Posts

All the articles I've posted.

• Pushed Authorization Requests (PAR): RFC 9126 Explained

  18 Apr, 2025

  • 13 min read

  Pushed Authorization Requests (RFC 9126) move OAuth request parameters off the browser. How PAR works with JAR, request_uri, and dynamic redirect URIs.

• JWT-Secured Authorization Request (JAR): RFC 9101 Explained

  17 Apr, 2025

  • 9 min read

  JAR (RFC 9101) signs OAuth 2.0 authorization requests as JWTs. Request objects by value and by reference, validation rules, and how JAR differs from OIDC.

• Is the OAuth 2.0 Authorization Code Grant Secure Enough?

  17 Apr, 2024

  • 10 min read

  Seven real weaknesses in the OAuth 2.0 authorization code grant, from code interception to mix-up attacks, and the specs (PKCE, PAR, JAR, JARM) that fix them.

• OAuth 2.0 Token Exchange (RFC 8693) in Practice

  26 Sep, 2023

  • 14 min read

  Practical OAuth 2.0 Token Exchange (RFC 8693): impersonation vs delegation, the act claim, scope down-scoping, cross-domain and workload identity use cases.

• OAuth 2.0 Dynamic Client Registration (DCR) Explained

  20 Apr, 2021

  • 13 min read

  How OAuth 2.0 clients register with an authorization server: out-of-band vs Dynamic Client Registration (RFC 7591) and DCR Management (RFC 7592), with examples.

• OAuth 2.0 Server Discovery with .well-known Metadata

  25 Apr, 2020

  • 8 min read

  How OAuth 2.0 clients discover endpoints using Authorization Server Metadata (RFC 8414) and OpenID Connect Discovery, with real .well-known examples.

• OAuth 2.0 Explained: Roles, Grants, Tokens and Extensions

  19 Apr, 2020

  • 24 min read

  A complete map of OAuth 2.0: roles, grant types, why implicit and password grants are deprecated, token types, introspection, revocation, DCR, OIDC and UMA.

• Preventing BOLA and BFLA: OWASP API Authorization Flaws

  2 Oct, 2019

  • 8 min read

  How to prevent Broken Object Level Authorization (BOLA) and Broken Function Level Authorization (BFLA), top OWASP API risks, using OAuth scopes and policies.

• SAML Web Browser SSO Profile: SP and IdP-Initiated Flows

  10 Jun, 2018

  • 16 min read

  SAML 2.0 Web Browser SSO Profile explained: SP-initiated vs IdP-initiated SSO, Redirect and POST bindings, AuthnRequest and Response anatomy, and RelayState.

• SAML IdP Discovery: How Service Providers Find the Right IdP

  13 May, 2018

  • 16 min read

  How a SAML service provider finds a user's identity provider: common domain cookie, identifier-first login, discovery services, and the OASIS discovery profiles.