The identity federation protocol flows are pretty straight forward (I may be biased!) ... but you should use existing libraries for all the crypto.
Defeating credential stuffing attacks is HARD. That is where services such as Auth0 shine.
Defeating credential stuffing attacks is HARD. That is where services such as Auth0 shine.
Minimizing a credential stuffing attack requires detecting the attack and then adding captchas or other bot mitigation techniques.