OAuth 2 in Action (Justin Richer, Antonio Sanso)（Z-Library）

【One-Line Pitch】 A hands-on guide to understanding and deploying OAuth 2.0 securely, written for developers and identity professionals who need to move from "I've heard of OAuth" to building real client, authorization server, and resource server implementations. If you work with APIs and need to protect them without reinventing access control, this book gives you both the protocol mechanics and the practical judgment to avoid common anti-patterns. 【Book Arc】 - **Opening (~0%–10%)**: Introduces OAuth 2.0 as a delegation framework, explains why it exists, and frames the core problem: how to let a client access a protected resource on behalf of a user without handing over full credentials. Sets up the "valet key" mental model and the four actors. - **Early (~10%–35%)**: Walks through the OAuth "dance" in detail — the authorization code grant, front-channel and back-channel communication, endpoints, tokens, and the roles of resource owner, client, authorization server, and protected resource. Establishes the vocabulary and flow diagrams used throughout. - **Middle (~35%–60%)**: Hands-on construction of a working OAuth ecosystem: building a simple client, a protected resource that accepts bearer tokens, and an authorization server. Covers token passing methods, scope-based access control, and refresh tokens for long-lived access. - **Late (~60%–85%)**: Moves into advanced topics — different grant types and client types, token introspection and revocation, dynamic client registration, and the JOSE stack (JWT, JWS, JWE) for token formats. Also covers OpenID Connect and User-Managed Access as extensions. - **Ending (~85%–100%)**: Focuses on implementation risks, anti-patterns, and best practices for deploying OAuth securely in production, including protecting REST APIs and avoiding common pitfalls that arise from OAuth's flexibility. 【Key Takeaways】 - **OAuth is a delegation framework, not an authentication protocol** (Early): It lets a resource owner grant limited access to a client without sharing credentials. Confusing it with login is a common and dangerous mistake. - **The authorization code grant is the workhorse flow** (Early): The client redirects the user to the authorization server, receives a code, then exchanges it for a token on the back channel. This separation is what makes it secure for web apps. - **Bearer tokens are simple but sensitive** (Middle): They can be passed via Authorization header, form body, or query parameter, but the header is preferred. Anyone who holds the token can use it, so transport security and storage matter. - **Scopes divide functionality** (Middle): Different actions require different scopes, allowing a single token to be valid across multiple resource servers while limiting what each client can do. - **Refresh tokens enable long-lived access without user interaction** (Middle): When an access token expires, the client can use a refresh token to get a new one, which is essential when the user is no longer present. - **OAuth's flexibility is its greatest strength and its biggest risk** (Late): Many pieces are optional, which leads to incompatibility and insecure deployments. Following best practices and avoiding anti-patterns is not optional. - **Advanced extensions like OpenID Connect and JOSE build on OAuth** (Late): OpenID Connect adds identity, while JOSE provides signing and encryption for tokens. These are separate specs but commonly used together. - **Implementation risks are real and avoidable** (Ending): The book emphasizes that just because you can deploy OAuth in any way doesn't mean you should. Secure deployment requires understanding the threats and following the spec's security considerations. 【Reading Tips】 - **Deep-read the early chapters on the authorization code grant** — this flow underpins most of the book and the exercises. Skim the acknowledgments and foreword. - **Do the exercises** — the book is built around building a client, authorization server, and protected resource. The hands-on code is where the concepts solidify. - **Pay extra attention to the security chapters near the end** — they distill the anti-patterns and best practices that separate a working demo from a production-safe deployment. - **Use the token and grant type chapters as reference** — when you need to choose a grant type or token format for a real project, revisit the comparisons and trade-offs. - **Don't skip the coverage of scopes and refresh tokens** — these are the practical levers for controlling access and maintaining sessions without user involvement. 【Coverage Limits】 This guide is based on stratified excerpts covering roughly the first half of the book in detail, with lighter coverage of the later chapters on advanced topics and security. Specific implementation details, code listings, and some advanced grant types are not fully represented in the excerpts.