Skip to content
Hallway
0:00 / 0:00

#oauth2.0#openidconnect#pkce

OpenID Connect & OAuth 2.0 – Security Best Practices - Dominick Baier

NDC Conferences

230K subscribers • 110 videos on Hallway • Conference channel

YouTube
  • Recommended by 1 person: 1 in engineering communities.
  • Presented by Dominick Baier, co-creator of Duende IdentityServer
  • May be out of date. Uploaded 6 years ago, in an area where tools change fast.

Intermediate. Assumes working knowledge.

5.3K views6 years ago1 recommendation

SecurityWeb developmentWeb and application securityCryptographyAPI design

Dominick Baier explains the latest security best practices and threat models for OAuth 2.0 and OpenID Connect.

Since its publication in RFC6749 and RFC6750, OAuth 2.0 has gotten massive traction in the market and became the standard for API protection and the foundation of OpenID Connect. In the meantime, the protocols have been attacked through known implementation weaknesses and anti-patterns, technology has changed and their usage has been expanded to use-cases and higher security environments than originally considered and anticipated. That’s the reason why the IETF has published a number of so called “Best Current Practices” (BCPs) which update the original specs and threat models and give more prescriptive guidance. This talk gives an overview over those BCPs and picks out a couple of the topics for more in-depth discussion. Check out more of our talks, courses, and conferences in the following links: ndcconferences.com/ ndc-security.com/

Why it's here

1 person recommends this

What people say. Recommended as an excellent, clear explanation of OAuth flows, PKCE, and modern security practices for identity services.

u/pdevito3in r/dotnet • Recommends

On “.NET Identity Documentation has broken me”

Dominick from the duende team has some fantastic talks on OAuth and OIDC and was *the* thing that finally helped me wrap my head around all the bs and outdated sources on it. Here’s a couple, but there’s more too - about OAuth flows and best best practices - on BFF’s if you care about front ends - this okta video is decent too but Dominick’s talks are better I think There was a good metaphor of PKCE on a podcast too but I don’t even remember where that is lol
15View on Reddit

u/pdevito3in r/dotnet • Recommends

On “Suggest a practical OAuth2 / OpenID connect / Identity course / book with .Net”

These are some good resources: - link to this video - https://www.scottbrady91.com/identity-server/getting-started-with-identityserver-4 The guys that built duende have a couple workshops each year that I’ve heard are really good
2View on Reddit

u/OTonConsolein r/dotnet • Mentions

How do you become a certified OAuth or OIDC person for .NET? I saw this slide from this NDC talk It says certified openid connect and oauth 2 implementation for .NET. Perhaps I misunderstood what the slide means, maybe it's something to do with duende and MSFT, either way, is there perhaps anything similar I can do to show that I have a good understanding of identity services, oauth 2.x and oidc. This will help me a lot in my career, so asking.
20View on Reddit