OAuth - the good Parts - Anders Abel - NDC Security 2023

OAuth has been around for more than 10 years now, and has become the standard protocol for token-based security. Like every popular technology that has been growing with its requirements, there are some things which work really well, and some that did not quite stand the test of time.
This talk looks at the essentials you should know about, if you would enter the OAuth ecosystem today. Which protocol flows and extensions should you study, which “dialects” like OpenID Connect are important, and if you decide to dive deeper, what would that “recommended reading” list look like?
Check out our new channel:
NDC Clips:
​‪@ndcclips‬
Check out more of our featured speakers and talks at
ndcconferences...
ndc-security.com/

Great talk. One thing that was unclear was where are the refresh tokens stored. In local storage or in the cookie.

[@vrjb100]

Oauth is a perfect demonstration on how software architects live in a different world than developers.
It would be handy when architects stick to the same terms as developers do, call them roles, not scopes.
In a company the user is not the owner of the data, so the concept of resource owner is wrong and no concept of consent is applicable