← All projects

Application Security Engineer

Flask OIDC Authentication App

A reference Flask application that delegates authentication to an OIDC provider with PKCE, refresh tokens and role-based access.

  • Flask
  • Authlib
  • OIDC
  • PKCE
  • JWT
  • Keycloak

Architecture

OIDC IdPFlask AppBrowserUserOIDC IdPFlask AppBrowserUserVisit /protectedGET /protected302 -> /authorize (+PKCE challenge)Authorize requestLogin + MFACredentials302 callback (+ code)GET /callback (code)Token exchange (code + verifier)id_token + access_tokenSet session cookieGET /protected200 + content

Overview

A teaching-grade reference app demonstrating the modern OIDC authorization code + PKCE flow against Keycloak. The repo includes a hardened nginx config, secure cookie strategy and a JWT validation layer.

Roles from the ID token claims are mapped to Flask decorators, so an endpoint protected by @role('admin') is enforced consistently across the application.

Security properties

  1. PKCE on the authorization code flow to defeat code interception.
  2. ID token signature and issuer verification on every request.
  3. Sessions are HttpOnly, SameSite=Lax, Secure, with a sliding inactivity timeout.
  4. Refresh tokens rotated and bound to the session identifier.