OAuth 2.0: Nailed the core framework with hands dirty.

Course Curriculum

Chapter 1: Setup environment

Lecture 1: Course Overview.

Lecture 2: Why don’t we implement an authorization server?

Lecture 3: Choosing between Virtual Machine and Docker

Lecture 4: Planning Development Environment.

Lecture 5: Why don’t I provide a project code?

Lecture 6: Prerequisite checklist.

Lecture 7: Vagrant Up.

Lecture 8: Install KeyCloak

Lecture 9: Configure KeyCloak accessible from host OS.

Chapter 2: Building OAuth’s Client.

Lecture 1: What is OAuth’s Client

Lecture 2: Setup Golang Environment.

Lecture 3: “Hello world” Client-Server Web Application.

Lecture 4: Sketch out OAuth Client.

Lecture 5: Add admin user to Authorization Server.

Lecture 6: Register Client to OAuth server & Obtain Authorization code.

Lecture 7: Processing the Authorization Code response.

Lecture 8: Added Resource Owner Logout Functionality.

Lecture 9: Improve UI & Code Refactoring

Lecture 10: Adding CSS & Improve UI Layout with Bootstrap.

Lecture 11: Exchange for an Access token.

Lecture 12: Extracting Access token.

Lecture 13: Authorization code flow recap.

Lecture 14: Logging

Chapter 3: Building a Protected Resource.

Lecture 1: Protected Resource Overview

Lecture 2: Simple Unprotected Resource

Lecture 3: Client – Resource Communication.

Lecture 4: Protecting Resource

Lecture 5: Access Token Validation Theories.

Lecture 6: Access Token Validation implementation.

Lecture 7: Update the Client to send access token in the request.

Lecture 8: Enforce permission with Access Token Scopes

Lecture 9: Client handles the bad responses from a protected resource.

Lecture 10: Adding scopes to Client Application.

Lecture 11: Offline Access Token Validation Overview.

Chapter 4: Continue building OAuth’s Client the right way.

Lecture 1: Exchange for Access token after redirect.

Lecture 2: Remove Exchange Token Endpoint.

Lecture 3: Your client has a flaw. Fishing for authCode

Lecture 4: Protect your client from cross-site

Lecture 5: Authorization Code flow Summary

Chapter 5: Implicit Grant Flow

Lecture 1: Why implicit Grant

Lecture 2: Implicit Grant flow

Lecture 3: Build a client with React

Lecture 4: Setup React Router and code skeleton.

Lecture 5: Get access Token

Lecture 6: Store Access token in React

Lecture 7: Access protected resources

Lecture 8: Fixing CORS and uses Optional Scope parameter

Lecture 9: Render result in React

Lecture 10: Implicit grant flow Summary.

Chapter 6: Resource Owner Password Credentials Grant

Lecture 1: Resource Owner Password Credentials Grant Flow diagram.

Lecture 2: Resource Owner Password Credentials Grant Flow in action.

Lecture 3: When to use Resource Owner Password Credentials Grant

Chapter 7: Client Credential Grant

Lecture 1: Client credential grant flow.

Lecture 2: Client credential grant flow in action

Chapter 8: Extension Grants

Lecture 1: Extension grants

Chapter 9: Fine-grain Topics

Lecture 1: Refresh token

Chapter 10: Realworld Scenarios

Lecture 1: Use GitHub as Identity Provider (IdP)

Lecture 2: Bad service reuse Access Token problem.

Lecture 3: Solution for Bad service reuse Access Token problem

Lecture 4: Solution analysis for a reused access token.

Lecture 5: Build Evil service

Lecture 6: Protect Good Service From a call by evil service.

Lecture 7: Exerciser Handle unmarshal audience problem.

Lecture 8: Solution Handle unmarshalled audience problem.

Lecture 9: Consent.

Lecture 10: Understand OpenID Connect (OIDC) + Hands-on.

Lecture 11: Interception Attack And Proof Key for Code Exchange (PKCE).

Lecture 12: PKCE concept.

Lecture 13: PKCE in action.

Lecture 14: PKCE in action Continue.

Chapter 11: Course summary

Lecture 1: Course summary

Lecture 2: Useful links

Lecture 3: Thank you, but not goodbye.