A visual journey to demystifying OAuth2 and OIDC - why do they exist and how to properly use them to secure your applications

The talk starts with the problem of letting an application act for a user without handing it the user's password, and of establishing trust between parties that do not trust each other. Everyday analogies, like a parent granting a child a snack or a driving license checked by a police officer, frame authorization as separate from authentication.

The core covers the OAuth 2.0 grant types, including authorization code, implicit, resource owner password and client credentials, and explains why implicit is discouraged since tokens reach the browser. It separates OAuth 2.0 for authorization from OpenID Connect, which adds an identity layer and an ID token. JWTs are broken into header, payload and signature, with a real Cognito token used to show claims such as subject, scope and audience. Refresh tokens are presented as the way to renew short-lived access without repeated logins.

The session closes with bearer tokens sent in an authorization header, and how a resource server validates signature, expiry and scope, returning 401 with a WWW-Authenticate challenge on failure. The practical takeaway is to use established libraries or managed identity providers instead of building this logic yourself, while still understanding the flows well enough to configure them. Callback URLs and client registration are noted as the hardest part of initial setup, and chained providers such as SAML bridged to OIDC as a frequent source of misconfiguration.