From the course: Web Security: OAuth and OpenID Connect (2019)

Unlock the full course today

Join today to access over 22,500 courses taught by industry experts or purchase this course individually.

Security considerations

Security considerations

From the course: Web Security: OAuth and OpenID Connect (2019)

Start my 1-month free trial

Security considerations

“

- [Man] Now let's talk about how to properly secure both Auth Code and Auth Code plus Pixie. The rules are basically the same. To be honest, these are probably the easiest grant types to secure, because of how they work. First, remember we're often passing around both authentication and authorization information and we have to protect it in transit, therefore we should only send over HTTPS using SSL or TLS. This applies regardless of the grant type so you'll hear it a few more times in this course. Next you must validate the access token before you use it. Once again, this applies regardless of grant type, so get use to hearing this one too. And now for a few things specific to Auth Code or Auth Code plus Pixie, remember that after the user authenticates they get an Auth Code, which is sent back to the application, then the app exchanges that for the actual access token. That code can only be used once and expires in 60…

Contents