OAuth Reference

Getting Started with OAuth — the problem OAuth solves, the four roles, confidential vs. public clients, the endpoints, and a complete authorization-code round-trip.

How OAuth Evolved — from the proprietary pre-OAuth protocols through OAuth 1.0, 1.0a and WRAP to RFC 6749, the extension decade, and the OAuth 2.1 draft.

OAuth 1.0a — the three-legged dance, the signature base string, the signature methods, and where it still survives.

OAuth 1.0 vs. OAuth 2.0 — each 1.0 limitation and what 2.0 did about it, plus an honest account of what 2.0 gave up in exchange.

Access and Refresh Tokens — bearer vs. sender-constrained, by-value vs. by-reference, the token response, and refresh-token rotation and reuse detection.

ID Tokens vs. Access Tokens — what each one is for, why swapping them is broken, and a comparison of all three token types.

JWT and the JOSE Family — JWS, JWE, JWK and JWA, the claim set, algorithm choice, the classic attacks, JWKS and key rotation, and a resource-server validation checklist.

Opaque Tokens, Introspection and Revocation — introspection, revocation, token status lists, and choosing between JWT and opaque tokens.

Scopes, Claims and Permissions — scopes vs. claims vs. roles, resource indicators, Rich Authorization Requests, step-up, and where the decision belongs.

Choosing an OAuth Flow — a decision tree by client shape, and every grant type with its current status.

Authorization Code and PKCE — every parameter, the iss response parameter, and what state, nonce and PKCE each actually protect.

Client Credentials and Client Authentication — machine-to-machine, and every client-authentication method side by side.

Device Authorization Grant — input-constrained devices, the polling loop, and the cross-device phishing threat.

Token Exchange and Assertion Grants — impersonation vs. delegation, the JWT and SAML bearer grants, and identity chaining.

Legacy Grants: Implicit and Password — how they worked, exactly why both are gone, and what to migrate to.

Native and Mobile Apps — why embedded WebViews are forbidden, in-app browser tabs, the three redirect-URI options, and what a real browser buys you.

Browser-Based Apps (SPAs) — the browser threat model, the backend-for-frontend pattern, and the browser-only variant with its residual risks.

Security Best Practices — the Security BCP as a threat-by-threat checklist, including mix-up attacks, code injection and token leakage.

Sender-Constrained Tokens: DPoP and mTLS — binding a token to a key so a leaked token is useless, and how proof of possession came back.

PAR, JAR and Hardened Profiles — pushed and signed authorization requests, and the FAPI profiles that mandate them.

OpenID Connect — the ID token, nonce, standard claims, UserInfo, and the authentication signals a client can request and verify.

Discovery, Metadata and Client Registration — the well-known documents, protected resource metadata, and dynamic client registration.

Logout and Session Management — RP-initiated, front-channel and back-channel logout, and single logout in a microservice topology.

Social Login and Federation — account linking and the verified-e-mail trap, provider quirks, SAML vs. OIDC, and the broker pattern.

Authentication Methods: Passwordless and 2FA — the passwordless primary methods, 2FA as an additional layer stacked on them, and how the result reaches the client through acr, amr and auth_time.

Testing and Debugging OAuth — running each flow by hand, what the standard error codes really mean, and conformance testing.

Spring Boot Integration: Overview — the three roles a Spring service can play, a protocol-concept to Spring-type dictionary, and what is already documented elsewhere in this repository.

Spring Boot Flow Recipes — one minimal recipe per grant type, including the ones the SpringBoot reference does not already cover.

Spring Boot Authentication Methods — one-time token login, passkeys, multi-factor authentication, what Spring does not implement, and emitting amr/acr/auth_time.

OAuth Cheat Sheet — a one-page, printable summary of the whole section, with a downloadable PDF.