World Congress 2026 Europe • Jul 9, 2026 • Session details

Keeping applications secure by evolving OAuth 2.0 and OpenID Connect

Alexander Schwartz

Are your underlying OAuth implementations hiding critical vulnerabilities? Discover how the upcoming OAuth 2.1 standard eliminates wildcard redirects. Learn to enforce strict identity policies seamlessly using Keycloak.

Pause

Mute

Enter Fullscreen

#1 about 4 min

Understanding attacker personas in FAPI 2.0 specifications

Define assumed threat models and attacker capabilities in security protocols.

#2 about 2 min

Securing the transport layer with TLS and DNSSEC

Establish baseline trust by implementing foundational encryption and network safeguards.

#3 about 2 min

Analyzing vulnerabilities in standard OAuth 2.0 authorization flows

Discover how standard authorization redirects expose access codes and refresh tokens.

#4 about 3 min

Adopting OAuth best practices and removing outdated grants

Migrate away from implicit grants and wildcard redirects for enhanced safety.

#5 about 2 min

Enhancing flow privacy using pushed authorization requests

Send authorization parameters directly to the identity provider to prevent manipulation.

#6 about 2 min

Implementing PKCE for secure code-to-token exchanges

Defend against spoofing by verifying clients through cryptographic code challenges.

#7 about 4 min

Securing refresh tokens using demonstration proof of possession

Bind tokens to client ephemeral key pairs generated by the web crypto API.

#8 about 2 min

Authenticating API requests using DPoP headers and nonces

Exchange standard bearer tokens for structurally validated cryptographic proofs.

#9 about 4 min

Enforcing FAPI 2.0 security profiles using Keycloak client policies

Centrally mandate compliant authenticators and strict HTTPS standards during client interactions.

#10 about 2 min

Planning a gradual rollout for updated OAuth standards

Enforce modern specifications methodically without paralyzing your existing application infrastructure.

#11 about 3 min

Accelerating security compliance through deliberate API brownouts

Trigger scheduled temporary outages to identify and fix non-compliant clients.

Matching moments

2:52 min

Implementing IAM with Keycloak and OpenID Connect

Thomas Südbröcker · LIVE

9:45 min

Audience Q&A on fine-grained access and JWT encryption

Philippe De Ryck · LIVE

1:45 min

Reviewing identity endpoints alongside specific Keycloak preview features

Alexander Schwartz

Alexander Schwartz · World Congress 2025

9:56 min

Final code walk-through and audience Q&A session

Germán Álvarez · LIVE

2:01 min

Implementing a layered authentication and authorization stack

Jose Manuel Ortega

Jose Manuel Ortega · Europe 2026 Virtual

3:26 min

Designing APIs for security from day one

Philippe De Ryck · LIVE

More from World Congress 2026 Europe

Building the Nervous System of AI - Michael Kagan (NVIDIA) thumbnail

Building the Nervous System of AI - Michael Kagan (NVIDIA)

Michael Kagan, Sead Ahmetović

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote thumbnail

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote

Christian Heilmann

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend thumbnail

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend

David vonThenen

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes thumbnail

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes

Irina Branovic

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬 thumbnail

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬

Jeremy Murray

Angstfreude - AI and Corporate Culture - The Thrill and the Threat thumbnail

Angstfreude - AI and Corporate Culture - The Thrill and the Threat

Axel Ebert, Karin Krobath

Related videos

Delegating the chores of authenticating users to Keycloak thumbnail

World Congress 2025 • about 1 year ago

Delegating the chores of authenticating users to Keycloak

Alexander Schwartz

Going Beyond Passwords: The Future of User Authentication thumbnail

World Congress 2023 • about 3 years ago

Going Beyond Passwords: The Future of User Authentication

Gift Egwuenu

Accelerating Authentication Architecture: Taking Passwordless to the Next Level thumbnail

LIVE • almost 3 years ago

Accelerating Authentication Architecture: Taking Passwordless to the Next Level

Yedidya Schwartz

MFA? Game over! Watch your protection collapse – live thumbnail

World Congress 2026 Europe • 3 months ago

MFA? Game over! Watch your protection collapse – live

Christoph Menzel

No More Post-its: Boost your login security with APIs thumbnail

World Congress 2024 • about 2 years ago

No More Post-its: Boost your login security with APIs

Alvaro Navarro

Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls thumbnail

World Congress 2026 Europe • 3 months ago

Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls

Martina Kraus

Related articles

DC

Daniel Cranney

Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.

Everyone thinks CISOs make the final call on security tools. But in modern software organisations, adoption starts long before the boardroom, inside CI/CD pipelines, developer workflows, and pull r...

8 months ago

A room full of people at a tech conference

DC

Daniel Cranney

Understanding and Mitigating Common Web Vulnerabilities

Vulnerabilities exist in many forms on the web, and attackers continue to find creative ways to exploit them. Technological advances like the proliferation of AI are of course exciting nd filled wi...

over 1 year ago

An image with neon lighting featuring a globe and a padlock

BB

Benedikt Bischof

Walking Into The Era of Supply Chain Risks

Welcome to this issue of the WeAreDevelopers Live Talk series. This article recaps an interesting talk by Vandana Verma who introduced the audience interesting topic of supply chain risks.About the...

about 4 years ago

Walking Into The Era of Supply Chain Risks

CH

Chris Heilmann

The top 200 passwords of 2024 can be cracked in less than a second

Passwords are a pain and with biometric logins, passkeys and other two factor authentication methods should be a thing of the past. In reality, though, a lot of systems still use username and passw...

almost 2 years ago

The top 200 passwords of 2024 can be cracked in less than a second

From learning to earning

Jobs that call for the skills explored in this talk.

about 2 months ago

Staff Developer Advocate, GitHub Security Lab

Experienced $121k–323k Remote Git Github Databases

29 days ago • Verified

Senior Supply Chain Security Engineer

Expert Remote Linux Kubernetes

Senior Security Architect / Secure Software Developer

Expert €53k OAuth Golang Docker

about 1 month ago

(Senior) Platform Engineer

MARKT-PILOT GmbH

Stuttgart, Germany

Expert Datadog Terraform Prometheus

Senior Security Architect / Secure Software Developer

Expert €53k OAuth Golang Docker

Principal Solutions Architect, Professional Services

€119k–170k Okta Docker OpenID