Get in Touch

Course Outline

Introduction

  • Overview of OAuth
  • Understanding API security

OAuth

  • Protocol endpoints
  • Scope
  • Authorisation code for web apps
  • Implicit flow for single-page apps
  • Client credentials for machines
  • Resource owner password credentials
  • Long-lived access with refresh tokens
  • Choosing the appropriate response mode
  • Simplifying OAuth with OAuth 2.1

Native Applications Best Practices

  • Unique issues associated with native apps
  • Using PKCE to mitigate stolen tokens
  • Selecting the optimal redirect URI

Browser-based Application Best Practices

  • The security profile of browser-based applications
  • OAuth within the browser
  • Avoiding OAuth vulnerabilities with SameSite cookies
  • Securing browser-based apps with Backend-for-Frontend

Extending OAuth

  • OAuth and Identity with OpenID Connect
  • Configuring clients using OAuth metadata
  • Authorising IoT devices with the OAuth device flow
  • Combining SAML and OAuth via the SAML assertion grant
  • Securing Microservices with token exchange

Summary and Next Steps

Requirements

  • Foundational knowledge of web services and API development

Audience

  • Developers
 7 Hours

Number of participants


Price per participant

Testimonials (3)

Provisional Upcoming Courses (Require 5+ participants)

Related Categories