I have started a new Youtube video series to explain the concepts of OAuth 2.0 to non-technical people. The series name is “2 minutes OAuth”. As the name suggests, each video will be around two minutes and explains one concept at a time.
The episode #1 explains how OAuth works by taking metro as an example.
You might think
Wait a moment. Is protected resource a train or the gate?
You asking that question is quite correct. In fact, it is one of the shortcomings of the OAuth. It does not distinguish between Policy Enforcement Point and the resource. These are going to be explained later in the series.
For now, what I have in mind for the series are:
- Basic concepts
- Bearer and Sender constrained tokens
- Where are Sender constrained tokens used in RFC6749?
- Different Endpoints in OAuth
- Authorization Request and Response
- Token Request and Response
- Confidential and public clients
- Access tokens and Refresh tokens
- Proof Key for Code Exchange (PKCE)
- Implicit flow and code flow
- Integrity protected authorization response
- JWS Authorization Request (JAR)
- PAP, PDP, PEP
- (… continues)
I might combine some of them, or split one subject to multiple sub-subjects. They are yet to be seen.
To get updates on my youtube channel, you can subscribe to my channel from here.
I hope you will enjoy it.