As the follow up to the knowledge base article, I implemented:

• an OAuth 2.0 Authorization Server
• two Resource Servers
• one web based Client App

For simplicity, those four server apps are on the same git repository. They are deployed to four different deployments as four different personalities.

I run those four server apps on the same laptop, so it is better to virtualize them using docker compose

To avoid distraction from the main points of this tutorial, I need to keep the source code size to be minimum. Therefore, the provided source code contains no automated test code. I also want to have the deployment configuration to be minimum, so I don't use production grade servers, such as NGINX and uwsgi

Here is the source code: https://github.com/aldian/auth-server-demo

Production OAuth 2.0 & PKCE Hardening

Always pair Authorization Code grants with PKCE (code_challenge_method=S256), short-lived access tokens, and rotating refresh tokens. Explore the companion OAuth 2.0 Auth Server Portfolio App and Freelance Security & Identity Programmer Guide.