OAuth 2.0 Course
The delegation protocol, walked step by step - who redirects whom, and why.
Take this course in the learning hubLessons
- The problem OAuth solvesBefore OAuth, letting an app read your data meant handing it your password.
- The four rolesEvery OAuth diagram is confusing until you can name the four parties.
- The authorization code flowThe main flow, walked message by message - including why the code exists at all.
- PKCE: protecting public clientsA mobile app cannot keep a secret, so the code alone is not safe. PKCE fixes that.
- Choosing a grant typeFour grants remain relevant, and two you should never use again.
- Scopes and consentScopes limit what a token can do - and asking for too many loses you users.
- Access tokens and refresh tokensShort-lived access, long-lived refresh - and why that split exists.
- The mistakes that cause breachesFive errors that turn a correct-looking OAuth integration into a vulnerability.
- Public and confidential clientsWhether your client can keep a secret decides the whole flow.
- Redirect URIs and the state parameterTwo checks that stop an attacker stealing the authorisation code.
- OAuth is not authentication - OIDC isThe distinction that causes the most real security bugs.
- Client credentials and service-to-service authThe grant with no user, and the one people misuse most.
- Token exchange and delegationCarrying user identity through a call chain without over-granting.