Скачать или смотреть OpenID Connect client authentication: basic auth and client secret post

🔥More exclusive content: https://productioncoder.com/you-decid...
Twitter:   / _jgoebel  
Website: https://jangoebel.com
Blog: https://productioncoder.com
Link to OAuth 2.0 Core RFC: https://datatracker.ietf.org/doc/html...

00:00 Client Authentication in OAuth and OpenID Connect
00:28 Using HTTP Basic Auth (client_secret_basic) to authenticate to the authorization server
01:01 client_secret post client authentication in OAuth and OpenID Connect
01:46 conclusion

In OAuth, confidential clients need to authenticate against the authorization server. The OAuth 2 Core spec explicitly defines two ways on how a client can authenticate against an authorization server - both of which are based on the transmission of shared secrets over an https connection.

The two mentioned client authentication methods are client_secret_post and client_secret_basic. Both of them rely on a shared secret that is transmitted with every request to the authorization server. The difference between them is that with client_secret_basic, the client uses HTTP Basic Auth and transfers the client secret in the Authorization header.

With client_secret_post the client secret is passed form-encoded as the payload in the request to the authorization sever.