README.md

Awesome OAuth 2.0 and OpenID Connect

Site

• OAuth on Wikipedia
• OAuth.net by Okta
• OAuth.com by Okta
• OAuth Articles and Posts by Alex Bilbie
• OpenID Connect

Specification

Formal

• The OAuth 2.0 Authorization Framework (RFC 6749)
• The OAuth 2.0 Authorization Framework: Bearer Token Usage (RFC 6750)
• OAuth 2.0 Threat Model and Security Considerations (RFC 6819)
• OAuth 2.0 Token Revocation (RFC 7009)
• JSON Web Signature (JWS) (RFC 7515)
• JSON Web Encryption (JWE) (RFC 7516)
• JSON Web Key (JWK) (RFC 7517)
• JSON Web Algorithms (JWA) (RFC 7518)
• JSON Web Token (JWT) (RFC 7519)
• Examples of Protecting Content Using JSON Object Signing and Encryption (JOSE) (RFC 7520)
• Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants (RFC 7521)
• SAML 2.0 Profile for OAuth 2.0 Client Authentication and Authorization Grants (RFC 7522)
• JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants (RFC 7523)
• OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591)
• OAuth 2.0 Dynamic Client Registration Management Protocol (RFC 7592)
• Proof Key for Code Exchange by OAuth Public Clients (RFC 7636)
• OAuth 2.0 Token Introspection (RFC 7662)
• JSON Web Signature (JWS) Unencoded Payload Option (RFC 7797)
• Authentication Method Reference Values (RFC 8176)
• OAuth 2.0 for Native Apps (RFC 8252)
• OAuth 2.0 Authorization Server Metadata (RFC 8414)
• OAuth 2.0 Device Authorization Grant (RFC 8628)
• OAuth 2.0 Mutual TLS Client Authentication and Certificate-Bound Access Tokens (RFC 8705)
• OAuth 2.0 Token Exchange (RFC 8693)
• JSON Web Token Best Current Practices (RFC 8725)
• The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request(JAR) (RFC 9101)

Draft

Active

• OAuth 2.0 Security Best Current Practice
• OAuth 2.0 for Browser-Based Apps
• The OAuth 2.1 Authorization Framework

Expired & archived

• Reciprocal OAuth (draft-ietf-oauth-reciprocal-04)
• OAuth 2.0 Token Binding (draft-ietf-oauth-token-binding-08)
• OAuth 2.0 Incremental Authorization(draft-ietf-oauth-incremental-authz-04)

Article

• OAuth 2.0 系列文 by Yucheng Chuang
  • (1) 世界觀
  • (2) Client 的註冊與認證
  • (3) Endpoints 的規格
  • (4.1) Authorization Code Grant Flow 細節
  • (4.2) Implicit Grant Flow 細節
  • (4.3) Resource Owner Credentials Grant Flow 細節
  • (4.4) Client Credentials Grant Flow 細節
  • (5) 核發與換發 Access Token
  • (6) Bearer Token 的使用方法
  • (7) 安全性問題
  • 各大網站 OAuth 2.0 實作差異
• OAuth 2 Simplified by Aaron Parecki
• 理解OAuth 2.0 by 阮一峰
• 帮你深入理解OAuth2.0协议

Book

• OAuth 2 in Action
• Getting Started with OAuth 2.0 - Programming Clients for Secure Web API Authorization and Authentication
• Identity and Data Security for Web Development - Best Practices
• OAuth 2.0 – Getting Started in Web-API Security

Playground

• OAUTH.TOOLS
• Google OAuth 2.0 Playground

X

• https://twitter.com/alexxubyte/status/1696180531266715815