction to Digital Identity: Essential Authentication, Authorization, and ID Management for Web Services
A review of Introduction to Digital Identity. A book that plainly explains the basics of authentication, authorization, and ID management for web services, with real examples. It spans the mechanisms of OAuth 2.0, OpenID Connect, and SAML through single sign-on, social login, and using IDaaS, an ideal primer.
OAuth 2.0 Explained: Complete Guide to Flows, Tokens, and Implementation
OAuth 2.0 explained from the specs (RFC 6749 and RFC 6750): the four roles, the four grant types, access and refresh tokens, endpoints, scopes, Bearer tokens, security considerations, and what OAuth 2.1 changes.
A Comprehensive Introduction to OAuth: Principles and Practices for Implementing a Secure Authorization System
A review of A Comprehensive Introduction to OAuth. One of the few books that explains OAuth in depth. Covering authorization from principles to practice, it is a good bridge to keep at hand after a primer and before diving into the specifications.
A Book to Understand Attacks and Countermeasures on OAuth and OIDC (Redirect Attack Edition)
A review of a book that organizes attacks and countermeasures on OAuth and OIDC (Redirect Attack Edition). It gently organizes the basic security of OAuth and OpenID Connect from the angle of attacks and defenses, using redirect-related attacks to help you grasp the essentials.
A Tutorial Guide to Understanding OAuth2.0 Without Just Going Through the Motions!
A review of A Tutorial Guide to Understanding OAuth2.0 Without Just Going Through the Motions. An introductory book for understanding OAuth2.0 by organizing its mechanisms rather than using it on vibes. Easy to read, it is well suited to first grasping OAuth2.0 flows.
Resources for Catching Up on OAuth2 and OIDC
Explore OAuth2, OIDC, JWT, and authentication standards through comprehensive specifications, books, and implementation guides.
A Book to Understand the Differences Between OAuth, OAuth Authentication, and OpenID Connect
A review of a book that helps you understand the differences between OAuth, OAuth authentication, and OpenID Connect. It clearly sorts out these easily-confused concepts for beginners, offering a starting point for understanding the role and proper use of each.
Basics of Authentication and Authorization
Learn authentication and authorization fundamentals: identification, RBAC, ABAC, credential types, SSO, SAML 2.0, OAuth 2.0, and OpenID Connect with practical context.