How Authentication and Authorization Work for SPAs

preview_player
Показать описание
Authentication and authorization in public clients like single-page applications can be complicated! We'll walk through the Authorization Code flow with Proof Key for Code Exchange (PKCE) extension to better understand how it works and inspect the auth tokens you get back from the process by spinning up a sample app using Okta.

Table of Contents
00:00 Welcome! Let's dive in!
00:16 Avoiding authentication-related attacks
01:27 Understanding Authorization Code flow with Proof Key for Code Exchange
03:40 Spin up an example application in React
04:38 Peek at the application code
05:51 Run the example application and sign in
06:54 Inspect the network calls from the Authorization Code flow
07:22 Finding the token storage location and look at the access and ID tokens
07:56 See the ID token in action within the application
08:30 See the access token in action within the application
08:59 Thanks for watching! Where to go from here

#authentication #authorization #oauth #oauth2 #spa

___________________________________________

Okta is a developer API service that stores user accounts for your web apps, mobile apps, and APIs.

Рекомендации по теме
Комментарии
Автор

I have a Question. In a other video a team member of your company claimed that SPA`s using implicit flow, because of the missing backchannel. But in this video pcke is used for react. So what is actually the right approach here now? Can i use your template and configure it to use a authprovider like keycloak running on our own servers?

hsul-git
visit shbcf.ru