Modern Authentication
Sessions, passkeys, delegated authorization, tokens, and single sign-on
Trace how modern login actually works, from session cookies and passkeys to OAuth delegation, token lifecycles, JWT validation, and single sign-on. Learn the decisions behind each mechanism, the attacks they defend against, and where the current OAuth Security BCP and OAuth 2.1 direction are taking the ecosystem.
See the Invisible
Interactive simulators visualise what's hidden from view.
Hands-On Labs
Step through executions tick by tick. Manipulate state.
Why, Not Just What
Understand the reasoning behind every design decision.
Quizzes & Cheatsheets
Verify your understanding and keep a quick reference handy.
Get Certified
Earn a shareable certificate to prove your deep expertise.
Become the Engineer Who Supervises AI
As AI generates more code, understanding what that code does becomes more valuable, not less. Someone must verify AI output, debug failures, and make architectural decisions.
Build Your Architectural EdgeStop copying auth flows you cannot defend in a review
Most engineers wire up login by following a provider quickstart, then freeze when asked why the redirect URI must match exactly, whether the refresh token belongs in localStorage, or what happens when a user signs out of one app but not the identity provider. This Deep Dive rebuilds authentication from its actual mechanics: what each cookie attribute, ceremony, grant, and claim defends against. You finish able to choose between sessions, passkeys, and token-based flows for a specific client, and to explain each choice in terms of the attack it prevents.
What You Will Be Able to Do
Choose the right login architecture per client
Decide between server-side sessions, a backend-for-frontend, in-memory tokens, or OS-protected native storage by weighing each option against XSS, CSRF, and token-theft exposure for that specific client type.
Implement OAuth flows that survive real attacks
Apply authorization code flow with PKCE, state correlation, exact redirect URI matching, and issuer identification, and explain which interception, CSRF, or mix-up attack each defense closes.
Validate tokens the way the specs require
Verify JWTs with algorithm allowlists, issuer and audience checks, and JWKS rotation, validate ID Tokens including nonce, and keep tokens for different contexts from being replayed against each other.
What's Covered
Server-side sessions with opaque identifiers, cookie controls like Secure, HttpOnly, and SameSite, fixation prevention, and expiration strategy, then WebAuthn ceremonies where public-key credentials bound to a relying-party origin remove the shared secret that phishing depends on.
How resource owners, clients, authorization servers, and resource servers split responsibility so applications never hold user credentials, why authorization code flow with PKCE became the default, and the Security BCP defenses behind the retirement of implicit and password grants.
Short-lived access tokens, refresh-token rotation with replay detection and family invalidation, storage trade-offs from browser memory to OS keychains, sender-constrained tokens, and JWT validation rules that block algorithm confusion and cross-context replay.
OpenID Connect as the identity layer over OAuth, ID Token validation and subject identifiers as account-linking keys, then the session boundaries SSO creates: independent identity-provider and relying-party sessions, logout propagation, and partial-logout risk.
The Curriculum
Comprehensive Lessons! Each with theory, interactive simulation, and quiz.
Session Authentication and Cookie Security
Passkeys and WebAuthn Ceremonies
OAuth Roles and Delegated Authorization
Authorization Code Flow with PKCE
OAuth Threats and Security BCP Defenses
Token Lifecycles and Client-Specific Storage
JWT Structure and BCP Validation
OpenID Connect Identity and Local Login
Single Sign-On and Federated Session Boundaries
Ready to see what's really happening?
All deep dives included with your subscription. Cancel anytime.