Building or leveraging an OIDC provider to protect web applications.

In this post, I write about OpenID and OAuth2 providers, and what can you use to build or leverage them to protect your web applications.

Implement OAuth2 Client-Credentials flow with Azure AD and Microsoft Identity Platform.

OAuth2 Client Credentials flow is a protocol to allow secure communication between two web APIs. Specifically, the protocol specifies the flow of obtaining authorization for a client to access protected endpoints of a resource server with no user interaction involved. With Microsoft Identity Platform, Azure portal, Microsoft Authentication Library (MSAL), and .NET core security middleware, you can implement the OAuth2 client credentials flow without much difficulty. In this post, I go over how to leverage those technologies to protect your ASP.NET core web APIs.

Continue reading

How can you trust a JWT to be authentic?

In this post, I am going to share a few things I have learned about JWT token. Specifically, I am going to go over the structure of a JWT and how you can trust the information in the token to be authentic by validating the signature.

Continue reading