Ask HN: Any comprehensive courses on Auth?

Just to be clear, I'm not a security expert in any way, just learned myself while building things.

So here is what I'd refer to:

https://stackoverflow.com/questions/44133536/is-it-safe-to-s...

Regarding the Firebase, I see an open issue on this, so I guess we are not the only ones wondering :)

https://github.com/firebase/quickstart-nodejs/issues/194

I don't know of any, but here's the resources I've found useful as I've worked in the space (disclosure: I work for an auth vendor, FusionAuth).

* Solving Identity Management In Modern Applications is a great book offering an overview of the entire identity process, including provisioning (adding users), authentication and more. I read and reference the 2019 edition; don't have the 2023 edition but expect it is just as good: https://link.springer.com/book/10.1007/978-1-4842-8261-8

* OAuth2 In Action walks you through building an OAuth2 server from scratch (in JavaScript). You'll learn about the fundamentals of tokens, clients, registration, and more. Very accessible. https://www.manning.com/books/oauth-2-in-action

* The Security Engineering Handbook is great for foundational security knowledge, like 'What does a hash look like, and what makes a good hashing algorithm' as well as a lot of broader security topics: https://www.cl.cam.ac.uk/~rja14/book.html

* FusionAuth's vendor neutral articles: https://fusionauth.io/articles/ . I'd especially call out these two: The Modern Guide to OAuth, which walks through the multiple different ways the OAuth 2 authorization framework can be used: https://fusionauth.io/learn/expert-advice/oauth/modern-guide... (previous HN discussion: https://news.ycombinator.com/item?id=29752918 ), and the Math of Password Hashing: https://fusionauth.io/learn/expert-advice/security/math-of-p...

* The Beer Drinkers Guide to SAML is a great resource for understanding this (still) critical standard, plus just a fun read: https://duo.com/blog/the-beer-drinkers-guide-to-saml

* The RFCs and BCPs (as mentioned). I've also learned a lot by lurking on the OAuth mailing list, which is freely available: https://mailarchive.ietf.org/arch/browse/oauth/

* The Identity Unlocked podcast with Vittorio Bertocci (RIP). This is not about the basics at all, but is a deeper dive into the dev focused side of authentication, and will give you great pointers for more reading: https://identityunlocked.auth0.com/

* The OWASP guides are good but specialized. See for example: https://owasp.org/API-Security/editions/2023/en/0xa2-broken-...

* I have a substack where I talk about aspects of customer identity and access management that I think is pretty good :) : https://ciamweekly.substack.com/

I think this would be a great linkedin learning, udacity or coursera course, but didn't see anything when I searched there. I've put together courses before and it's a ton of work, but hmmm, maybe it'd be fun to do for this topic.

Edit: corrected spelling of Vittorio Bertocci's name.

As mentioned elsewhere, I'd probably start with OAuth2.1 (not quite a standard but well on its way) as this updates the OAuth2 standard, as well as consolidates lots of improvements.

https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-09.htm...

Vittorio Bertocci

Thanks! I corrected the spelling of his name.