OAuth 2.0, OpenID Connect, SAML & JWTs¶

These protocols power "Log in with Google," enterprise SSO, and API authorization. Know what each does.

Authentication vs Authorization (again)¶

• Authentication = proving identity (OpenID Connect, SAML).
• Authorization = granting access to resources (OAuth 2.0).

OAuth 2.0 — Delegated Authorization¶

OAuth lets an app access resources on your behalf without getting your password.

You → "Let App X read my calendar" → Google issues App X an access token (scoped, time-limited) → App X uses the token to call the Calendar API

Key terms: resource owner (you), client (App X), authorization server (Google), access token, scope.

Use the Authorization Code flow with PKCE for web and mobile apps. Avoid the legacy Implicit flow.

OpenID Connect (OIDC)¶

OIDC is a thin authentication layer on top of OAuth 2.0. It adds an ID token (a JWT) proving who the user is. "Log in with Google/Apple" is OIDC.

SAML¶

The XML-based SSO standard common in enterprises. The Identity Provider (IdP) sends a signed SAML assertion to the Service Provider (SP). Functionally similar to OIDC, just older and XML-heavy.

JSON Web Tokens (JWT)¶

A JWT is a compact, signed (not necessarily encrypted) token with three parts:

header.payload.signature eyJhbG.. . eyJzdWI.. . SflKxw...

• Header — algorithm & type.
• Payload — claims (user id, roles, expiry). Readable by anyone — never put secrets here.
• Signature — verifies integrity using a secret or the issuer's private key.

JWT Security Pitfalls¶

1. 1.alg: none — reject unsigned tokens; pin the expected algorithm.
2. 2.Algorithm confusion (RS256 → HS256) — validate the algorithm server-side.
3. 3.No expiry / long-lived tokens — set short exp; use refresh tokens.
4. 4.Can't easily revoke — maintain a denylist or keep access tokens short-lived.
5. 5.Storing JWTs in localStorage — exposes them to XSS; prefer HttpOnly cookies for browser sessions.

Choosing¶