OAuth 2.0: Nailed the core framework with hands dirty.

The OAuth client retrieves access tokens from the authorization server and uses them to access protected resources, guided by authorization grant types, especially the authorization code grant.

Set up the Go environment by installing Go and adopting Go modules, initialize a module with go mod init, and run a hello world to start an OAuth client.

Implement an OAuth 2.0 client using the authorization code flow, building a landing page, redirect logic, and template handling to drive authentication to the authorization server.

Learn to add an admin user to the keycloak authorization server, start the server, access the administration console, and create realms and clients for OAuth 2.0 setup.

Refactor the ui and code for OAuth 2.0, fix logout text, rename config for clarity, and show authCode and session values to illustrate the authorization code to access token flow.

Exchange an authorization code for an access token via a form URL-encoded POST to the token endpoint, using redirect URI and client credentials, yielding a JWT access token.

Learn to extract the access token from the OAuth 2.0 response and unmarshal the JSON payload into a Go struct like AccessTokenResponse, with expire_in and refresh_token.

Use the access token to access a protected resource by header, body, or query parameter, and validate the token while building and integrating protected resource from scratch into the codebase.

Protect resources with OAuth 2.0 by validating access tokens at the resource server, using the authorization header, form, or query parameter, and enforcing JWT claims and scopes.

Develop and validate access token requests, handle responses, and verify status codes. Strip bearer from tokens, parse JSON into a struct, and confirm token validity.

Learn how access token scopes enforce permissions in OAuth 2.0 by validating tokens with the getBillingService scope, inspecting JWT claims, and decoding scopes with base64 in Go.

Add the getBillingService scope to the access token by configuring default and optional scopes in keycloak for billingApp. Create the scope in client scopes and enable it in the token.

Explore offline access token validation as an alternative to token introspection, and learn how JWT validation, audience, and scope checks secure OAuth 2.0 tokens across protected resources.

Understand the implicit grant flow, where after resource owner authentication the authorization server redirects to the client with an access token in the URL fragment, enabling access to protected resources.

Build a React-based client to explore the implicit grant flow with create-react-app, configure localhost:3000, set client_id, and verify the access_token and token_type bearer in the URL.

Explore how to obtain an access token from the url fragment by inspecting window.location.hash, parsing it with substring(1), split, and reduce to a key-value object for authenticated requests.

Fix the CORS issue by configuring access-control headers and adding optional scope parameters to tokens, then verify billing service access across origins and render UI resources.

Render protected resources in a React implicit client by converting a functional component to a class, managing state with this.state, and using componentDidMount to fetch once.

Explore the implicit grant flow, a variant of authorization code flow for cors workarounds, less secure; learn to build an implicit React client and use an access token via redirect_uri.

Understand resource owner password credential grant in OAuth 2.0, where the resource owner provides credentials to a trusted client to authenticate with the authorization server and obtain an access token.

Demonstrate resource owner password credentials grant flow in OAuth 2.0 using Postman to obtain an access token with grant_type=password, username, and password. Note its simplicity versus the authorization code flow.

Practice the client credential grant flow using Postman and Keycloak, duplicating the request, renaming it to client_credentials, and enabling the service account in billingApp to obtain an access_token.

Explore extension grants in OAuth 2.0, including SAML 2.0 assertion and other custom grant types, and understand how they extend the core 4 standard grants for added security.

Duplicate the billing service to create badBillingService on port 8082 and build evil-service that calls good-service on port 8081, using access tokens and logging to diagnose invalid tokens and timeouts.

Learn how to enforce audience validation in OAuth 2.0 tokens by configuring scopes, client mappers, and audience fields in OpenID Connect, including multiple audiences and token validation scenarios.

Explore how consent works in Keycloak with OAuth 2.0, enable and customize the consent screen, and understand how scopes like email address and basic profile info appear to users.

Explore OAuth 2.0 best practices and a sample attack, then learn how PKCE (RFC 7636) prevents authorization code injection and how to implement secure redirection.

Demonstrate PKCE in action: generate a code_verifier, derive a code_challenge with s256, and send code_challenge and code_challenge_method during authorization to exchange for an access token.

Master PKCE in OAuth 2.0 by implementing code_verifier and code_challenge with sha256 and base64url encoding, testing and validating token exchange.