Industry Best Practices Flashcards

When integrating a modern web application for user sign-in, which protocol is generally recommended for authentication on top of OAuth 2.0?

Answer: OpenID Connect

OpenID Connect adds an identity layer (ID tokens) to OAuth 2.0 for authenticating users in modern apps.

Which OAuth 2.0 flow is the current best practice for single-page and native applications?

Answer: Authorization Code flow with PKCE

Authorization Code with PKCE protects public clients against code interception and replaces the deprecated implicit flow.

Which OAuth 2.0 grant is appropriate for service-to-service communication with no user present?

Answer: Client Credentials

The Client Credentials grant lets a machine client authenticate with its own credentials to obtain an access token.

What is a recommended practice for handling access token lifetimes?

Answer: Use short-lived access tokens with refresh tokens, ideally with rotation

Short-lived access tokens limit exposure if stolen, while rotating refresh tokens maintain usability securely.

In SAML, what best practice helps prevent assertion tampering?

Answer: Digitally signing assertions and validating the signature at the service provider

Signed assertions let the SP verify integrity and that the assertion was issued by the trusted IdP.

Which standard is the industry best practice for automating user provisioning between an identity provider and SaaS applications?

Answer: SCIM

SCIM (System for Cross-domain Identity Management) is a REST-based standard for creating, updating, and deprovisioning users and groups.

An API validates incoming JWT access tokens. Which check is essential?

Answer: Verifying signature, issuer, audience, and expiration

Proper JWT validation confirms the signature, intended audience, trusted issuer, and that the token has not expired.