Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
The Logic of OAuth 2.0: Roles, Grant Types, Scopes and What RFC 9700 and OAuth 2.1 Bring
OAuth 2.0 is a delegation protocol, not a sign-in protocol. We run the four roles, the front/back channel split, confidential vs public clients, and the authorization code, client credentials and device grants against a Keycloak lab with .NET 10 code; then show why implicit and password grants were removed, what RFC 9700 and the OAuth 2.1 draft bring, and why an access token is not proof of sign-in.
Authorization Code Flow + PKCE Step by Step: state, nonce, PAR and Reading the HTTP Traffic with Keycloak
PKCE binds the code that crosses the front channel to the client that asked for it; a stolen code is useless without the verifier. In a Keycloak lab we read the flow step by step with curl, show what state and nonce prevent, that a code is burned after a wrong verifier and why redirect URIs must match exactly; then we move parameters to the back channel with PAR and trace ASP.NET Core's OIDC handler end to end.
Protecting the API: Access Token Validation, Audience, Scope Policies, Client Credentials and DPoP
An API must accept not every validly signed token, but only one issued for its own audience and carrying the required scope. We wire AddJwtBearer to Keycloak, map scopes to policies, use introspection to show why a signed-out user's JWT still passes, write a DelegatingHandler that caches client credentials tokens, and verify in five scenarios that a stolen DPoP-bound token is useless.
Choosing an Authorization Server: Comparing OpenIddict, Duende IdentityServer, Keycloak and Microsoft Entra ID
The right authorization server depends on what your team can operate: OpenIddict and Duende are frameworks, Keycloak a product, Entra ID a managed service. We run three in the lab, build a capability matrix from discovery documents, show why it must be read with care, and compare licenses, operational load, SAML bridging and why you should not write your own authorization server, as of November 2026.