PRIMITIVE #20Core Distributed Systems Component
OAuth 2.0, OIDC & Distributed Token Authentication
1. What It Is & Why It Exists
The Core Problem: Delegated Authorization vs. Authentication
In distributed architectures, microservices must answer two fundamental security questions:
- Authentication (AuthN - "Who are you?"): Verifying identity. Solved by OpenID Connect (OIDC), an identity layer built on top of OAuth 2.0 that provides standardized ID Tokens (
id_token). - Authorization (AuthZ - "What permissions do you have?"): Delegating access rights to third parties without sharing user passwords. Solved by OAuth 2.0, which issues scoped Access Tokens (
access_token).
Interactive Architecture DiagramSynthesizing vector architecture diagram...
2. OAuth 2.0 Authorization Code Flow with PKCE
For Single-Page Applications (SPAs) and mobile clients that cannot securely store client secrets, PKCE (Proof Key for Code Exchange - RFC 7636) is mandatory to prevent authorization code interception attacks.
Interactive Architecture DiagramSynthesizing vector architecture diagram...
3. Token Formats & Cryptographic Comparison
Comprehensive Comparison Matrix
| Format | Structure | Signature / Encryption | Payload Tampering Defense | Revocation Mechanism | Latency Overhead |
|---|---|---|---|---|---|
| Stateful Session ID | 128-bit Opaque UUID | None (Lookup Key) | Server-side storage validation | Immediate (DEL session:uuid) | (Redis read per RPC) |
| JWT (RS256 / EdDSA) | Header.Payload.Signature | Asymmetric Public Key (RS256 / Ed25519) | Cryptographic signature verification | Bloom filter / Redis blocklist / Short TTL | (Local CPU verification) |
| PASETO (v4.public) | v4.public.<payload>.<sig> | Ed25519 (No alg: none exploit) | Built-in Authenticated Encryption (AEAD) | Short TTL + Refresh token rotation | (Local CPU verification) |
| Passkeys / WebAuthn | FIDO2 Authenticator Assertion | ECDSA / RSA Hardware Key | Phishing-resistant challenge-response | Public key de-registration | Native OS / Secure Enclave |
Part 2: Production Deep-Dive Locked1 Coin = 24 Hours
Unlock Complete Architecture & Production Runbooks
Your Balance:40 Coins
You have explored the free architectural preview (~44%). Spend 1 Coin to unlock the remaining 4 production deep-dive sections for a full 24 hours.
Sections Included in This 24-Hour Pass:
4. Distributed Token Revocation Architecture
5. Critical Edge Cases & Security Failure Modes
6. AWS Reference Architecture
7. Interview Delivery Framework
Keeps page unlocked for exactly 24 hoursSpend coins to fund LLM & compute infrastructure