LESSON 3.3
MFA and delegated authentication
Learn key techniques and workflows in Practical Web Security.
4m
intermediate
7,785 students
Overview
A second factor defeats stolen passwords. OAuth and OIDC hand identity to a provider — useful, and only if you validate what comes back.
In this lesson you will:
- Add a second factor without wrecking usability
- Distinguish OAuth authorization from OIDC identity
- Validate tokens and claims on every request
Pro Tip
Use caching and revalidation wisely to ensure your app stays fast and data remains fresh without unnecessary requests.