JWT and OAuth
- Category
- Developer tools
- Docs outline
- 19 sections
Official docs outline
oauth.net- OAuth 2.0 overview
Roles (resource owner, client, authorization server, resource server), delegated authorization, RFC 6749.
- Grant types
Authorization code, client credentials, device code, refresh token, deprecated implicit and password grants.
- Authorization code grant
Front-channel redirect, authorization code exchange at token endpoint, state parameter, redirect URIs.
- PKCE
Proof Key for Code Exchange, code_verifier and code_challenge, protecting public clients, RFC 7636.
- Client credentials grant
Machine-to-machine authentication, service accounts, confidential clients.
- Device authorization grant
Input-constrained devices, user code and verification URI, polling the token endpoint.
- Scopes
Scope parameter, least privilege, granting and requesting permissions.
- Access tokens
Bearer access tokens, opaque vs structured tokens, lifetime, audience.
- Refresh tokens
Long-lived refresh tokens, rotation, refresh grant, revocation on reuse.
- JWT access tokens
JWT profile for OAuth access tokens, claims such as iss, aud, exp, scope, RFC 9068.
- JSON Web Tokens
JWT structure (header, payload, signature), registered claims, signing, base64url, JWS.
- JWT specification (RFC 7519)
Normative JWT definition, claims, validation rules, algorithms.
- JWT best current practices
Algorithm confusion, alg none, validating iss/aud/exp, key management pitfalls.
- OpenID Connect
Identity layer on OAuth 2.0, ID tokens, openid scope, userinfo endpoint, nonce, authentication vs authorization.
- Token introspection and revocation
Introspecting opaque tokens at the authorization server, revoking tokens.
- OAuth security best practice
Current security recommendations: no implicit grant, exact redirect URI matching, PKCE everywhere.
- OAuth 2.1
Consolidation of OAuth 2.0 best practices: mandatory PKCE, removal of implicit and password grants.
- Browser-based and native apps
Public clients, SPA token handling, BFF pattern, native app flows.
- DPoP
Sender-constrained tokens via proof-of-possession to prevent token replay.
Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.
