OAuth2.0 and OpenID Connect: The Professional Guide
SHARE ON
Über dieses E-Book
Authentication and authorization are critical parts of any application. They evolved over the years to meet the challenging requirements of the modern Web. OAuth2.0 and OpenID Connect offer a framework for handling them in an effective way. Learn the best practices in using both standards in different scenarios and application types. This e-book will explain not just the hows, but also the whys of OAuth2.0 and OpenID Connect.
TABLE OF CONTENTS
- Preface 4
- Introduction 5
- Chapter 1 - Introduction to Digital Identity 6
- From User Passwords in Every App... 9
- ...to Directories 11
- Cross-Domain SSO 13
- The Password Sharing Anti-Pattern 18
- Delegated Authorization: OAuth 2.0 20
- Layering Sign In on Top of OAuth 2.0: OpenID Connect 24
- Auth0: an Intermediary Keeping Complexity at Bay 28
- Chapter 2 - OAuth 2.0 and OpenID Connect 30
- OAuth 2.0 Roles 32
- OAuth 2.0 Grants and OIDC Flows 34
- Chapter 3 - Web Sign-In 35
- Confidential Clients 35
- The Implicit Grant with Form Post 37
- A detailed walkthrough 37
- Anatomy of an ID Token 44
- Principles of Token Validation 47
- Metadata and Discovery 50
- Chapter 4 - Calling an API from a Web App 53
- The Authorization Code Grant 53
- Sidebar: Essential Authorization Concepts and Terminology 64
- The Refresh Token Grant 68
- Sidebar: Access Tokens vs. ID Tokens 75
- ID Tokens and the Back Channel 79
- The Userinfo Endpoint 80
- The Hybrid Grant 85
- Client Credentials Grant 85
- Chapter 5 - Desktop and Mobile Apps 92
- Public Clients 92
- Native Applications and the Browser 93
- Meet the PKCE 95
- Desktop Applications and Browsers 95
- The Authorization Code Grant with PKCE 96
- The Problem with Refresh Tokens 101
- The Resource Owner Grant 103
- Other Grants for Native Apps 108
- Chapter 6 - Single Page Applications 110
- The Nature of Single Page Applications 110
- Security Challenges of Single Page Applications 110
- Single Page Applications and the Implicit Grant 111
- SPAs and the Authorization Code with PKCE Flow 113
- SPAs with a Backend 115
- Conclusion 119
Hosted By
Vittorio Bertocci
Beginnen Sie Ihre Journey mit Auth0
Profitieren Sie von einer erstklassigen Customer Identity-Lösung mit integrierter Sicherheit.