privileged.id

Section · 12 pages

Protocols

The protocols that carry identity between systems, explained from the specifications with real HTTP messages: what each step does, what each token means, and where implementations go wrong.

OAuth 2.0 OAuth 2.0 Delegated authorization for HTTP APIs: who the participants are, which grants still belong in new systems, and what OAuth is not. OAuth 2.0 Authorization code flow with PKCE The one OAuth flow every user-facing client should use, request by request, with the RFC 7636 test vector and the rules from RFC 9700 and RFC 8252. OAuth 2.0 Client credentials grant How a service gets an access token as itself, how it should prove its identity, and how to keep its tokens narrow and short-lived. OAuth 2.0 Device authorization grant Sign-in for TVs, consoles and command-line tools, and the remote phishing attack that abuses the same flow. OAuth 2.0 Access, refresh and ID tokens Three tokens with three different recipients. Using one where another was meant is the root of many OAuth bugs. OAuth 2.0 Scopes and consent Scopes decide how much a client can do; audiences decide where. Consent is where users get tricked. How to design all three. JOSE JSON Web Tokens (JWT) A worked decode of the RFC 7519 example token, the claims that matter, and the validation mistakes behind algorithm confusion attacks. OpenID Connect OpenID Connect The identity layer on OAuth 2.0: what the ID token proves, how to validate it, and how to identify users safely. SAML SAML 2.0 How SAML single sign-on works, and the validation rules a service provider must get right, including the errata that changed them. OAuth 2.0 OAuth security mistakes (RFC 9700) A plain-English, section-by-section summary of the current OAuth security best practice, with the exact requirement strength of each rule. OAuth 2.0 Sender-constrained tokens: DPoP and mTLS Turning stolen tokens into useless strings: how DPoP proofs and certificate-bound tokens work, verified against the RFC examples. Protocols OAuth, OpenID Connect and SAML compared One is for authorization, two are for sign-in, and most organizations run all three. When to use which, and how they fit together.