Far from a comprehensive course, but I found this blogpost really good for understanding OAuth2 and usecases/limitations/footguns: https://www.ory.sh/oauth2-openid-connect-do-you-need-use-cas...