OAuth and OIDC

  1. OAuth 2.0 Authorization Grants
    1. Grant Type Overview
      1. Purpose of Different Grants
        1. Selection Criteria
          1. Security Considerations
          2. Authorization Code Grant
            1. Flow Description
              1. Authorization Request
                1. User Authentication
                  1. Authorization Code Issuance
                    1. Token Exchange
                    2. Security Properties
                      1. Code Confidentiality
                        1. Client Authentication
                          1. CSRF Protection
                          2. Use Cases
                            1. Web Applications
                              1. Server-Side Applications
                                1. Confidential Clients
                                2. Implementation Details
                                  1. Redirect URI Validation
                                    1. State Parameter Usage
                                      1. Error Handling
                                    2. Proof Key for Code Exchange
                                      1. Security Problem
                                        1. Authorization Code Interception
                                          1. Public Client Vulnerabilities
                                            1. Mobile App Risks
                                            2. PKCE Mechanism
                                              1. Code Verifier Generation
                                                1. Code Challenge Creation
                                                  1. Challenge Methods
                                                  2. Integration with Authorization Code Flow
                                                    1. Modified Request Parameters
                                                      1. Verification Process
                                                      2. Implementation Requirements
                                                        1. Entropy Requirements
                                                          1. Storage Considerations
                                                            1. Error Handling
                                                          2. Client Credentials Grant
                                                            1. Flow Description
                                                              1. Client Authentication
                                                                1. Token Request
                                                                  1. Token Response
                                                                  2. Use Cases
                                                                    1. Machine-to-Machine Communication
                                                                      1. Service-to-Service Access
                                                                        1. Backend Processes
                                                                        2. Security Considerations
                                                                          1. Client Secret Management
                                                                            1. Scope Limitations
                                                                              1. Token Lifecycle
                                                                            2. Implicit Grant
                                                                              1. Flow Description
                                                                                1. Direct Token Issuance
                                                                                  1. Fragment-Based Response
                                                                                  2. Security Limitations
                                                                                    1. Token Exposure
                                                                                      1. No Refresh Tokens
                                                                                        1. Limited Client Authentication
                                                                                        2. Historical Context
                                                                                          1. Early SPA Requirements
                                                                                            1. Browser Limitations
                                                                                            2. Deprecation Status
                                                                                              1. OAuth 2.1 Changes
                                                                                                1. Migration Recommendations
                                                                                              2. Resource Owner Password Credentials Grant
                                                                                                1. Flow Description
                                                                                                  1. Direct Credential Handling
                                                                                                    1. Token Exchange
                                                                                                    2. Security Risks
                                                                                                      1. Credential Exposure
                                                                                                        1. Phishing Vulnerabilities
                                                                                                          1. Trust Requirements
                                                                                                          2. Limited Use Cases
                                                                                                            1. Legacy System Migration
                                                                                                              1. Trusted First-Party Applications
                                                                                                              2. Deprecation Status
                                                                                                                1. Security Concerns
                                                                                                                  1. Alternative Recommendations

                                                                                                              Previous

                                                                                                              5. Scopes and Permissions

                                                                                                              Go to top

                                                                                                              Next

                                                                                                              7. OpenID Connect Identity Layer