Building OAuth from First Principles

IdentityShield Summit '25

A ground-up derivation of OAuth 2.0 and OpenID Connect: starting from the naive 'just share your password' approach and iteratively fixing each flaw — tokens, scopes, redirect URLs, client secrets, authorization codes, state, refresh tokens, ID tokens, and PKCE — until we arrive at the modern authorization-code-with-PKCE flow.

Slides

Building OAuth from First Principles — slide 1

Building OAuth from First Principles — slide 2

Building OAuth from First Principles — slide 3

Building OAuth from First Principles — slide 4

Building OAuth from First Principles — slide 5

Building OAuth from First Principles — slide 6

Building OAuth from First Principles — slide 7

Building OAuth from First Principles — slide 8

Building OAuth from First Principles — slide 9

Building OAuth from First Principles — slide 10

Building OAuth from First Principles — slide 11

Building OAuth from First Principles — slide 12

Building OAuth from First Principles — slide 13

Building OAuth from First Principles — slide 14

Building OAuth from First Principles — slide 15

Building OAuth from First Principles — slide 16

Building OAuth from First Principles — slide 17

Building OAuth from First Principles — slide 18

Building OAuth from First Principles — slide 19

Building OAuth from First Principles — slide 20

Building OAuth from First Principles — slide 21

Building OAuth from First Principles — slide 22

Building OAuth from First Principles — slide 23

Building OAuth from First Principles — slide 24

Building OAuth from First Principles — slide 25

Building OAuth from First Principles — slide 26

Building OAuth from First Principles — slide 27

Building OAuth from First Principles — slide 28

Building OAuth from First Principles — slide 29

Building OAuth from First Principles — slide 30

1 / 30

Use the arrow keys or the buttons to navigate. 30 slides.

✦ Manali Kaswa

© 2025 Manali Kaswa. All rights reserved.