Book
OAuth 2 in Action
Justin Richer, Antonio Sanso
Summary
Justin Richer and Antonio Sanso teach the practical use and deployment of OAuth 2.0 from three angles: an OAuth client, an authorization server, and a resource server. The book opens with an overview of OAuth and how its components interact, then moves to hands-on construction of each of those three pieces in turn. Later chapters dig into tokens, dynamic client registration, and other advanced topics. The authors describe OAuth as the web equivalent of a valet key: an HTTP-based protocol that lets a user allow an application to act on their behalf with a service, such as Facebook or Google, without handing over full control of the account. By the end, the goal is to build and deploy OAuth confidently and securely on both the client and server sides.
Target Readers
- Developers who need to implement an OAuth client, authorization server, or resource server and want to see all three roles built, not just consumed
- Engineers whose OAuth knowledge comes only from wiring up a library, who need to reason about tokens and dynamic client registration directly
- Backend teams building or reviewing an authorization server rather than only integrating against someone else's
Tags
Colophon
- Publisher
- Shoeisha
- ISBN
- 978-4-7981-5929-4
- Published
- Jan 2019
- List price
- ¥4,620incl. taxMay differ from the actual selling price on Amazon
Get this book
* The link above is an advertisement via Amazon Associates.Related Books
Prerequisites
- Recommended
Ango Gijutsu Nyumon, 3rd Edition (An Introduction to Cryptography)
Alice in the Land of Secrets
Hiroshi Yuki
Reason: Only with a foundation in signatures and public-key cryptography can you correctly understand token-based authorization. OAuth 2.0 is the de facto standard for delegating privileges; learn its grant types and flows from first principles.
- Recommended
Hajimete no Digital Identity (Getting Started with Digital Identity)
Authentication, Authorization, and Identity Management Every Web Service Needs
Ryo Ito
Reason: Once you hold the shape of ID management and identity federation, step into the implementation of the authorization protocol at its core. Working through OAuth 2.0's grants and flows in code clarifies pitfalls like token leakage and redirect URI tampering from first principles.
Next Books
- Recommended
OpenID Connect Nyumon (Introduction to OpenID Connect)
Practical Technical Guide for Application Developers
Kohei Toki
Reason: OAuth 2.0 is fundamentally an authorization protocol, and misusing it for pseudo-authentication breeds vulnerabilities. Advancing to OIDC, which standardizes identity verification, clarifies how to build correct authentication, including ID token validation.