MFA and delegated authentication

A second factor defeats stolen passwords. OAuth and OIDC hand identity to a provider — useful, and only if you validate what comes back.

5m
Intermediate

Video thumbnail for MFA and delegated authentication

Video by ByteByteGo · YouTube

Check your understanding

3 questions. Unlocks when you finish the video.

Overview

What this lesson covers

Add a second factor without wrecking usability
Distinguish OAuth authorization from OIDC identity
Validate tokens and claims on every request

This lesson sits in Authentication Done Right, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.

In this lesson you will:

Add a second factor without wrecking usability
Distinguish OAuth authorization from OIDC identity
Validate tokens and claims on every request

Resources

OWASP Top 10The official reference for the tools used in this lesson.