Course Outline

Introduction

  • Overview of OAuth for government
  • Understanding API security in the public sector

OAuth

  • Protocol endpoints for secure communication
  • Scope definitions and management
  • Authorization code flow for web applications
  • Implicit flow for single-page applications
  • Client credentials for machine-to-machine interactions
  • Resource owner password credentials for direct user authentication
  • Long-lived access through the use of refresh tokens
  • Selecting the appropriate response mode for different scenarios
  • Simplifying OAuth with the introduction of OAuth 2.1

Native Applications Best Practices

  • Addressing unique challenges in native applications for government
  • Utilizing PKCE to mitigate risks from stolen tokens
  • Determining the optimal redirect URI for enhanced security

Browser-based Application Best Practices

  • Evaluating the security profile of browser-based applications
  • Implementing OAuth within the browser environment
  • Avoiding issues with SameSite cookies in OAuth flows
  • Enhancing security for browser-based apps using backend for frontend patterns

Extending OAuth

  • Integrating OAuth and Identity with OpenID Connect for government
  • Configuring clients using OAuth metadata for streamlined operations
  • Authorizing Internet of Things (IoT) devices with the OAuth device flow
  • Combining SAML and OAuth with the SAML assertion grant for hybrid environments
  • Securing microservices architecture through token exchange mechanisms

Summary and Next Steps

Requirements

  • Fundamental understanding of web services and API development for government

Audience

  • Software Developers
 7 Hours

Number of participants


Price per participant

Testimonials (5)

Upcoming Courses

Related Categories