oauth2simplified.com Open in urlscan Pro
45.79.83.22  Public Scan

Form analysis
1 forms found in the DOM

Name: mc-embedded-subscribe-form — POST //nicernet.us12.list-manage.com/subscribe/post?u=3da16cdb35a3696d18f3d5001&id=3565daa7a4

<form action="//nicernet.us12.list-manage.com/subscribe/post?u=3da16cdb35a3696d18f3d5001&amp;id=3565daa7a4" method="post" id="mc-embedded-subscribe-form" name="mc-embedded-subscribe-form" class="validate" target="_blank" novalidate="">
  <div id="mc_embed_signup_scroll">
    <div class="mc-field-group">
      <label for="mce-EMAIL">Email Address <span class="asterisk">*</span></label>
      <input type="email" value="" name="EMAIL" class="required email" id="mce-EMAIL" placeholder="enter your email">
    </div>
    <div class="mc-field-group">
      <label for="mce-FNAME">First Name </label>
      <input type="text" value="" name="FNAME" class="" id="mce-FNAME" placeholder="what is your name?">
    </div>
    <div id="mce-responses" class="clear">
      <div class="response" id="mce-error-response" style="display:none"></div>
      <div class="response" id="mce-success-response" style="display:none"></div>
    </div>
    <div style="position: absolute; left: -5000px;" aria-hidden="true"><input type="text" name="b_3da16cdb35a3696d18f3d5001_3565daa7a4" tabindex="-1" value=""></div>
    <div class="clear">
      <input type="submit" value="Keep me updated!" name="subscribe" id="mc-embedded-subscribe" class="button">
    </div>
  </div>
</form>

Text Content

OAUTH 2.0 SIMPLIFIED


FOURTH EDITION, UPDATED NOVEMBER 2021

Paperback
PDF Kindle ePub

OAuth 2.0 Simplified is a guide to building an OAuth 2.0 server. Through
high-level overviews, step-by-step instructions, and real-world examples, you
will learn how to take advantage of the OAuth 2.0 framework while building a
secure API.

Subscribe to my email list to be notified about new books, workshops and more!

Email Address *
First Name





THE NUTS AND BOLTS OF OAUTH 2.0



This course includes the latest recommendations from the OAuth working group
including covering everything from using PKCE for all types of applications to
explaining the motivations behind dropping the Implicit and Password grants from
the spec. These security recommendations and more will be rolled up into the new
OAuth 2.1 update, so this course will give you an excellent head start on
learning the best way to use OAuth going forward!

Topics include: OAuth 2.0, OpenID, PKCE, deprecated flows, JWTs, API Gateways,
and scopes. No programming knowledge needed!

This course covers each of the OAuth flows and applies them to use cases such as
implementing OAuth for web apps, native apps, and SPAs. In addition to learning
how applications can use OAuth to access APIs, you’ll learn how to use OpenID
Connect to get the user’s identity.

If you're building an API, you'll learn the differences and tradeoffs between
different access token formats, how to choose an appropriate access token
lifetime, and how to design scopes to protect various parts of your APIs.

Enroll Now


ADVANCED OAUTH SECURITY



Certain applications need a higher level of security compared to what is part of
the core OAuth 2.0 specifications. This course will guide you through the
details of FAPI, a set of extensions of OAuth 2.0 that provide additional layers
of security throughout the OAuth flows.

Topics include: Pushed Authorization Requests (PAR), JWT Secured Authorization
Request (JAR), JWT Authorization Response Mode (JARM), Mutual TLS (MTLS), DPoP,
Authorization Server Issuer Identifier (iss), and HTTP Signatures.

The content is divided into five parts, beginning with and overview of the OAuth
authorization code flow, an overview of the security goals set out by FAPI and
related extensions, as well as a description of the types of attacks we are
concerned about protecting against. Part two focuses on securing the front
channel, where we'll discuss authorization code injection attacks, PKCE,
authorization server mixup attacks, and using Pushed Authorization Requests.
Part three focuses on the back channel, and discusses the differences between
Mutual TLS and Private Key JWT for client authentication. Part four is all about
proof-of-possession (sender-constraining) access tokens using Mutual TLS and
DPoP. Part five discusses how to achieve non-repudiation throughout each leg of
the OAuth flow.

Enroll Now


STICKERS

Buy Now Buy Now Buy Now


THE LITTLE BOOK OF OAUTH 2.0 RFCS


BUY NOW!

Paperback

This reference guide will help you understand the context of each RFC that is
part of OAuth.

This book is a reproduction of all the RFCs relating to OAuth, everything from
OAuth core RFC6749 to the latest Security Best Current Practice. Each RFC is
prefaced by a short introduction to set the context for why it's important to
the space.


WHY OAUTH?

The OAuth 2.0 authorization framework has become the industry standard in
providing secure access to web APIs. OAuth allows users to grant external
applications access to their data, such as profile data, photos, and email,
without compromising security.

Whether you’re a software architect, application developer, project manager, or
a casual programmer, this book will introduce you to the concepts of OAuth 2.0
and demonstrate what is required when building a server.


ABOUT THE AUTHOR

Aaron Parecki is a Senior Security Architect at Okta with over two decades of
experience in the industry. He is the author of OAuth 2.0 Simplified, and
maintains oauth.net. He has been invited to speak at events around the world
about OAuth, online security, privacy and data ownership. He is a regular
contributor to several specs at the IETF including OAuth 2.1 and GNAP.

Aaron is the co-founder of IndieWebCamp, a yearly worldwide conference on data
ownership and online identity. His work has been featured in Wired, Fast
Company, and made Inc. Magazine’s 30 Under 30 while building a startup that was
later acquired. Aaron holds a B.S. in Computer Science from University of Oregon
and lives in Portland, Oregon.



Questions?
Tweet me and I'd be happy to help!

© 2024 by Aaron Parecki. All rights reserved.

OAuth 2.0 Simplified is published by Okta, Inc.