> Markdown version of [/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect?t=358](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect?t=358). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Keeping applications secure by evolving OAuth 2.0 and OpenID Connect

Are your underlying OAuth implementations hiding critical vulnerabilities? Discover how the upcoming OAuth 2.1 standard eliminates wildcard redirects. Learn to enforce strict identity policies seamlessly using Keycloak.

- **Speakers:** [Alexander Schwartz](https://www.wearedevelopers.com/@alexander-schwartz)
- **Event:** World Congress 2026 Europe
- **Published:** July 9, 2026
- **Duration:** 24:07
- **URL:** https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect

## Summary

While OAuth 2.0 and OpenID Connect are firmly established, functional applications frequently obscure underlying vulnerabilities against sophisticated web and network-level threats. To counter threat actors intercepting mobile redirects or monitoring proxy logs, the FAPI 2.0 Security Profile and upcoming OAuth 2.1 standard strictly formalize identity best practices. Key updates include enforcing strict transport layer encryption alongside HSTS, deprecating the resource owner password and implicit grants, and wholly eliminating wildcard redirects to prevent authorization bypasses. Relying on basic security assumptions is no longer sufficient; as the speaker notes, "sometimes it's hard to convince people to do the obvious."

To secure the highly vulnerable authorization protocol layer, application builders must adopt advanced grant types and token constraints. Pushed Authorization Requests (PAR) prevent tampering by sending parameters directly from the out-of-band client to the identity provider, bypassing the browser entirely. Similarly, Proof Key for Code Exchange (PKCE) ensures that only the originating client can exchange an authorization code for a highly sensitive refresh token. For ultimate protection against token exfiltration, Demonstrating Proof of Possession (DPoP) binds access and refresh tokens to an ephemeral client key pair—often generated natively via the browser's Web Crypto API—ensuring that stolen tokens remain entirely useless to external attackers.

Implementing these rigorous standards organization-wide requires robust identity and access management operations. Keycloak, an open-source IAM platform under the CNCF, allows administrators to centrally define and enforce FAPI 2.0 client policies, ensuring that non-compliant authentication flows fail at runtime without manual code review. To accelerate global adoption without causing catastrophic, permanent production failures, teams can implement deliberate "brownouts." By enforcing strict security policies during temporary, scheduled service windows, engineering teams can identify lagging network clients and force developers to upgrade their systems, leveraging "security with a whip" to achieve organization-wide compliance.

**Keywords:** oauth 2.1 standards, fapi 2.0 security profile, openid connect, keycloak IAM, dpop proof of possession, pushed authorization requests, pkce code exchange, web crypto API, wildcard redirect vulnerabilities, implicit grant deprecation, resource owner password grant, sender-constrained tokens, ephemeral client key pair, application security brownouts, IAM client policies

## Chapters

1. **Understanding attacker personas in FAPI 2.0 specifications** (00:02) — Define assumed threat models and attacker capabilities in security protocols.
1. **Securing the transport layer with TLS and DNSSEC** (03:04) — Establish baseline trust by implementing foundational encryption and network safeguards.
1. **Analyzing vulnerabilities in standard OAuth 2.0 authorization flows** (04:23) — Discover how standard authorization redirects expose access codes and refresh tokens.
1. **Adopting OAuth best practices and removing outdated grants** (05:58) — Migrate away from implicit grants and wildcard redirects for enhanced safety.
1. **Enhancing flow privacy using pushed authorization requests** (08:47) — Send authorization parameters directly to the identity provider to prevent manipulation.
1. **Implementing PKCE for secure code-to-token exchanges** (10:12) — Defend against spoofing by verifying clients through cryptographic code challenges.
1. **Securing refresh tokens using demonstration proof of possession** (11:29) — Bind tokens to client ephemeral key pairs generated by the web crypto API.
1. **Authenticating API requests using DPoP headers and nonces** (14:36) — Exchange standard bearer tokens for structurally validated cryptographic proofs.
1. **Enforcing FAPI 2.0 security profiles using Keycloak client policies** (16:33) — Centrally mandate compliant authenticators and strict HTTPS standards during client interactions.
1. **Planning a gradual rollout for updated OAuth standards** (20:09) — Enforce modern specifications methodically without paralyzing your existing application infrastructure.
1. **Accelerating security compliance through deliberate API brownouts** (21:56) — Trigger scheduled temporary outages to identify and fix non-compliant clients.

## Related Moments

- [Implementing IAM with Keycloak and OpenID Connect](https://www.wearedevelopers.com/videos/123-get-started-with-securing-your-cloud-native-java-microservices-applications) (from "Get started with securing your cloud-native Java microservices applications")
- [Audience Q&A on fine-grained access and JWT encryption](https://www.wearedevelopers.com/videos/377-architecting-api-security) (from "Architecting API Security")
- [Reviewing identity endpoints alongside specific Keycloak preview features](https://www.wearedevelopers.com/videos/1558-delegating-the-chores-of-authenticating-users-to-keycloak) (from "Delegating the chores of authenticating users to Keycloak")
- [Final code walk-through and audience Q&A session](https://www.wearedevelopers.com/videos/831-creating-a-routing-app-with-google-maps-api-from-scratch) (from "Creating a routing app with Google Maps API from scratch")
- [Designing APIs for security from day one](https://www.wearedevelopers.com/videos/377-architecting-api-security) (from "Architecting API Security")
- [The current state of enterprise APIs and security trends](https://www.wearedevelopers.com/videos/1574-lessons-learned-from-observing-a-billion-api-requests) (from "Lessons learned from observing a billion API requests")

## Related Articles

- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [The top 200 passwords of 2024 can be cracked in less than a second](https://www.wearedevelopers.com/magazine/502-the-top-200-passwords-of-2024-can-be-cracked-in-less-than-a-second)

## Related Jobs

- [Principal Software Engineer, Identity](https://www.wearedevelopers.com/jobs/ext/1469181-principal-software-engineer-identity) at **GitHub**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Software Engineer II, Security](https://www.wearedevelopers.com/jobs/ext/131510-software-engineer-ii-security) at **GitHub**
- [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio**
- [Staff Engineer - Offensive Security](https://www.wearedevelopers.com/jobs/ext/1226927-staff-engineer-offensive-security) at **Twilio**
- [Security Architect - AI](https://www.wearedevelopers.com/jobs/ext/1581899-security-architect-ai) at **ZEISS Group**