OAuth2 + OIDC: All of the Specs (2026 Edition)
Current as of August, 2026.
Read article: OAuth2 + OIDC: All of the Specs (2026 Edition)OAuth2
39 articles tagged OAuth2.
PKCE: Proof Key for Code Exchange
One of the biggest misconceptions about OAuth2 is that it is a single protocol. In reality, OAuth2 has evolved considerably over the years as new attack vectors have been discovered and new security mechanisms introduced. One of the most significant of these improvements is Proof Key for Code…
Read article: PKCE: Proof Key for Code Exchange
DPoP: The Missing Security Layer in OAuth2 and OID4VCI
OAuth2 has long suffered from a fundamental weakness: bearer tokens.
Read article: DPoP: The Missing Security Layer in OAuth2 and OID4VCI
DPoP Support Comes to the Identity Protocol Debugger
OAuth2 has always had a fundamental problem: a bearer token is a bearer token. After all, it’s a bearer token.
Read article: DPoP Support Comes to the Identity Protocol Debugger
JWT as Oauth2 Access Tokens & Refresh Tokens— Invalidation: The Awkward Reality
I’ve touched on the topic of using JWT as an Access Token on several previous blog posts:
Read article: JWT as Oauth2 Access Tokens & Refresh Tokens— Invalidation: The Awkward Reality
How Many IETF RFCs Actually Become Standards?
The Internet Engineering Task Force (IETF) has 10K+ published Request For Comments (RFCs) documents. The industry hears about RFCs all the time. But, as the name implies (“request for comments”) that isn’t the final step in the process. A very small number of RFCs are promoted to Internet…
Read article: How Many IETF RFCs Actually Become Standards?The OAuth2/OIDC Debugger Has Learned a New Trick: SAML2 Support Is Here
Identity engineers have a complicated relationship with SAML.
Read article: The OAuth2/OIDC Debugger Has Learned a New Trick: SAML2 Support Is Here
Introducing IDPTools: An Open Source OAuth2 & OpenID Connect Debugger
If you’ve spent any amount of time integrating OAuth 2.0 or OpenID Connect (OIDC), you’ve probably experienced the same cycle:
Read article: Introducing IDPTools: An Open Source OAuth2 & OpenID Connect DebuggerIdentity Protocol Debugger + IDPTools Series
This is a collection of blog posts about my OpenSource Software Project, OAuth2 / OIDC Debugger.
Read article: Identity Protocol Debugger + IDPTools Series
RFC 9068: A JWT-Based OAuth2 Access Token Format Standard
For anyone who has been paying attention, this blog post has been a long-time coming for multiple reasons. First, this is my first blog post in a couple of years — I’ve been heads down on a couple of projects for awhile now. This is literally the first time I’ve “come up for air” since the last…
Read article: RFC 9068: A JWT-Based OAuth2 Access Token Format Standard