The document outlines a presentation agenda covering access control, OAuth history, OAuth flows, implementation steps, and potential issues that may arise. It details the lifecycle of authorization codes and access tokens, including database keying and JWT considerations. Additionally, it addresses common problems such as client secret compromises, access token vulnerabilities, and user revocation of authorization.

1. The API Gatekeeper
Dick Hardt
Monday, November 4, 13

2. Agenda
2
Monday, November 4, 13

3. Agenda
•Access Control Overview
2
Monday, November 4, 13

4. Agenda
•Access Control Overview
•OAuth History
2
Monday, November 4, 13

5. Agenda
•Access Control Overview
•OAuth History
•OAuth Flows
2
Monday, November 4, 13

6. Agenda
•Access Control Overview
•OAuth History
•OAuth Flows
•Implementation Steps
2
Monday, November 4, 13

7. Agenda
•Access Control Overview
•OAuth History
•OAuth Flows
•Implementation Steps
•What can go wrong?
2
Monday, November 4, 13

8. Agenda
•Access Control Overview
•OAuth History
•OAuth Flows
•Implementation Steps
•What can go wrong?
•Q & A
2
Monday, November 4, 13

9. Authorization Code
3
Monday, November 4, 13

10. Authorization Code
•key into database
3
Monday, November 4, 13

11. Authorization Code
•key into database
–user, scope, app id, expiry (5 min)
3
Monday, November 4, 13

12. Authorization Code
•key into database
–user, scope, app id, expiry (5 min)
•token (self contained)
3
Monday, November 4, 13

13. Authorization Code
•key into database
–user, scope, app id, expiry (5 min)
•token (self contained)
–user, scope, app id, expiry (5 min)
3
Monday, November 4, 13

14. Authorization Code
•key into database
–user, scope, app id, expiry (5 min)
•token (self contained)
–user, scope, app id, expiry (5 min)
–JWT
3
Monday, November 4, 13

15. Access Token Lifecycle
4
Monday, November 4, 13

16. Access Token Lifecycle
•key into database
4
Monday, November 4, 13

17. Access Token Lifecycle
•key into database
–user, scope, app id, expiry, status
4
Monday, November 4, 13

18. Access Token Lifecycle
•key into database
–user, scope, app id, expiry, status
•token (self contained)
4
Monday, November 4, 13

19. Access Token Lifecycle
•key into database
–user, scope, app id, expiry, status
•token (self contained)
–user, scope, app id, expiry (60 minutes)
4
Monday, November 4, 13

20. Access Token Lifecycle
•key into database
–user, scope, app id, expiry, status
•token (self contained)
–user, scope, app id, expiry (60 minutes)
–JWT
4
Monday, November 4, 13

21. Access Token Lifecycle
•key into database
–user, scope, app id, expiry, status
•token (self contained)
–user, scope, app id, expiry (60 minutes)
–JWT
•Refresh token
4
Monday, November 4, 13

22. Access Token Lifecycle
•key into database
–user, scope, app id, expiry, status
•token (self contained)
–user, scope, app id, expiry (60 minutes)
–JWT
•Refresh token
–user, scope, app id, expiry / status
4
Monday, November 4, 13

23. Access Token Lifecycle
•key into database
–user, scope, app id, expiry, status
•token (self contained)
–user, scope, app id, expiry (60 minutes)
–JWT
•Refresh token
–user, scope, app id, expiry / status
–JWT
4
Monday, November 4, 13

24. API Authorization Middleware
implementation dependent
Monday, November 4, 13

25. X-RateLimit-Limit: 500
X-RateLimit-Remaining: 432
Monday, November 4, 13

26. Developer Documentation /
Sandbox
Monday, November 4, 13

27. Developer Documentation /
Sandbox
Monday, November 4, 13

28. What can go wrong?
8
Monday, November 4, 13

29. What can go wrong?
•Compromise of client secret
8
Monday, November 4, 13

30. What can go wrong?
•Compromise of client secret
•Compromise of access tokens (server)
8
Monday, November 4, 13

31. What can go wrong?
•Compromise of client secret
•Compromise of access tokens (server)
–Developer rests client secret
8
Monday, November 4, 13

32. What can go wrong?
•Compromise of client secret
•Compromise of access tokens (server)
–Developer rests client secret
–All access tokens are invalidated
8
Monday, November 4, 13

33. What can go wrong?
•Compromise of client secret
•Compromise of access tokens (server)
–Developer rests client secret
–All access tokens are invalidated
–Refresh tokens still work, but require new secret
8
Monday, November 4, 13

34. What can go wrong?
•Compromise of client secret
•Compromise of access tokens (server)
–Developer rests client secret
–All access tokens are invalidated
–Refresh tokens still work, but require new secret
•Compromise of access token (client)
8
Monday, November 4, 13

35. What can go wrong?
•Compromise of client secret
•Compromise of access tokens (server)
–Developer rests client secret
–All access tokens are invalidated
–Refresh tokens still work, but require new secret
•Compromise of access token (client)
–User revokes authorization
8
Monday, November 4, 13

36. What can go wrong?
•Compromise of client secret
•Compromise of access tokens (server)
–Developer rests client secret
–All access tokens are invalidated
–Refresh tokens still work, but require new secret
•Compromise of access token (client)
–User revokes authorization
•Resolution is self service
8
Monday, November 4, 13