OAuth2 on a National Level - How to Secure Extremely Sensitive APIs

This session examines HelseID’s security profile for using OAuth to share sensitive health information across systems. It discusses the profile’s requirements, its choices, and how it relates to OAuth 2.1 and FAPI 2.0.

Syllabus

OAuth2 on a national scale
Sensitive APIs?
The Norwegian health sector
But what is the problem?
alternatives
Securing an API is easy
The HelseID security profile
OAuth 2.1
FAPI 2.0 security profile
Standard web security
Only confidential clients
Keypairs only
Strict requirements regarding signing algorithms
Only one way to use the protocols
USE A LIBRARY!
code reviews
self-service setup
the core service
In summary