This workshop is part of our Enterprise Readiness Workshop series.
Read more
Aaron Parecki
Aaron Parecki is a Senior Security Architect at Okta. He is the author of OAuth 2.0 Simplified, and maintains oauth.net. He regularly writes and gives talks about OAuth and online security. He is an editor of several internet specs, and is the co-founder of IndieWebCamp, a conference focusing on data ownership and online identity. Aaron has spoken at conferences around the world about OAuth, data ownership, quantified self, and home automation, and his work has been featured in Wired, Fast Company and more.
All posts by Aaron Parecki
Ready to move beyond MVP in the journey of adding enterprise-ready identity in your SaaS app? With the must-have functionality in place, you're ready to make your app stand out, get noticed by enterprise customers, and handle user provisioning and automation that can scale!
Read moreThe Identity of OAuth Public Clients
8 min read
I recently got back from a series of events filled with lots of interesting discussions around various OAuth-related topics. At the official IETF meeting in Vienna back in March, I presented the latest work on OAuth 2.1 and we discussed and made progress on some of the current open issues.…
Read moreYou know how you will see an ad on Instagram for something that you just searched for hours earlier? This is in no small part due to a special API for iOS that allows app developers to track your behavior across apps, even those by different developers. Well, all of…
Read moreI'm happy to announce the release of a brand new OAuth cheat sheet published through DZone's Refcardz, "OAuth Patterns and Anti-Patterns". This five-page reference guide covers the latest in OAuth and clarifies some common misunderstandings of applying it to real world use cases. With a focus on OAuth 2.0, OpenID…
Read moreOAuth Sketch Notes - Live Q&A
1 min read
Why do we need PKCE in OAuth? How does PKCE work? What's the difference between the front channel and back channel? Can SPAs even use a back channel?
Read moreSee you at Disclosure 2020!
1 min read
I'm thrilled to share the virtual stage at Disclosure tomorrow! Disclosure is a security conference that's shaping up to have a super amazing schedule! The speaker lineup is fantastic—with talks ranging from cyber warfare to disinformation to social engineering (and much more!).
Read moreIn this video you'll learn about the latest developments in the OAuth and OpenID Connect specs from Aaron Parecki, a regular contributor to the OAuth working group. The latest additions to the specs enable richer experiences and better security for applications using OAuth.
Read moreWhat do OAuth 2.0 access tokens and hotel key cards have in common? It turns out quite a lot! A hotel key card is essentially a physical counterpart to an OAuth access token.
Read moreWhat the Heck is Sign In with Apple?
11 min read
This week at Apple's developer conference WWDC, Apple announced a new feature, "Sign In with Apple" enabling users to sign in to apps using their Apple ID. This new feature is positioned as a secure and privacy-friendly way for users to create an account in apps. Most iOS and Mac…
Read moreIs the OAuth 2.0 Implicit Flow Dead?
7 min read
You may have heard some buzz recently about the OAuth 2.0 Implicit flow. The OAuth Working Group has published some new guidance around the Implicit flow and JavaScript-based apps, specifically that the Implicit flow should no longer be used. In this post we'll look at what's changing with the Implicit…
Read moreYou may not have heard of the Device Flow before, but you've probably used it if you have an Apple TV, Roku or Amazon FireTV! The OAuth 2.0 Device Flow is used to log in to a device using OAuth when the device doesn't have a browser, or also when…
Read moreIt's pretty common for mobile apps to access backend API services to fetch data. It's also pretty common for APIs to require secret keys in order to access them. So how do you securely include API keys in a mobile app? Well, the short answer is you don't. The long…
Read moreDo you run a WordPress site and want to avoid managing a separate list of user accounts? Have you ever wanted to add two-factor authentication to WordPress? Typically WordPress keeps its own database of usernames and passwords, but if you run multiple websites, I'm sure you're familiar with the pain…
Read moreEver found yourself wanting to put an application behind a login form, but dreading writing all that code to deal with OAuth 2.0 or passwords? In this tutorial, I'll show you how to use the nginx auth_request module to protect any application running behind your nginx server with OAuth 2.0,…
Read moreOAuth 2.0 from the Command Line
4 min read
So you've found yourself writing a command line script and needing to talk to an API that uses OAuth 2.0? The typical approaches to getting an OAuth access token from a command line script usually involve copying and pasting the authorization code into the terminal. But we can do better!
Read moreHave you ever found yourself building an app and needing to add authentication, dreading the thought of setting up yet another username and password database? In this post, I'll show you how easy it is to use Okta to add authentication to a simple PHP app in 5 minutes. By…
Read moreThe OAuth 2.0 Password Grant Type is a way to get an access token given a username and password. It's typically used only by a service's own mobile apps and is not usually made available to third party developers.
Read moreThe Implicit Grant Type is a way for a single-page JavaScript app to get an access token without an intermediate code exchange step. It was originally created for use by JavaScript apps (which don't have a way to safely store secrets) but is only recommended in specific situations.
Read moreThere's been a lot of news lately about the new W3C Web Authentication API, also known as WebAuthn. Want to know what it's all about? Let's take a closer look.
Read moreThe Authorization Code Grant Type is probably the most common of the OAuth 2.0 grant types that you'll encounter. It is used by both web apps and native apps to get an access token after a user authorizes an app.
Read moreHello, Okta!
2 min read
My name is Aaron Parecki, and last week I joined Okta on the Developer Advocacy team.
Read more