Flow picker
Given 3 app types (server web app, SPA, machine-to-machine), choose the safest OAuth 2.0 grant and explain in one line each.
Legacy & Roots / Knowledge library
OAuth 2.0
delegated authorization for api access
Why learn OAuth 2.0?
OAuth 2.0 lets users grant limited app access to APIs without sharing their passwords. It standardizes scopes, token lifetimes, and delegated consent across clients, authorization servers, and resource servers.
Where it came from
2007-2010: OAuth 1.0 emerged to avoid password sharing but was hard to implement. 2012: OAuth 2.0 was standardized in RFC 6749 (framework) and RFC 6750 (bearer tokens). OpenID Connect (built on OAuth 2.0) became the common identity layer for login. Security guidance evolved through RFC 6819 and later OAuth 2.0 Security BCP. Current direction: OAuth 2.1 and FAPI profiles push safer defaults and remove weak patterns.
- 2007-2010: OAuth 1.0 emerged to avoid password sharing but was hard to implement.
- 2012: OAuth 2.0 was standardized in RFC 6749 (framework) and RFC 6750 (bearer tokens).
- OpenID Connect (built on OAuth 2.0) became the common identity layer for login.
- Security guidance evolved through RFC 6819 and later OAuth 2.0 Security BCP.
- Current direction: OAuth 2.1 and FAPI profiles push safer defaults and remove weak patterns.
Build your understanding
Work through these exercises in order. Try the task before opening a reference.
- Given 3 app types (server web app, SPA, machine-to-machine), choose the safest OAuth 2.0 grant and explain in one line each.
- Design scopes for a notes API (read, create, delete, admin). Keep least privilege and separate user vs admin paths.
- You received a security report: stolen bearer token used from another device. Propose 3 mitigations using OAuth features and deployment controls.
- Given logs from an auth code + PKCE exchange, identify two likely causes of invalid_grant and the exact fix for each.
- Migrate a legacy implicit-flow SPA to authorization code + PKCE. List endpoint changes, frontend changes, and rollout checks.
More ways to practice
Scope design mini-lab
Design scopes for a notes API (read, create, delete, admin). Keep least privilege and separate user vs admin paths.
Token hardening
You received a security report: stolen bearer token used from another device. Propose 3 mitigations using OAuth features and deployment controls.
Debug invalid_grant
Given logs from an auth code + PKCE exchange, identify two likely causes of invalid_grant and the exact fix for each.
Migration task
Migrate a legacy implicit-flow SPA to authorization code + PKCE. List endpoint changes, frontend changes, and rollout checks.
Documentation and sources
- RFC 6749: OAuth 2.0 Framework (datatracker.ietf.org)
- RFC 6750: Bearer Token Usage (datatracker.ietf.org)
- OAuth 2.0 Security Best Current Practice (datatracker.ietf.org)
- OAuth 2.1 Draft (datatracker.ietf.org)
- OpenID Connect Core 1.0 (openid.net)
Catalog research notes
- OAuth 2.1 draft consolidates best practices and removes risky legacy flows.
- PKCE is now expected for public clients (SPAs and mobile apps).
- Implicit grant and Resource Owner Password Credentials grant are broadly discouraged.
- Sender-constrained tokens (mTLS, DPoP) are gaining adoption to reduce bearer-token replay.