Advanced OAuth Security
What you'll learn
- How to leverage the advanced OAuth specifications for high-security applications
- Learn the details of the FAPI specifications, including the FAPI Security Profile and FAPI Message Signing
- Learn the purpose of JAR, JARM, MTLS, DPoP, HTTP Signatures, and Non-Repudiation
- How to apply HTTP Message Signing and JWTs to achieve non-repudiation for every role in an OAuth exchange
- A basic understanding of HTTP requests, responses, and JSON
- An understanding of the basics of OAuth flows, especially the Authorization Code Flow
- Familiarity with JSON Web Tokens (JWT)
Certain applications need a higher level of security compared to what is part of the core OAuth 2.0 specifications. This course will guide you through the details of FAPI, a set of extensions of OAuth 2.0 that provide additional layers of security throughout the OAuth flows.
This course covers the extensions of OAuth developed by the OAuth Working Group at the IETF as well as the OpenID Foundation, including:
Authorization Server Issuer Identifier (iss)
Pushed Authorization Requests (PAR)
Mutual TLS (MTLS)
Private Key JWT
Demonstration of Proof of Possession (DPoP)
JWT Response for OAuth Token Introspection
JWT-Secured Authorization Requests (JAR)
JWT-Secured Authorization Response Mode (JARM)
This course is for you because...
You've got a solid understanding of the basics of OAuth, and
You're looking to take your knowledge to the next level
You want to ensure the systems you're building are up to the industry standards in security
You want to deepen your understanding of application security and become a technical leader
An understanding of HTTP requests, responses, and JSON
A basic understanding of JSON Web Tokens (JWT)
Familiarity with the OAuth authorization code flow
The content is divided into five parts, beginning with and overview of the OAuth authorization code flow, an overview of the security goals set out by FAPI and related extensions, as well as a description of the types of attacks we are concerned about protecting against. Part two focuses on securing the front channel, where we'll discuss authorization code injection attacks, PKCE, authorization server mixup attacks, and using Pushed Authorization Requests. Part three focuses on the back channel, and discusses the differences between Mutual TLS and Private Key JWT for client authentication. Part four is all about proof-of-possession (sender-constraining) access tokens using Mutual TLS and DPoP. Part five discusses how to achieve non-repudiation throughout each leg of the OAuth flow.
Who this course is for:
- Software architects, application developers, or technical decision makers
- API developers who want to better secure their APIs
- Developers and software architects working in high-security fields working with financial or medical records
Aaron Parecki is a Senior Security Architect at Okta. He is the author of OAuth 2.0 Simplified, a guide to building OAuth apps and servers. He regularly writes and gives talks about OAuth and online security, and is the editor of several specifications in the OAuth working group at the IETF. Aaron has spoken at conferences around the world about OAuth, data ownership, quantified self, and home automation, and his work has been featured in Wired, Fast Company and more.