Internet Protocols · Cluster
Identity Protocols
OAuth, OIDC, and federation mechanics.
- 01 Delegated Authority: What OAuth's Four Roles Actually Separate Why OAuth replaces password sharing with a scoped, revocable token, and how the split between authorization server and resource server makes that possible.
- 02 Authorization Code Flow: Why the Redirect Carries a Code and Not a Token How the front channel and back channel split the grant, what exact-match redirect URI registration protects, and where state and mix-up defences sit in the exchange.
- 03 PKCE: Binding an Authorization Code to the Client That Asked for It How the code verifier and S256 transformation stop intercepted codes from being redeemed, and why the plain transformation is a fallback rather than an equal.
- 04 Scopes Are Strings, Consent Is Policy: Where Access Limits Actually Live Why the scope parameter is only a request, how authorization servers narrow or refuse it, and what incremental authorization costs in state tracking.
- 05 Refresh Token Rotation and Replay Detection in OAuth 2.0 How one-time-use refresh tokens turn a stolen credential into a detectable event, what the rotation chain costs in storage, and where concurrent use breaks the model.
- 06 Self-Contained Access Tokens and the Cost of Local Validation What a resource server gains and loses when it validates a signed token locally instead of asking the issuer, and where clock skew and key caching change the answer.
- 07 ID Tokens: Validating the Claims That Establish Who the User Is The claim set OpenID Connect adds to a JWT, the ordered checks a client must perform, and why a valid signature is the least interesting part of validation.
- 08 Discovery Metadata and the Key Set Rotation Problem How a well-known document bootstraps trust in endpoints and signing keys, and what an implementation must do when the published key set changes underneath it.
- 09 Client Authentication: Secrets, Assertions, and Certificates What each token endpoint authentication method actually proves, why a shared secret is the weakest of them, and how a signed assertion avoids transmitting one.
- 10 Federated Session State: Logout, Propagation, and the Limits of Single Sign-Out Why a logout at one relying party cannot reliably end sessions at others, how back-channel and front-channel logout differ, and what session identifiers can and cannot carry.