Web Security: OAuth and OpenID Connect

Introduction

• Using OAuth 2.0 and OpenID Connect
• What you should know
• How to use code for this course

1. What Is OAuth?

• Describing OAuth 2.0
• Making OAuth 2.0 useful with extensions
• Extending OAuth 2.0 with OpenID Connect

2. Foundational Concepts

• OAuth 2.0 fundamentals
• Touring the OAuth endpoints
• Grant type overview
• Designing and using OAuth scopes
• Using the OAuth playground

3. OAuth Tokens

• OAuth 2.0 tokens
• Validating JWTs
• Handling tokens safely and securely

4. Grant Type: Authorization Code

• Overview: Authorization Code Flow
• When should you use this?
• Lab: Build an example (web app or Postman)
• Auth-Code and PKCE overview
• When should you use PKCE?
• Lab: Build an example (native app or spa)
• Security considerations

5. Grant Type: Resource Owner Password

• Overview: Resource Owner Password flow
• When should you use this?
• Lab: Build an example (curl)
• Security considerations

6. Grant Type: Client Credential

• Overview: Client Credential Flow
• When should you use this?
• Lab: Build an example (curl)
• Security considerations

7. Grant Type: Device Grant Type

• Overview: Device flow
• When should you use this?
• Lab: Build an example (kiosk)
• Security considerations

8. Using an OAuth Architecture

• OAuth recommended practices
• Lab: Configuring an OAuth server in PHP
• Lab: Configuring an OAuth server in Node.js
• OAuth 2.0 as a service using Auth0

9. State of the Industry

• OAuth extensions
• Industry-specific OAuth extensions

Conclusion

• Next steps