Back to roadmap
Module 9 · Protocols, Security, ObservabilityDay 08625 min

OAuth 2.1 and OIDC

Delegated authorization vs identity — and why both matter.

← PreviousNext →
Day 086

OAuth 2.1 and OIDC

User
client
SPA
service
AuthZ Server
external
Resource Server
service
Signal path
Authorization code with PKCE
User
client
flow
SPA
service
SPA
service
code
AuthZ Server
external
SPA
service
access_token
Resource Server
service
Memory hook

OAuth 2.1 and OIDC: delegated authorization vs identity

Mental model

design for the day something breaks

Design lens

Implicit flow is deprecated.

Recall anchors
OAuth — authorizationOIDC — identityFlows

Why it matters

OAuth 2.1 grants a client access to a user's resources without sharing credentials. OIDC layers identity on top with ID tokens. Modern best practice: authorization code + PKCE for browsers and mobile.

Deep dive

Authorization code: client redirects user to authorization server; receives code; exchanges for tokens.

PKCE binds the code to the client, defeating interception.

Refresh tokens persist sessions; rotate them and bind to client.

Demo / scenario

SPA logs in via Google.

  1. App generates code_verifier + challenge.
  2. Redirect to Google with challenge.
  3. Google redirects back with code.
  4. App exchanges code+verifier for tokens.

Tradeoffs

  • Implicit flow is deprecated.
  • Refresh-token rotation prevents replay.
  • ID tokens shouldn't be used for API auth — use access tokens.

Diagram

codeaccess_token
User
SPA
AuthZ Server
Resource Server
Authorization code with PKCE.

Mind map

Check yourself

Loading quiz…

Sources & further reading

← PreviousNext →