Advanced OAuth 2.0 Topics

Course Description

Almost every company that exposes an API is moving toward using OAuth 2.0 as a delegation framework. Therefore, OAuth 2.0 is still under active development, and a wide variety of complex deployment scenarios are supported. In this course, we investigate various addendums to OAuth 2.0 that lift the security of almost all OAuth 2.0 aspects.

Learning Objectives

• Describe the technical requirements for proactively revoking OAuth 2.0 tokens
• Explain the challenges of token theft and the potential solutions in the OAuth 2.0 ecosystem
• Mitigate subtle weaknesses in OAuth 2.0 flows by leveraging new specifications
• Analyze the requirements for implementing a delegation scenario
• Assess whether traditional scopes suffice for user consent, and recognize which more fine-grained mechanisms might be more appropriate

Details

Delivery Format: eLearning

Duration: 2 Hours

Level: Advanced

Intended Audience:

• Architects
• Back-End Developers
• Mobile Developers

Prerequisites

• OAuth 2.0 Security
• Securely Accessing APIs Using OAuth 2.0
• Securely Granting Access to an API Using OAuth 2.0

Course Details

Introduction

•  Advanced Scenarios

Strong Client Authentication Mechanisms

• The Concept of Key-Based Client Authentication
• Key-Based Client Authentication with mTLS
• Key-Based Client Authentication with JWTs

Client-Based Token Revocation

• The Need for Token Revocation
• The Token Revocation Endpoint
• Considerations for Token Revocation

Using Resource Indicators

• Typical OAuth 2.0 Access Tokens
•  Using Resource Indicators
• Practicalities for Using Resource Indicators

Strengthening Bearer Tokens

• Strengthening Bearer Tokens with Proof-of-Possession
• Transport-Layer Proof-of-Possession with TLS
• Application-Level Proof-of-Possession with DPoP
• Handling Sender-Constrained Tokens

Delegation in OAuth 2.0 Architectures

• Impersonation Versus Delegation
• The Idea Behind a Token Exchange
• The Token Exchange in Detail
• Additional Considerations

Strengthening the Initialization of a Flow

• The Flow Initialization Request
• Signed Initialization Requests
• Passing Request Objects by Reference
• Pushed Authorization Requests

Advanced Scopes and Consent

• Parametrized Scopes
• Rich Authorization Requests (RAR)
• Security Considerations

Wrapping Up OAuth 2.0

• The Current OAuth 2.0 Landscape Wrapping Up