Managing Multiple Identity Providers with Passport.js Strategies
Learn how to use the Strategy pattern in Passport.js to support multiple identity providers while maintaining a unified user session and secure database integration.
Loading…
ReadMeFeed / Community knowledge
OAuth
Real questions. Useful conversations. Find the people who know your stack.
OAuth
Security & identity · #oauth
passportUse Authorization Code Flow with PKCE for Browser-Based OAuth Clients
PKCE lets public clients like SPAs use the OAuth Authorization Code flow without a client secret.
OAuth 2.0 Flow Selection: Authorization Code vs Client Credentials
Choose OAuth 2.0 Authorization Code Flow for user data and Client Credentials Flow for machine-to-machine access.
Why PKCE Is the Default for SPA Authentication in 2024
PKCE replaces the client secret with a per-request cryptographic challenge, making the Authorization Code Flow safe for single-page applications. Here's how it works, a minimal implementation, and the risks it doesn't solve.
PKCE for Public OAuth Clients: Block Authorization Code Interception
PKCE binds the OAuth 2.0 authorization code flow to a client-generated verifier so public clients can redeem codes safely. Includes a Bash example, server validation steps, and limitations.
Securing Public Clients with OAuth 2.0 Authorization Code Grant + PKCE
Learn how PKCE turns the OAuth 2.0 Authorization Code Grant into a safe flow for mobile and single-page apps, with a step-by-step example, trade-offs, and a quick checklist to get you started.
Implementing OAuth 2.0 PKCE for Public Clients
Learn how to add PKCE to OAuth 2.0 authorization code flow for SPAs and mobile apps, preventing authorization code interception with a per‑request verifier and challenge.
Implementing OAuth 2.0 Authorization Code Flow with PKCE for Public Clients
A practical task guide for implementing OAuth 2.0 Authorization Code with PKCE in public clients such as SPAs and mobile apps, covering prerequisites, the code exchange, validation checks, and recovery paths.
OAuth PKCE: Binding Authorization Codes to the Client That Asked for Them
PKCE turns an intercepted authorization code into a dead end by binding it to a client-generated secret. Here is how the flow works, where enforcement still varies, and how to check your server.