OAuth2.0 and OpenID Connect: The Professional Guide
SHARE ON
About this ebook
Authentication and authorization are critical parts of any application. They evolved over the years to meet the challenging requirements of the modern Web. OAuth2.0 and OpenID Connect offer a framework for handling them in an effective way. Learn the best practices in using both standards in different scenarios and application types. This e-book will explain not just the hows, but also the whys of OAuth2.0 and OpenID Connect.
TABLE OF CONTENTS
- Preface 4
- Introduction 5
- Chapter 1 - Introduction to Digital Identity 6
- From User Passwords in Every App... 9
- ...to Directories 11
- Cross-Domain SSO 13
- The Password Sharing Anti-Pattern 18
- Delegated Authorization: OAuth 2.0 20
- Layering Sign In on Top of OAuth 2.0: OpenID Connect 24
- Auth0: an Intermediary Keeping Complexity at Bay 28
- Chapter 2 - OAuth 2.0 and OpenID Connect 30
- OAuth 2.0 Roles 32
- OAuth 2.0 Grants and OIDC Flows 34
- Chapter 3 - Web Sign-In 35
- Confidential Clients 35
- The Implicit Grant with Form Post 37
- A detailed walkthrough 37
- Anatomy of an ID Token 44
- Principles of Token Validation 47
- Metadata and Discovery 50
- Chapter 4 - Calling an API from a Web App 53
- The Authorization Code Grant 53
- Sidebar: Essential Authorization Concepts and Terminology 64
- The Refresh Token Grant 68
- Sidebar: Access Tokens vs. ID Tokens 75
- ID Tokens and the Back Channel 79
- The Userinfo Endpoint 80
- The Hybrid Grant 85
- Client Credentials Grant 85
- Chapter 5 - Desktop and Mobile Apps 92
- Public Clients 92
- Native Applications and the Browser 93
- Meet the PKCE 95
- Desktop Applications and Browsers 95
- The Authorization Code Grant with PKCE 96
- The Problem with Refresh Tokens 101
- The Resource Owner Grant 103
- Other Grants for Native Apps 108
- Chapter 6 - Single Page Applications 110
- The Nature of Single Page Applications 110
- Security Challenges of Single Page Applications 110
- Single Page Applications and the Implicit Grant 111
- SPAs and the Authorization Code with PKCE Flow 113
- SPAs with a Backend 115
- Conclusion 119
Hosted By
Vittorio Bertocci
Start your journey with Auth0
Get best-in-class customer identity, with security built in️.