OAuth 2 in Action

Justin Richer, a systems architect, and security researcher Antonio Sanso explain how to use and deploy OAuth 2, the HTTP-based security protocol that lets users allow applications to act on a service for them without handing over full control, an arrangement the authors liken to a valet key for the web. Readers see the protocol from three sides, the client, the authorization server and the protected resource, and build a simple version of each. Other topics include tokens, dynamic client registration, OpenID Connect, User-Managed Access, JOSE, introspection and revocation, common vulnerabilities and protecting REST APIs. Ian Glazer wrote the foreword. Readers need basic programming skills and a working knowledge of HTTP and JSON.

PentesterLab founder Louis Nyffenegger listed it among the books on his bedside table.