OWASP Top 10 (opens in a new tab)
The official reference for the tools used in this lesson.
Link
MFA and delegated authentication
A second factor defeats stolen passwords. OAuth and OIDC hand identity to a provider — useful, and only if you validate what comes back.
Lesson 3.34m 32sIntermediate7.8k students
Lesson length
4:32What this lesson covers
- Add a second factor without wrecking usability
- Distinguish OAuth authorization from OIDC identity
- Validate tokens and claims on every request
This lesson sits in Authentication Done Right, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.
In this lesson you will
- Add a second factor without wrecking usability
- Distinguish OAuth authorization from OIDC identity
- Validate tokens and claims on every request
Resources
Personal notes are coming soon.