WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2026 Europe • Jul 9, 2026 • Session details

Keeping applications secure by evolving OAuth 2.0 and OpenID Connect

Alexander Schwartz

Are your underlying OAuth implementations hiding critical vulnerabilities? Discover how the upcoming OAuth 2.1 standard eliminates wildcard redirects. Learn to enforce strict identity policies seamlessly using Keycloak.

Pause
Mute Enter Fullscreen
#1 about 4 min

Understanding attacker personas in FAPI 2.0 specifications

Define assumed threat models and attacker capabilities in security protocols.

#2 about 2 min

Securing the transport layer with TLS and DNSSEC

Establish baseline trust by implementing foundational encryption and network safeguards.

#3 about 2 min

Analyzing vulnerabilities in standard OAuth 2.0 authorization flows

Discover how standard authorization redirects expose access codes and refresh tokens.

#4 about 3 min

Adopting OAuth best practices and removing outdated grants

Migrate away from implicit grants and wildcard redirects for enhanced safety.

#5 about 2 min

Enhancing flow privacy using pushed authorization requests

Send authorization parameters directly to the identity provider to prevent manipulation.

#6 about 2 min

Implementing PKCE for secure code-to-token exchanges

Defend against spoofing by verifying clients through cryptographic code challenges.

#7 about 4 min

Securing refresh tokens using demonstration proof of possession

Bind tokens to client ephemeral key pairs generated by the web crypto API.

#8 about 2 min

Authenticating API requests using DPoP headers and nonces

Exchange standard bearer tokens for structurally validated cryptographic proofs.

#9 about 4 min

Enforcing FAPI 2.0 security profiles using Keycloak client policies

Centrally mandate compliant authenticators and strict HTTPS standards during client interactions.

#10 about 2 min

Planning a gradual rollout for updated OAuth standards

Enforce modern specifications methodically without paralyzing your existing application infrastructure.

#11 about 3 min

Accelerating security compliance through deliberate API brownouts

Trigger scheduled temporary outages to identify and fix non-compliant clients.

Matching moments

2:52 min

Implementing IAM with Keycloak and OpenID Connect

Thomas Südbröcker · LIVE

9:45 min

Audience Q&A on fine-grained access and JWT encryption

Philippe De Ryck · LIVE

1:45 min

Reviewing identity endpoints alongside specific Keycloak preview features

Alexander Schwartz Alexander Schwartz · WWC 2025

9:56 min

Final code walk-through and audience Q&A session

Germán Álvarez · LIVE

3:26 min

Designing APIs for security from day one

Philippe De Ryck · LIVE

3:15 min

The current state of enterprise APIs and security trends

Pratim Bhosale Pratim Bhosale · WWC 2025

More from World Congress 2026 Europe

Building the Nervous System of AI - Michael Kagan (NVIDIA) thumbnail
29:17
about 1 month ago

Building the Nervous System of AI - Michael Kagan (NVIDIA)

Michael Kagan, Sead Ahmetović

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote thumbnail
19:41
about 1 month ago

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote

Christian Heilmann

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend thumbnail
32:06
about 1 month ago

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend

David vonThenen

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes thumbnail
35:13
about 1 month ago

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes

Irina Branovic

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬 thumbnail
24:23
about 1 month ago

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬

Jeremy Murray

Angstfreude - AI and Corporate Culture - The Thrill and the Threat thumbnail
30:26
about 1 month ago

Angstfreude - AI and Corporate Culture - The Thrill and the Threat

Axel Ebert, Karin Krobath

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Securing AI Agent Infrastructure: Identity, Attestation, and Trust at Scale

Abdel Fane

Founder of OpenA2A

Abdel Fane
Open session

World Congress 2026 North America

It passed auth, then production caught fire

Alex Olivier

Co-founder & CPO @ Cerbos | OpenID AuthZEN Co-chair

Alex Olivier
Open session

World Congress 2026 North America

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

Designing APIs That Survive AI Agents at Scale

Phani Pendurthi

Mastercard, Principal Software Engineer

Phani Pendurthi
Open session

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali

Related videos

Delegating the chores of authenticating users to Keycloak thumbnail
23:42
WWC 2025 • 12 months ago

Delegating the chores of authenticating users to Keycloak

Alexander Schwartz

Going Beyond Passwords: The Future of User Authentication thumbnail
27:55
WWC 2023 • almost 3 years ago

Going Beyond Passwords: The Future of User Authentication

Gift Egwuenu

Accelerating Authentication Architecture: Taking Passwordless to the Next Level thumbnail
49:52
LIVE • almost 3 years ago

Accelerating Authentication Architecture: Taking Passwordless to the Next Level

Yedidya Schwartz

MFA? Game over! Watch your protection collapse – live thumbnail
28:30
WWC Europe 2026 • about 1 month ago

MFA? Game over! Watch your protection collapse – live

Christoph Menzel

No More Post-its: Boost your login security with APIs thumbnail
16:05
WWC 2024 • almost 2 years ago

No More Post-its: Boost your login security with APIs

Alvaro Navarro

Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls thumbnail
31:16
WWC Europe 2026 • about 1 month ago

Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls

Martina Kraus

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.