OAuth Flows Named
Name flows; prefer safe modern patterns — practice on 127.0.0.1:8814.
Visual · oauth_flows_named
Auth code (+PKCE), client credentials; avoid implicit. 127.0.0.1:8814.
If you cannot name the flow, you cannot spot when a tutorial is teaching a museum piece — or a trap.
Authorization Code with PKCE is the common browser-app pattern. Client Credentials suits service-to-service without a user. Implicit flow is legacy for SPAs and widely discouraged. Device code exists for input-limited devices. Cyberlium names them so you can read docs — not so you can phish auth codes. Lab on 127.0.0.1:8814. Next: OIDC ID Token Literacy.
1. Authorization Code + PKCE as the default story
Browser apps send the user to the AS, receive a code, exchange it at the token endpoint, preferably with PKCE to bind the code to the client instance.
On YOUR lab, trace the steps with fake endpoints on loopback. Do not intercept real provider traffic on shared Wi-Fi.
Command guide
Try these commands — Authorization Code + PKCE as the default story
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OAuth grant types — https://oauth.net/2/grant-types/ PKCE — https://oauth.net/2/pkce/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
curl -sS "https://httpbin.org/get?grant_type=authorization_code&code_challenge_method=S256" | jq '.args | {grant_type, code_challenge_method}'
curl -sS -I http://127.0.0.1:8814/oauth/authorize 2>/dev/null | head -8 || echo 'YOUR lab authorize endpoint on 8814 when ready'Primary tools to practice this lesson: curl, jq. Reference sites: OAuth grant types (https://oauth.net/2/grant-types/); PKCE (https://oauth.net/2/pkce/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Client credentials and legacy implicit
Client credentials: client id/secret to AS, access token for RS — no human resource owner in the loop. Guard those secrets like API keys.
Implicit returned tokens in front-channel URLs; treat it as historical warning, not a template to rebuild.
3. Ethics
Stealing authorization codes from redirect URIs on a network you do not own is an attack. Lab redirects stay on 127.0.0.1.
Ship a flow cheat strip: code+PKCE, client credentials, implicit=avoid.
4. What you ship: a named-flow cheat strip
Code+PKCE, client credentials, implicit discouraged. Loopback-only redirects. DEMO GATE. No code theft labs on strangers.
5. What you record before the next lesson
Date. Flow strip. File t13-m05-l02-flows-named.txt chmod 600.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
- Wrong: Rebuild implicit for “simplicity.” Sniff café redirects. Phish codes.
- Right: Named flows. Next: OIDC ID Token Literacy.
Mission: name flows before you configure them
1) / STOP if router. 2) Write cheat strip for three flows. 3) Note PKCE purpose in one sentence. Never steal redirect codes.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor what PKCE prevents at a high level — not for a phishing redirect kit.
APPLY: Modern browser apps should prefer:
APPLY: True or False: Client credentials flow is for service-to-service without a user present.
APPLY: Capturing classmates’ auth codes on café Wi-Fi is:
OIDC ID Token Literacy
Part of API Security with AI — OAuth and OIDC Literacy.
OAuth Lab — Roles and Token Shape
Part of API Security with AI — OAuth and OIDC Literacy.
Quiz — OAuth and OIDC
Part of API Security with AI — OAuth and OIDC Literacy.