39 articles tagged OAuth2.
There are several approaches to securing APIs. Every API Gateway vendor supports the same core set of API security mechanisms. API Keys and OAuth2 are two examples of these authentication (plus authorization) mechanism. When should one be used over the other? What are the differences between the…
Read article: OAuth2 Access Tokens vs API Keys — Using JWTsThis post continues where “SECURELY USING THE OIDC AUTHORIZATION CODE FLOW AND A PUBLIC CLIENT WITH SINGLE PAGE APPLICATIONS” left off on the topic of securing Single Page Applications (SPAs). That post describes an architecture where the SPA running in the browser (User Agent)is acting as the…
Read article: More Single Page Application (SPA) and OAuth2 ThoughtsThis article is a place my other blog posts can point at when referencing this series.
Read article: OAuth2 Access Tokens and Multiple Resources SeriesThis post was originally published as “OAUTH2 ACCESS TOKEN USAGE STRATEGIES FOR MULTIPLE RESOURCES (APIS): PART 3” on the Ping Identity Blog.
Read article: OAUTH2 ACCESS TOKEN USAGE STRATEGIES FOR MULTIPLE RESOURCES (APIS): PART 3This post was originally published as “OAUTH 2 ACCESS TOKEN USAGE STRATEGIES FOR MULTIPLE RESOURCES (APIS): PART 2” on the Ping Identity Blog.
Read article: OAuth2 Access Token Usage Strategies for Multiple Resources (APIs) Part 2This post was originally published as “OAUTH 2 ACCESS TOKEN USAGE STRATEGIES FOR MULTIPLE RESOURCES (APIS): PART 1” on the Ping Identity Blog.
Read article: OAUTH 2 ACCESS TOKEN USAGE STRATEGIES FOR MULTIPLE RESOURCES (APIS): PART 1Earlier this year, I was working on a project that was using AWS Cognito (as the identity stack) and the AWS API Gateway (as the front-door to all of the API calls). AWS Cognito is a relatively new player in the identity space. It doesn’t support the full OAuth2 or OpenID Connect specs, but, does…
Read article: OpenID Connect Authorization Code Flow with AWS CognitoUpdate (01/31/2021) — Since I originally wrote this article, a proposal has been created that officially describes using JSON Web Tokens (JWTs) as OAuth2 Access Tokens. As of this date, it has not yet been adopted as an official RFC.
Read article: The Benefits of JWTs as OAuth2 Access TokensIt’s 2018. At this point, application developers should not be writing code that directly implements HTTPS calls to OAuth2 or OpenID Connect endpoints, token caching, token refreshes, token validation, or other such activities. An authentication library should be used that implements these…
Read article: OpenID Connect (OIDC) and OAuth2 Authentication LibrariesI’ve written blog posts on the following identity protocols. I’m creating this post to have a central place to refer to “identity protocols”. I will periodically update this list as I publish new posts with related material.
Read article: The Common Identity Protocols
