Tag: OAuth 2.0

OAuth 2.0 roles and grant types, authorization server discovery, dynamic client registration, token exchange, and authorization code flow hardening with PKCE, PAR, JAR, JARM and mTLS.

• Protected Resource Metadata Is the Missing Piece in OAuth 2.0 Discovery

  4 May, 2025

  • 9 min read

  OAuth 2.0 could automate client registration and AS discovery, but clients still had to hardcode which authorization server protects a given resource. Protected Resource Metadata fixes that. Here's how PRM completes the dynamic integration story, and why AI agents made it urgent.

• Certificate-Bound Access Tokens: How mTLS Makes Stolen Tokens Useless

  26 Apr, 2025

  • 9 min read

  Bearer tokens are usable by anyone who possesses them. Certificate-bound tokens, defined in RFC 8705, bind the access token to the client certificate used in the mTLS handshake, so even if a token is intercepted, it's cryptographically worthless without the matching certificate.

• mTLS for OAuth2 Client Authentication: A Stronger Alternative to Shared Secrets

  25 Apr, 2025

  • 13 min read

  Shared secrets can be stolen, leaked, or brute-forced. mTLS-based client authentication uses certificates to prove private key possession. Learn how to apply TLS handshake–based authentication to meet OAuth 2.0 client authentication requirements.

• PKCE Explained: How It Stops OAuth Code Interception

  24 Apr, 2025

  • 11 min read

  How PKCE (RFC 7636) stops authorization code interception in OAuth 2.0: code_verifier, code_challenge, S256, and a hands-on walkthrough for public clients.

• JARM Explained: Signed OAuth 2.0 Authorization Responses

  20 Apr, 2025

  • 11 min read

  JARM signs OAuth 2.0 authorization responses as JWTs to stop tampering and mix-up attacks. Covers response modes, claims, validation, and a working demo.

• Pushed Authorization Requests (PAR): RFC 9126 Explained

  18 Apr, 2025

  • 13 min read

  Pushed Authorization Requests (RFC 9126) move OAuth request parameters off the browser. How PAR works with JAR, request_uri, and dynamic redirect URIs.

• JWT-Secured Authorization Request (JAR): RFC 9101 Explained

  17 Apr, 2025

  • 9 min read

  JAR (RFC 9101) signs OAuth 2.0 authorization requests as JWTs. Request objects by value and by reference, validation rules, and how JAR differs from OIDC.

• Is the OAuth 2.0 Authorization Code Grant Secure Enough?

  17 Apr, 2024

  • 10 min read

  Seven real weaknesses in the OAuth 2.0 authorization code grant, from code interception to mix-up attacks, and the specs (PKCE, PAR, JAR, JARM) that fix them.

• OAuth 2.0 Token Exchange (RFC 8693) in Practice

  26 Sep, 2023

  • 14 min read

  Practical OAuth 2.0 Token Exchange (RFC 8693): impersonation vs delegation, the act claim, scope down-scoping, cross-domain and workload identity use cases.

• OAuth 2.0 Dynamic Client Registration (DCR) Explained

  20 Apr, 2021

  • 13 min read

  How OAuth 2.0 clients register with an authorization server: out-of-band vs Dynamic Client Registration (RFC 7591) and DCR Management (RFC 7592), with examples.

• OAuth 2.0 Server Discovery with .well-known Metadata

  25 Apr, 2020

  • 8 min read

  How OAuth 2.0 clients discover endpoints using Authorization Server Metadata (RFC 8414) and OpenID Connect Discovery, with real .well-known examples.

• OAuth 2.0 Explained: Roles, Grants, Tokens and Extensions

  19 Apr, 2020

  • 24 min read

  A complete map of OAuth 2.0: roles, grant types, why implicit and password grants are deprecated, token types, introspection, revocation, DCR, OIDC and UMA.

• Preventing BOLA and BFLA: OWASP API Authorization Flaws

  2 Oct, 2019

  • 8 min read

  How to prevent Broken Object Level Authorization (BOLA) and Broken Function Level Authorization (BFLA), top OWASP API risks, using OAuth scopes and policies.