Authentication & Security
OAuth2 and Token Lifecycles Without Guesswork
Walk authorization code, refresh rotation, and scoped client credentials with diagrams you can paste into design reviews.
4 weeks Self-paced plus labs Advanced
Overview
Security theater fails in production. Here you trace tokens end to end: storage boundaries for public clients, confidential server flows, and rotation policies that survive incident drills. You will break deliberately misconfigured samples, then rebuild them with least privilege defaults that your security reviewers can follow.
What you practice
- Authorization server lab with rotating refresh tokens
- Scope design studio with misuse cases
- PKCE exercises for mobile-shaped clients
- Confidential client secret hygiene drills
- JWKS rotation rehearsal with staged keys
- Audit log fields your support desk will actually query
Outcomes
- Produce a threat sketch for one of your real clients
- Implement refresh rotation with backoff on transient failures
- Document a token incident runbook your on-call can execute
FAQ
You integrate with an existing OIDC provider. Building a bespoke IdP is out of scope to keep time on integration edges.