SlideShare a Scribd company logo

Stateless token-based authentication for pure front-end applications

Alvaro Sanchez-Mariscal
Alvaro Sanchez-Mariscal

The document discusses stateless token-based authentication mechanisms for front-end applications, focusing on OAuth 2.0 and JSON Web Tokens (JWT). It contrasts traditional stateful authentication in monolithic applications with the demands of microservices, stressing the need for statelessness. A detailed agenda is provided, covering topics like authentication methods, OAuth roles, and practical implementation considerations for developers.

Technology
1 of 73
Downloaded 249 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
Stateless token-based authentication for pure front-end applications MADRID · NOV 21-22 · 2014 Álvaro Sánchez-Mariscal Web Architect Daniel Ortega Segura Senior Grails Developer
About us - Álvaro Sánchez-Mariscal ● Passionate Software Developer. ● Worked at IBM BCS, BEA Systems and Sun Microsystems. ● Founded Salenda and Escuela de Groovy. ● Working now at as a Web Architect. ● Living between Madrid and Gibraltar. MADRID · NOV 21-22 · 2014
About us - Daniel Ortega Segura MADRID · NOV 21-22 · 2014 ● Enthusiast guitarist ● Rubik’s cubes freak ● Senior Grails Developer at
MADRID · NOV 21-22 · 2014 About us - ● HTML5 games platform. ● We provide game developers a Javascript SDK. ● Server side logic and maths are handled by our industry certified game engines. ● Seamless integration with several casinos. ● Check out play.odobo.com and play for free!
MADRID · NOV 21-22 · 2014 Agenda 1. Authentication in monolithic applications vs microservices. 2. Introduction to OAuth 2.0. 3. Achieving statelessness with JWT. 4. Demo. 5. Q&A.
MADRID · NOV 21-22 · 2014 Agenda 1. Authentication in monolithic applications vs microservices. 2. Introduction to OAuth 2.0. 3. Achieving statelessness with JWT. 4. Demo. 5. Q&A.
MADRID · NOV 21-22 · 2014 Agenda 1. Authentication in monolithic applications vs microservices. 2. Introduction to OAuth 2.0. 3. Achieving statelessness with JWT. 4. Demo. 5. Q&A.
MADRID · NOV 21-22 · 2014 Agenda 1. Authentication in monolithic applications vs microservices. 2. Introduction to OAuth 2.0. 3. Achieving statelessness with JWT. 4. Demo. 5. Q&A.
MADRID · NOV 21-22 · 2014 Agenda 1. Authentication in monolithic applications vs microservices. 2. Introduction to OAuth 2.0. 3. Achieving statelessness with JWT. 4. Demo. 5. Q&A.
Authentication in monolithic apps ● Historically, authentication has always been a stateful service. ● When moving to Single-Page Applications, and/or having mobile clients, it becomes an issue. ● If you are build a REST and stateless API, your authentication should be that way too. MADRID · NOV 21-22 · 2014
Microservices by http://martinfowler.com/articles/microservices. html MADRID · NOV 21-22 · 2014
Microservices by http://martinfowler.com/articles/microservices. html MADRID · NOV 21-22 · 2014
Authentication and microservices ● Authentication: to verify the identity of the user given the credentials received. ● Authorization: to determine if the user should be granted access to a particular resource. ● In a microservices context: ○ Authentication can be a microservice itself. ○ Authorization is a common functionality in all of them. MADRID · NOV 21-22 · 2014
Authentication and microservices Catalog DB Invoicing DB MADRID · NOV 21-22 · 2014 Javascript front-end UI Mobile app Authentication Service Shopping cart Service Catalog Service Orders Service Shipping Service User repository Shipping partners Web Backend Mobile Backend
MADRID · NOV 21-22 · 2014 Agenda 1. Authentication in monolithic applications vs microservices. 2. Introduction to OAuth 2.0. 3. Achieving statelessness with JWT. 4. Demo. 5. Q&A.
MADRID · NOV 21-22 · 2014 Introducing OAuth 2.0 An open protocol to allow secure authorization in a simple and standard method from web, mobile and desktop applications.
MADRID · NOV 21-22 · 2014 OAuth 2.0: roles Resource Owner: the person or the application that holds the data to be shared. Resource Server: the application that holds the protected resources. Authorization Server: the application that verifies the identity of the users. Client: the application that makes requests to the RS on behalf of the RO.
MADRID · NOV 21-22 · 2014 OAuth 2.0: roles Resource Owner: the person or the application that holds the data to be shared. Resource Server: the application that holds the protected resources. Authorization Server: the application that verifies the identity of the users. Client: the application that makes requests to the RS on behalf of the RO.
MADRID · NOV 21-22 · 2014 OAuth 2.0: roles Resource Owner: the person or the application that holds the data to be shared. Resource Server: the application that holds the protected resources. Authorization Server: the application that verifies the identity of the users. Client: the application that makes requests to the RS on behalf of the RO.
MADRID · NOV 21-22 · 2014 OAuth 2.0: roles Resource Owner: the person or the application that holds the data to be shared. Resource Server: the application that holds the protected resources. Authorization Server: the application that verifies the identity of the users. Client: the application that makes requests to the RS on behalf of the RO.
MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow I want to see a list of games
MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Hey, backend, could you please give me a list of games?
MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Sorry mate, this is a protected resource. You will need to present me an access token
MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Hi Google, can I get an access token please? Backend is asking
MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Sure thing sir. I just need to ask a few details to the user first
MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Hi, could you please provide me your credentials? I need to verify your identity
MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow That’s no problem at all. I am bob@gmail.com and my password is secret.
MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow The user is who claims to be. Here is your access token: qfE2KhvKggluHqe7IpTBqZ4qziTQQbKa
MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Hi Backend, this is my token: qfE2KhvKggluHqe7IpTBqZ4qziTQQbKa
MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Hi, I’ve been given qfE2KhvKggluHqe7IpTBqZ4qziTQQbKa. Could you please tell me who it belongs to?
MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Of course. That token is still valid and it belongs to bob@gmail.com.
MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Everything is allright. This is the list of games. Enjoy!
MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Here you are the list of games.Thank you for your business and have a good day!
MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow OAuth 2.0 is a delegation protocol, as this guy has no idea about the credentials of this guy
MADRID · NOV 21-22 · 2014 OAuth 2.0: grant types ● Authorization code: for web server applications. ● Implicit: for JS front-ends and mobile apps. ● Resource Owner Password Credentials: for trusted clients. ● Client credentials: for service authentication.
Authorization code grant ● For server-based applications, where the client ID and secret are securely stored. ● It’s a redirect flow, so it’s for web server apps. ● The client (web server app) redirects the user to the authorization server to get a code. ● Then, using the code and its client credentials MADRID · NOV 21-22 · 2014 asks for an access token.
MADRID · NOV 21-22 · 2014 Authorization code grant http://myServerApp.com
MADRID · NOV 21-22 · 2014 Authorization code grant https://facebook.com/dialog/oauth ?response_type=code &client_id=YOUR_CLIENT_ID &redirect_uri= http://myServerApp.com/oauth &scope=email,public_profile
MADRID · NOV 21-22 · 2014 Authorization code grant hhttttpp::////fmacyeSbeorvoekr.Acopmp.com
MADRID · NOV 21-22 · 2014 Authorization code grant hhttttpp:s/://m/faycSeebrvoeorkA.cpopm.com
MADRID · NOV 21-22 · 2014 Authorization code grant https://myServerApp.com/oauth?code=CODE Finishing authentication...
Authorization code grant Server-side POST request to: https://graph. facebook.com/oauth/access_token With this body: grant_type=authorization_code &code=CODE_FROM_QUERY_STRING &redirect_uri=http://myServerApp.com &client_id=YOUR_CLIENT_ID &client_secret=YOUR_CLIENT_SECRET MADRID · NOV 21-22 · 2014
MADRID · NOV 21-22 · 2014 Authorization code grant Example response: { "access_token": "RsT5OjbzRn430zqMLgV3Ia", "token_type": "Bearer", "expires_in": 3600, "refresh_token": "e1qoXg7Ik2RRua48lXIV" }
MADRID · NOV 21-22 · 2014 Implicit grant ● For web applications running on the browser (eg: AngularJS, etc) or mobile apps. ● Client credentials confidentiality cannot be guaranteed. ● Similar to the code grant, but in this case, the client gets an access token directly.
MADRID · NOV 21-22 · 2014 Implicit grant http://myFrontendApp.com/#/home
MADRID · NOV 21-22 · 2014 Implicit grant https://facebook.com/dialog/oauth ?response_type=token &client_id=YOUR_CLIENT_ID &redirect_uri= http://myFrontendApp.com/#/cb &scope=email,public_profile
MADRID · NOV 21-22 · 2014 Implicit grant hhttttpp:s/://m/faycSeebrvoeorkA.cpopm.com
MADRID · NOV 21-22 · 2014 Implicit grant https://myFrontendApp.com/#/cb?token=TOKEN Finishing authentication...
MADRID · NOV 21-22 · 2014 Password credentials grant ● In this case, client collects username and password to get an access token directly. ● Viable solution only for trusted clients: ○ The official website consumer of your API. ○ The official mobile app consuming your API. ○ Etc.
MADRID · NOV 21-22 · 2014 Password credentials grant
Password credentials grant POST request to: https://api.example. org/oauth/access_token With this body: grant_type=password &username=USERNAME&password=PASSWORD &client_id=YOUR_CLIENT_ID &client_secret=YOUR_CLIENT_SECRET MADRID · NOV 21-22 · 2014
MADRID · NOV 21-22 · 2014 Password credentials grant Example response: { "access_token": "RsT5OjbzRn430zqMLgV3Ia", "token_type": "Bearer", "expires_in": 3600, "refresh_token": "e1qoXg7Ik2RRua48lXIV" }
MADRID · NOV 21-22 · 2014 Client credentials grant ● Service-to-service authentication, without a particular user being involved. ○ Eg: the Orders microservice making a request to the Invoicing microservice. ● The application authenticates itself using its client ID and client secret.
Client credentials grant POST request to: https://api.example. org/oauth/access_token With this body: grant_type=client_credentials &client_id=YOUR_CLIENT_ID &client_secret=YOUR_CLIENT_SECRET MADRID · NOV 21-22 · 2014
MADRID · NOV 21-22 · 2014 Client credentials grant Example response: { "access_token": "RsT5OjbzRn430zqMLgV3Ia", "token_type": "Bearer", "expires_in": 3600, "refresh_token": "e1qoXg7Ik2RRua48lXIV" }
Accessing the protected resource Once the client has an access token, it can request a protected resource: GET /games HTTP/1.1 Host: api.example.org Authorization: Bearer RsT5OjbzRn430zqMLgV3Ia MADRID · NOV 21-22 · 2014
Token expiration and refresh ● If the Authorization Server issues expiring tokens, they will be paired with refresh tokens. ● When the access token has expired, the refresh token can be used to get a new access token. MADRID · NOV 21-22 · 2014
Tips for a front-end application MADRID · NOV 21-22 · 2014 ● Use the implicit grant. ○ Already supported for 3rd party providers like Google, Facebook. ○ If you hold your own users, have your backend to implement the OAuth 2.0 Authorization Server role. ● Use HTML5’s localStorage for access and refresh tokens.
MADRID · NOV 21-22 · 2014 Agenda 1. Authentication in monolithic applications vs microservices. 2. Introduction to OAuth 2.0. 3. Achieving statelessness with JWT. 4. Demo. 5. Q&A.
MADRID · NOV 21-22 · 2014 Stateful vs. Stateless ● Authorization Servers are often stateful services. ○ They store issued access tokens in databases for future checking. ● How can we achieve statelessness? ○ Issuing JWT tokens as access tokens.
MADRID · NOV 21-22 · 2014 Introducing JWT JSON Web Token is a compact URL-safe means of representing claims to be transferred between two parties. The claims are encoded as a JSON object that is digitally signed by hashing it using a shared secret between the parties.
Introducing JWT... in Plain English A secure way to encapsulate arbitrary data that can be sent over unsecure URL’s. MADRID · NOV 21-22 · 2014
MADRID · NOV 21-22 · 2014 When can JWT be useful? ● When generating “one click” action emails. ○ Eg: “delete this comment”, “add this to favorites”. ● To achieve Single Sign-On. ○ Sharing the JWT between different applications. ● Whenever you need to securely send a payload. ○ Eg: to “obscure” URL parameters or POST bodies.
Header Claims MADRID · NOV 21-22 · 2014 How does a JWT look like? eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9. eyJleHAiOjE0MTY0NzE5MzQsInVzZXJfbmFtZSI6InV zZXIiLCJzY29wZSI6WyJyZWFkIiwid3JpdGUiXSwiYX V0aG9yaXRpZXMiOlsiUk9MRV9BRE1JTiIsIlJPTEVfV VNFUiJdLCJqdGkiOiI5YmM5MmE0NC0wYjFhLTRjNWUt YmU3MC1kYTUyMDc1YjlhODQiLCJjbGllbnRfaWQiOiJ teS1jbGllbnQtd2l0aC1zZWNyZXQifQ. AZCTD_fiCcnrQR5X7rJBQ5rO-2Qedc5_3qJJf-ZCvVY Signature
MADRID · NOV 21-22 · 2014 JWT Header { "alg": "HS256", "typ": "JWT" }
MADRID · NOV 21-22 · 2014 JWT Claims { "exp": 1416471934, "user_name": "user", "scope": [ "read", "write" ], "authorities": [ "ROLE_ADMIN", "ROLE_USER" ], "jti": "9bc92a44-0b1a-4c5e-be70-da52075b9a84", "client_id": "my-client-with-secret" }
MADRID · NOV 21-22 · 2014 Signature HMACSHA256( base64(header) + "." + base64(payload), "secret" )
Sample access token response MADRID · NOV 21-22 · 2014 { "access_token": "eyJhbGciOiJIUzI1NiJ9. eyJleHAiOjE0MTY0NzEwNTUsInVzZXJfbmFtZSI6InVzZXIiLCJzY29wZS I6WyJyZWFkIiwid3JpdGUiXSwiYXV0aG9yaXRpZXMiOlsiUk9MRV9BRE1J TiIsIlJPTEVfVVNFUiJdLCJqdGkiOiIzZGJjODE4Yi0wMjAyLTRiYzItYT djZi1mMmZlNjY4MjAyMmEiLCJjbGllbnRfaWQiOiJteS1jbGllbnQtd2l0 aC1zZWNyZXQifQ. Wao_6hLnOeMHS4HEel1UGWt1g86ad9N0qCexr1IL7IM", "token_type": "bearer", "expires_in": 43199, "scope": "read write", "jti": "3dbc818b-0202-4bc2-a7cf-f2fe6682022a" }
MADRID · NOV 21-22 · 2014 Achieving statelessness ● Instead of storing the access token / principal relationship in a stateful way, do it on a JWT. ● Access tokens with the JWT-encoded principal can be securely stored on the client’s browser. ● That way you are achieving one of the basic principles of REST: State Transfer.
MADRID · NOV 21-22 · 2014 Tips for using JWT ● JWT claims are just signed by default (JWS - JSON Web Signature). ○ It prevents the content to be tampered. ● Use encryption to make it bomb proof. ○ Use any algorithm supported by JWE - JSON Web Encryption.
MADRID · NOV 21-22 · 2014 Agenda 1. Authentication in monolithic applications vs microservices. 2. Introduction to OAuth 2.0. 3. Achieving statelessness with JWT. 4. Demo. 5. Q&A.
MADRID · NOV 21-22 · 2014 Agenda 1. Authentication in monolithic applications vs microservices. 2. Introduction to OAuth 2.0. 3. Achieving statelessness with JWT. 4. Demo. 5. Q&A.
MADRID · NOV 21-22 · 2014 Thanks! Álvaro Sánchez-Mariscal Web Architect Daniel Ortega Segura Senior Grails Developer

More Related Content

What's hot (20)

PDF
Modern Authentication -- FIDO2 Web Authentication (WebAuthn) を学ぶ --
Jun Kurihara
 
PDF
The Shift from Federated to Decentralized Identity
Evernym
 
PDF
Stateless Auth using OAuth2 & JWT
Gaurav Roy
 
PDF
OpenID Connect Explained
Vladimir Dzhuvinov
 
PDF
Token, token... From SAML to OIDC
Shiu-Fun Poon
 
PDF
OpenID Connect 入門 〜コンシューマーにおけるID連携のトレンド〜
Masaru Kurahayashi
 
PDF
FIDO2 ～ パスワードのいらない世界へ
FIDO Alliance
 
PPTX
OpenID for Verifiable Credentials
Torsten Lodderstedt
 
PPTX
Intro to OAuth2 and OpenID Connect
LiamWadman
 
PDF
NGINX基本セミナー（セキュリティ編）～NGINXでセキュアなプラットフォームを実現する方法！
NGINX, Inc.
 
PDF
OpenID for Verifiable Credentials
Torsten Lodderstedt
 
PDF
Integrating FIDO Authentication & Federation Protocols
FIDO Alliance
 
PDF
なぜOpenID Connectが必要となったのか、その歴史的背景
Tatsuo Kudo
 
PDF
IDA,VC,DID関連仕様 最新情報 - OpenID BizDay #15
OpenID Foundation Japan
 
PPTX
An introduction to OAuth 2
Sanjoy Kumar Roy
 
PDF
IT エンジニアのための 流し読み Windows 10 - Windows Hello for Business
TAKUYA OHTA
 
PDF
KeycloakのDevice Flow、CIBAについて
Hiroyuki Wada
 
PDF
Verifiable Credentials for Travel & Hospitality
Evernym
 
PDF
OAuth 2.0 and OpenID Connect
Jacob Combs
 
PDF
How to Build Interoperable Decentralized Identity Systems with OpenID for Ver...
Torsten Lodderstedt
 
Modern Authentication -- FIDO2 Web Authentication (WebAuthn) を学ぶ --
Jun Kurihara
 
The Shift from Federated to Decentralized Identity
Evernym
 
Stateless Auth using OAuth2 & JWT
Gaurav Roy
 
OpenID Connect Explained
Vladimir Dzhuvinov
 
Token, token... From SAML to OIDC
Shiu-Fun Poon
 
OpenID Connect 入門 〜コンシューマーにおけるID連携のトレンド〜
Masaru Kurahayashi
 
FIDO2 ～ パスワードのいらない世界へ
FIDO Alliance
 
OpenID for Verifiable Credentials
Torsten Lodderstedt
 
Intro to OAuth2 and OpenID Connect
LiamWadman
 
NGINX基本セミナー（セキュリティ編）～NGINXでセキュアなプラットフォームを実現する方法！
NGINX, Inc.
 
OpenID for Verifiable Credentials
Torsten Lodderstedt
 
Integrating FIDO Authentication & Federation Protocols
FIDO Alliance
 
なぜOpenID Connectが必要となったのか、その歴史的背景
Tatsuo Kudo
 
IDA,VC,DID関連仕様 最新情報 - OpenID BizDay #15
OpenID Foundation Japan
 
An introduction to OAuth 2
Sanjoy Kumar Roy
 
IT エンジニアのための 流し読み Windows 10 - Windows Hello for Business
TAKUYA OHTA
 
KeycloakのDevice Flow、CIBAについて
Hiroyuki Wada
 
Verifiable Credentials for Travel & Hospitality
Evernym
 
OAuth 2.0 and OpenID Connect
Jacob Combs
 
How to Build Interoperable Decentralized Identity Systems with OpenID for Ver...
Torsten Lodderstedt
 

Viewers also liked (20)

PDF
Codemotion 2014 - Hackathones - de 0 a produccion en 24 horas
Adolfo Sanz De Diego
 
PDF
Mejora tus retrospectivas (codemotion 2014)
Juanma Gómez
 
PDF
Scrum bad smells (codemotion 2014)
Juanma Gómez
 
PDF
#PlatziConf - El camino para ser un Pro en JavaScript
Carlos Azaustre
 
PDF
Stateless authentication for microservices - Spring I/O 2015
Alvaro Sanchez-Mariscal
 
PDF
OAuth2 and Spring Security
Orest Ivasiv
 
PDF
OAuth and OpenID Connect for Microservices
Twobo Technologies
 
PDF
Stateless authentication for microservices
Alvaro Sanchez-Mariscal
 
PDF
Conhecendo NancyFX!
Luis Rudge
 
PPTX
Three Other Web Frameworks. All .NET. All OSS. One Hour. Go
Christian Horsdal
 
PDF
Quita, que tú no sabes; ya lo hago yo. Generación e inyección de código en ti...
Alberto Sanz Herrero
 
PPTX
Web API 2 Token Based Authentication
jeremysbrown
 
PPTX
Java & JWT Stateless authentication
Karlo Novak
 
PDF
PHP Experience 2016 - [Palestra] Json Web Token (JWT)
iMasters
 
PPTX
Token Based Authentication Systems with AngularJS & NodeJS
Hüseyin BABAL
 
PDF
Stateless authentication for microservices - GR8Conf 2015
Alvaro Sanchez-Mariscal
 
PDF
2016 pycontw web api authentication
Micron Technology
 
PPTX
Combining Angular and React Together
Sebastian Pederiva
 
PDF
Json web token api authorization
Giulio De Donato
 
PDF
Stateless authentication with OAuth 2 and JWT - JavaZone 2015
Alvaro Sanchez-Mariscal
 
Codemotion 2014 - Hackathones - de 0 a produccion en 24 horas
Adolfo Sanz De Diego
 
Mejora tus retrospectivas (codemotion 2014)
Juanma Gómez
 
Scrum bad smells (codemotion 2014)
Juanma Gómez
 
#PlatziConf - El camino para ser un Pro en JavaScript
Carlos Azaustre
 
Stateless authentication for microservices - Spring I/O 2015
Alvaro Sanchez-Mariscal
 
OAuth2 and Spring Security
Orest Ivasiv
 
OAuth and OpenID Connect for Microservices
Twobo Technologies
 
Stateless authentication for microservices
Alvaro Sanchez-Mariscal
 
Conhecendo NancyFX!
Luis Rudge
 
Three Other Web Frameworks. All .NET. All OSS. One Hour. Go
Christian Horsdal
 
Quita, que tú no sabes; ya lo hago yo. Generación e inyección de código en ti...
Alberto Sanz Herrero
 
Web API 2 Token Based Authentication
jeremysbrown
 
Java & JWT Stateless authentication
Karlo Novak
 
PHP Experience 2016 - [Palestra] Json Web Token (JWT)
iMasters
 
Token Based Authentication Systems with AngularJS & NodeJS
Hüseyin BABAL
 
Stateless authentication for microservices - GR8Conf 2015
Alvaro Sanchez-Mariscal
 
2016 pycontw web api authentication
Micron Technology
 
Combining Angular and React Together
Sebastian Pederiva
 
Json web token api authorization
Giulio De Donato
 
Stateless authentication with OAuth 2 and JWT - JavaZone 2015
Alvaro Sanchez-Mariscal
 
Ad

Similar to Stateless token-based authentication for pure front-end applications (20)

PDF
Stateless authentication for microservices applications - JavaLand 2015
Alvaro Sanchez-Mariscal
 
PDF
Stateless authentication for microservices - Greach 2015
Alvaro Sanchez-Mariscal
 
PDF
OAuth and why you should use it
Sergey Podgornyy
 
PPTX
Devteach 2017 OAuth and Open id connect demystified
Taswar Bhatti
 
PPTX
Oauth2 and OWSM OAuth2 support
Gaurav Sharma
 
PDF
Stateless Auth using OAUTH2 & JWT
Mobiliya
 
PDF
ConFoo 2015 - Securing RESTful resources with OAuth2
Rodrigo Cândido da Silva
 
PDF
OAuth2
SPARK MEDIA
 
PDF
Spring4 security oauth2
Sang Shin
 
PPT
Oauth2.0
Yasmine Gaber
 
PDF
Spring security oauth2
axykim00
 
PDF
Spring4 security oauth2
axykim00
 
PPTX
OAuth
Tom Elrod
 
PDF
Top X OAuth 2 Hacks
Antonio Sanso
 
PDF
OAuth Base Camp
Oliver Pfaff
 
PDF
OAuth: Trust Issues
Lorna Mitchell
 
PDF
When and Why Would I use Oauth2?
Dave Syer
 
PDF
The Many Flavors of OAuth - Understand Everything About OAuth2
Khor SoonHin
 
PPTX
O auth 2.0 authorization framework
John Temoty Roca
 
PPTX
OAuth - Don’t Throw the Baby Out with the Bathwater
Apigee | Google Cloud
 
Stateless authentication for microservices applications - JavaLand 2015
Alvaro Sanchez-Mariscal
 
Stateless authentication for microservices - Greach 2015
Alvaro Sanchez-Mariscal
 
OAuth and why you should use it
Sergey Podgornyy
 
Devteach 2017 OAuth and Open id connect demystified
Taswar Bhatti
 
Oauth2 and OWSM OAuth2 support
Gaurav Sharma
 
Stateless Auth using OAUTH2 & JWT
Mobiliya
 
ConFoo 2015 - Securing RESTful resources with OAuth2
Rodrigo Cândido da Silva
 
OAuth2
SPARK MEDIA
 
Spring4 security oauth2
Sang Shin
 
Oauth2.0
Yasmine Gaber
 
Spring security oauth2
axykim00
 
Spring4 security oauth2
axykim00
 
OAuth
Tom Elrod
 
Top X OAuth 2 Hacks
Antonio Sanso
 
OAuth Base Camp
Oliver Pfaff
 
OAuth: Trust Issues
Lorna Mitchell
 
When and Why Would I use Oauth2?
Dave Syer
 
The Many Flavors of OAuth - Understand Everything About OAuth2
Khor SoonHin
 
O auth 2.0 authorization framework
John Temoty Roca
 
OAuth - Don’t Throw the Baby Out with the Bathwater
Apigee | Google Cloud
 
Ad

More from Alvaro Sanchez-Mariscal (20)

PDF
Serverless functions with Micronaut
Alvaro Sanchez-Mariscal
 
PDF
Asynchronous and event-driven Grails applications
Alvaro Sanchez-Mariscal
 
PDF
6 things you need to know about GORM 6
Alvaro Sanchez-Mariscal
 
PDF
Reactive microservices with Micronaut - GR8Conf EU 2018
Alvaro Sanchez-Mariscal
 
PDF
Reactive microservices with Micronaut - Greach 2018
Alvaro Sanchez-Mariscal
 
PDF
Practical Spring Cloud
Alvaro Sanchez-Mariscal
 
PDF
Creating applications with Grails, Angular JS and Spring Security - G3 Summit...
Alvaro Sanchez-Mariscal
 
PDF
Mastering Grails 3 Plugins - G3 Summit 2016
Alvaro Sanchez-Mariscal
 
PDF
Desarrollo de aplicaciones con Grails 3, Angular JS y Spring Security
Alvaro Sanchez-Mariscal
 
PDF
Creating applications with Grails, Angular JS and Spring Security - GR8Conf U...
Alvaro Sanchez-Mariscal
 
PDF
Mastering Grails 3 Plugins - GR8Conf US 2016
Alvaro Sanchez-Mariscal
 
PDF
Mastering Grails 3 Plugins - GR8Conf EU 2016
Alvaro Sanchez-Mariscal
 
PDF
Creating applications with Grails, Angular JS and Spring Security - GR8Conf E...
Alvaro Sanchez-Mariscal
 
PDF
Mastering Grails 3 Plugins - Greach 2016
Alvaro Sanchez-Mariscal
 
PDF
Creating applications with Grails, Angular JS and Spring Security
Alvaro Sanchez-Mariscal
 
PDF
Efficient HTTP applications on the JVM with Ratpack - Voxxed Days Berlin 2016
Alvaro Sanchez-Mariscal
 
PDF
Efficient HTTP applications on the JVM with Ratpack - JDD 2015
Alvaro Sanchez-Mariscal
 
PDF
Ratpack 101 - GR8Conf 2015
Alvaro Sanchez-Mariscal
 
PDF
Ratpack 101 - GeeCON 2015
Alvaro Sanchez-Mariscal
 
PDF
Workshop: Creating RESTful API’s with Grails and Spring Security (GR8Conf 2014)
Alvaro Sanchez-Mariscal
 
Serverless functions with Micronaut
Alvaro Sanchez-Mariscal
 
Asynchronous and event-driven Grails applications
Alvaro Sanchez-Mariscal
 
6 things you need to know about GORM 6
Alvaro Sanchez-Mariscal
 
Reactive microservices with Micronaut - GR8Conf EU 2018
Alvaro Sanchez-Mariscal
 
Reactive microservices with Micronaut - Greach 2018
Alvaro Sanchez-Mariscal
 
Practical Spring Cloud
Alvaro Sanchez-Mariscal
 
Creating applications with Grails, Angular JS and Spring Security - G3 Summit...
Alvaro Sanchez-Mariscal
 
Mastering Grails 3 Plugins - G3 Summit 2016
Alvaro Sanchez-Mariscal
 
Desarrollo de aplicaciones con Grails 3, Angular JS y Spring Security
Alvaro Sanchez-Mariscal
 
Creating applications with Grails, Angular JS and Spring Security - GR8Conf U...
Alvaro Sanchez-Mariscal
 
Mastering Grails 3 Plugins - GR8Conf US 2016
Alvaro Sanchez-Mariscal
 
Mastering Grails 3 Plugins - GR8Conf EU 2016
Alvaro Sanchez-Mariscal
 
Creating applications with Grails, Angular JS and Spring Security - GR8Conf E...
Alvaro Sanchez-Mariscal
 
Mastering Grails 3 Plugins - Greach 2016
Alvaro Sanchez-Mariscal
 
Creating applications with Grails, Angular JS and Spring Security
Alvaro Sanchez-Mariscal
 
Efficient HTTP applications on the JVM with Ratpack - Voxxed Days Berlin 2016
Alvaro Sanchez-Mariscal
 
Efficient HTTP applications on the JVM with Ratpack - JDD 2015
Alvaro Sanchez-Mariscal
 
Ratpack 101 - GR8Conf 2015
Alvaro Sanchez-Mariscal
 
Ratpack 101 - GeeCON 2015
Alvaro Sanchez-Mariscal
 
Workshop: Creating RESTful API’s with Grails and Spring Security (GR8Conf 2014)
Alvaro Sanchez-Mariscal
 

Recently uploaded (20)

PPTX
Webinar: Introduction to LF Energy EVerest
DanBrown980551
 
PDF
“NPU IP Hardware Shaped Through Software and Use-case Analysis,” a Presentati...
Edge AI and Vision Alliance
 
PPTX
Future Tech Innovations 2025 – A TechLists Insight
TechLists
 
PDF
What Makes Contify’s News API Stand Out: Key Features at a Glance
Contify
 
PPTX
"Autonomy of LLM Agents: Current State and Future Prospects", Oles` Petriv
Fwdays
 
PDF
POV_ Why Enterprises Need to Find Value in ZERO.pdf
darshakparmar
 
PDF
Exolore The Essential AI Tools in 2025.pdf
Srinivasan M
 
PDF
Empower Inclusion Through Accessible Java Applications
Ana-Maria Mihalceanu
 
PPTX
Q2 FY26 Tableau User Group Leader Quarterly Call
lward7
 
PDF
Newgen Beyond Frankenstein_Build vs Buy_Digital_version.pdf
darshakparmar
 
PDF
Agentic AI lifecycle for Enterprise Hyper-Automation
Debmalya Biswas
 
PDF
Transforming Utility Networks: Large-scale Data Migrations with FME
Safe Software
 
PDF
LOOPS in C Programming Language - Technology
RishabhDwivedi43
 
PDF
[Newgen] NewgenONE Marvin Brochure 1.pdf
darshakparmar
 
PDF
Jak MŚP w Europie Środkowo-Wschodniej odnajdują się w świecie AI
dominikamizerska1
 
DOCX
Python coding for beginners !! Start now!#
Rajni Bhardwaj Grover
 
PDF
IoT-Powered Industrial Transformation – Smart Manufacturing to Connected Heal...
Rejig Digital
 
PDF
Achieving Consistent and Reliable AI Code Generation - Medusa AI
medusaaico
 
PDF
Building Real-Time Digital Twins with IBM Maximo & ArcGIS Indoors
Safe Software
 
PDF
Biography of Daniel Podor.pdf
Daniel Podor
 
Webinar: Introduction to LF Energy EVerest
DanBrown980551
 
“NPU IP Hardware Shaped Through Software and Use-case Analysis,” a Presentati...
Edge AI and Vision Alliance
 
Future Tech Innovations 2025 – A TechLists Insight
TechLists
 
What Makes Contify’s News API Stand Out: Key Features at a Glance
Contify
 
"Autonomy of LLM Agents: Current State and Future Prospects", Oles` Petriv
Fwdays
 
POV_ Why Enterprises Need to Find Value in ZERO.pdf
darshakparmar
 
Exolore The Essential AI Tools in 2025.pdf
Srinivasan M
 
Empower Inclusion Through Accessible Java Applications
Ana-Maria Mihalceanu
 
Q2 FY26 Tableau User Group Leader Quarterly Call
lward7
 
Newgen Beyond Frankenstein_Build vs Buy_Digital_version.pdf
darshakparmar
 
Agentic AI lifecycle for Enterprise Hyper-Automation
Debmalya Biswas
 
Transforming Utility Networks: Large-scale Data Migrations with FME
Safe Software
 
LOOPS in C Programming Language - Technology
RishabhDwivedi43
 
[Newgen] NewgenONE Marvin Brochure 1.pdf
darshakparmar
 
Jak MŚP w Europie Środkowo-Wschodniej odnajdują się w świecie AI
dominikamizerska1
 
Python coding for beginners !! Start now!#
Rajni Bhardwaj Grover
 
IoT-Powered Industrial Transformation – Smart Manufacturing to Connected Heal...
Rejig Digital
 
Achieving Consistent and Reliable AI Code Generation - Medusa AI
medusaaico
 
Building Real-Time Digital Twins with IBM Maximo & ArcGIS Indoors
Safe Software
 
Biography of Daniel Podor.pdf
Daniel Podor
 

Stateless token-based authentication for pure front-end applications

  • 1. Stateless token-based authentication for pure front-end applications MADRID · NOV 21-22 · 2014 Álvaro Sánchez-Mariscal Web Architect Daniel Ortega Segura Senior Grails Developer
  • 2. About us - Álvaro Sánchez-Mariscal ● Passionate Software Developer. ● Worked at IBM BCS, BEA Systems and Sun Microsystems. ● Founded Salenda and Escuela de Groovy. ● Working now at as a Web Architect. ● Living between Madrid and Gibraltar. MADRID · NOV 21-22 · 2014
  • 3. About us - Daniel Ortega Segura MADRID · NOV 21-22 · 2014 ● Enthusiast guitarist ● Rubik’s cubes freak ● Senior Grails Developer at
  • 4. MADRID · NOV 21-22 · 2014 About us - ● HTML5 games platform. ● We provide game developers a Javascript SDK. ● Server side logic and maths are handled by our industry certified game engines. ● Seamless integration with several casinos. ● Check out play.odobo.com and play for free!
  • 5. MADRID · NOV 21-22 · 2014 Agenda 1. Authentication in monolithic applications vs microservices. 2. Introduction to OAuth 2.0. 3. Achieving statelessness with JWT. 4. Demo. 5. Q&A.
  • 6. MADRID · NOV 21-22 · 2014 Agenda 1. Authentication in monolithic applications vs microservices. 2. Introduction to OAuth 2.0. 3. Achieving statelessness with JWT. 4. Demo. 5. Q&A.
  • 7. MADRID · NOV 21-22 · 2014 Agenda 1. Authentication in monolithic applications vs microservices. 2. Introduction to OAuth 2.0. 3. Achieving statelessness with JWT. 4. Demo. 5. Q&A.
  • 8. MADRID · NOV 21-22 · 2014 Agenda 1. Authentication in monolithic applications vs microservices. 2. Introduction to OAuth 2.0. 3. Achieving statelessness with JWT. 4. Demo. 5. Q&A.
  • 9. MADRID · NOV 21-22 · 2014 Agenda 1. Authentication in monolithic applications vs microservices. 2. Introduction to OAuth 2.0. 3. Achieving statelessness with JWT. 4. Demo. 5. Q&A.
  • 10. Authentication in monolithic apps ● Historically, authentication has always been a stateful service. ● When moving to Single-Page Applications, and/or having mobile clients, it becomes an issue. ● If you are build a REST and stateless API, your authentication should be that way too. MADRID · NOV 21-22 · 2014
  • 13. Authentication and microservices ● Authentication: to verify the identity of the user given the credentials received. ● Authorization: to determine if the user should be granted access to a particular resource. ● In a microservices context: ○ Authentication can be a microservice itself. ○ Authorization is a common functionality in all of them. MADRID · NOV 21-22 · 2014
  • 14. Authentication and microservices Catalog DB Invoicing DB MADRID · NOV 21-22 · 2014 Javascript front-end UI Mobile app Authentication Service Shopping cart Service Catalog Service Orders Service Shipping Service User repository Shipping partners Web Backend Mobile Backend
  • 15. MADRID · NOV 21-22 · 2014 Agenda 1. Authentication in monolithic applications vs microservices. 2. Introduction to OAuth 2.0. 3. Achieving statelessness with JWT. 4. Demo. 5. Q&A.
  • 16. MADRID · NOV 21-22 · 2014 Introducing OAuth 2.0 An open protocol to allow secure authorization in a simple and standard method from web, mobile and desktop applications.
  • 17. MADRID · NOV 21-22 · 2014 OAuth 2.0: roles Resource Owner: the person or the application that holds the data to be shared. Resource Server: the application that holds the protected resources. Authorization Server: the application that verifies the identity of the users. Client: the application that makes requests to the RS on behalf of the RO.
  • 18. MADRID · NOV 21-22 · 2014 OAuth 2.0: roles Resource Owner: the person or the application that holds the data to be shared. Resource Server: the application that holds the protected resources. Authorization Server: the application that verifies the identity of the users. Client: the application that makes requests to the RS on behalf of the RO.
  • 19. MADRID · NOV 21-22 · 2014 OAuth 2.0: roles Resource Owner: the person or the application that holds the data to be shared. Resource Server: the application that holds the protected resources. Authorization Server: the application that verifies the identity of the users. Client: the application that makes requests to the RS on behalf of the RO.
  • 20. MADRID · NOV 21-22 · 2014 OAuth 2.0: roles Resource Owner: the person or the application that holds the data to be shared. Resource Server: the application that holds the protected resources. Authorization Server: the application that verifies the identity of the users. Client: the application that makes requests to the RS on behalf of the RO.
  • 21. MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow I want to see a list of games
  • 22. MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Hey, backend, could you please give me a list of games?
  • 23. MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Sorry mate, this is a protected resource. You will need to present me an access token
  • 24. MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Hi Google, can I get an access token please? Backend is asking
  • 25. MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Sure thing sir. I just need to ask a few details to the user first
  • 26. MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Hi, could you please provide me your credentials? I need to verify your identity
  • 27. MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow That’s no problem at all. I am [email protected] and my password is secret.
  • 28. MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow The user is who claims to be. Here is your access token: qfE2KhvKggluHqe7IpTBqZ4qziTQQbKa
  • 29. MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Hi Backend, this is my token: qfE2KhvKggluHqe7IpTBqZ4qziTQQbKa
  • 30. MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Hi, I’ve been given qfE2KhvKggluHqe7IpTBqZ4qziTQQbKa. Could you please tell me who it belongs to?
  • 31. MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Of course. That token is still valid and it belongs to [email protected].
  • 32. MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Everything is allright. This is the list of games. Enjoy!
  • 33. MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow Here you are the list of games.Thank you for your business and have a good day!
  • 34. MADRID · NOV 21-22 · 2014 OAuth 2.0: protocol flow OAuth 2.0 is a delegation protocol, as this guy has no idea about the credentials of this guy
  • 35. MADRID · NOV 21-22 · 2014 OAuth 2.0: grant types ● Authorization code: for web server applications. ● Implicit: for JS front-ends and mobile apps. ● Resource Owner Password Credentials: for trusted clients. ● Client credentials: for service authentication.
  • 36. Authorization code grant ● For server-based applications, where the client ID and secret are securely stored. ● It’s a redirect flow, so it’s for web server apps. ● The client (web server app) redirects the user to the authorization server to get a code. ● Then, using the code and its client credentials MADRID · NOV 21-22 · 2014 asks for an access token.
  • 37. MADRID · NOV 21-22 · 2014 Authorization code grant http://myServerApp.com
  • 38. MADRID · NOV 21-22 · 2014 Authorization code grant https://facebook.com/dialog/oauth ?response_type=code &client_id=YOUR_CLIENT_ID &redirect_uri= http://myServerApp.com/oauth &scope=email,public_profile
  • 39. MADRID · NOV 21-22 · 2014 Authorization code grant hhttttpp::////fmacyeSbeorvoekr.Acopmp.com
  • 40. MADRID · NOV 21-22 · 2014 Authorization code grant hhttttpp:s/://m/faycSeebrvoeorkA.cpopm.com
  • 41. MADRID · NOV 21-22 · 2014 Authorization code grant https://myServerApp.com/oauth?code=CODE Finishing authentication...
  • 42. Authorization code grant Server-side POST request to: https://graph. facebook.com/oauth/access_token With this body: grant_type=authorization_code &code=CODE_FROM_QUERY_STRING &redirect_uri=http://myServerApp.com &client_id=YOUR_CLIENT_ID &client_secret=YOUR_CLIENT_SECRET MADRID · NOV 21-22 · 2014
  • 43. MADRID · NOV 21-22 · 2014 Authorization code grant Example response: { "access_token": "RsT5OjbzRn430zqMLgV3Ia", "token_type": "Bearer", "expires_in": 3600, "refresh_token": "e1qoXg7Ik2RRua48lXIV" }
  • 44. MADRID · NOV 21-22 · 2014 Implicit grant ● For web applications running on the browser (eg: AngularJS, etc) or mobile apps. ● Client credentials confidentiality cannot be guaranteed. ● Similar to the code grant, but in this case, the client gets an access token directly.
  • 45. MADRID · NOV 21-22 · 2014 Implicit grant http://myFrontendApp.com/#/home
  • 46. MADRID · NOV 21-22 · 2014 Implicit grant https://facebook.com/dialog/oauth ?response_type=token &client_id=YOUR_CLIENT_ID &redirect_uri= http://myFrontendApp.com/#/cb &scope=email,public_profile
  • 47. MADRID · NOV 21-22 · 2014 Implicit grant hhttttpp:s/://m/faycSeebrvoeorkA.cpopm.com
  • 48. MADRID · NOV 21-22 · 2014 Implicit grant https://myFrontendApp.com/#/cb?token=TOKEN Finishing authentication...
  • 49. MADRID · NOV 21-22 · 2014 Password credentials grant ● In this case, client collects username and password to get an access token directly. ● Viable solution only for trusted clients: ○ The official website consumer of your API. ○ The official mobile app consuming your API. ○ Etc.
  • 50. MADRID · NOV 21-22 · 2014 Password credentials grant
  • 51. Password credentials grant POST request to: https://api.example. org/oauth/access_token With this body: grant_type=password &username=USERNAME&password=PASSWORD &client_id=YOUR_CLIENT_ID &client_secret=YOUR_CLIENT_SECRET MADRID · NOV 21-22 · 2014
  • 52. MADRID · NOV 21-22 · 2014 Password credentials grant Example response: { "access_token": "RsT5OjbzRn430zqMLgV3Ia", "token_type": "Bearer", "expires_in": 3600, "refresh_token": "e1qoXg7Ik2RRua48lXIV" }
  • 53. MADRID · NOV 21-22 · 2014 Client credentials grant ● Service-to-service authentication, without a particular user being involved. ○ Eg: the Orders microservice making a request to the Invoicing microservice. ● The application authenticates itself using its client ID and client secret.
  • 54. Client credentials grant POST request to: https://api.example. org/oauth/access_token With this body: grant_type=client_credentials &client_id=YOUR_CLIENT_ID &client_secret=YOUR_CLIENT_SECRET MADRID · NOV 21-22 · 2014
  • 55. MADRID · NOV 21-22 · 2014 Client credentials grant Example response: { "access_token": "RsT5OjbzRn430zqMLgV3Ia", "token_type": "Bearer", "expires_in": 3600, "refresh_token": "e1qoXg7Ik2RRua48lXIV" }
  • 56. Accessing the protected resource Once the client has an access token, it can request a protected resource: GET /games HTTP/1.1 Host: api.example.org Authorization: Bearer RsT5OjbzRn430zqMLgV3Ia MADRID · NOV 21-22 · 2014
  • 57. Token expiration and refresh ● If the Authorization Server issues expiring tokens, they will be paired with refresh tokens. ● When the access token has expired, the refresh token can be used to get a new access token. MADRID · NOV 21-22 · 2014
  • 58. Tips for a front-end application MADRID · NOV 21-22 · 2014 ● Use the implicit grant. ○ Already supported for 3rd party providers like Google, Facebook. ○ If you hold your own users, have your backend to implement the OAuth 2.0 Authorization Server role. ● Use HTML5’s localStorage for access and refresh tokens.
  • 59. MADRID · NOV 21-22 · 2014 Agenda 1. Authentication in monolithic applications vs microservices. 2. Introduction to OAuth 2.0. 3. Achieving statelessness with JWT. 4. Demo. 5. Q&A.
  • 60. MADRID · NOV 21-22 · 2014 Stateful vs. Stateless ● Authorization Servers are often stateful services. ○ They store issued access tokens in databases for future checking. ● How can we achieve statelessness? ○ Issuing JWT tokens as access tokens.
  • 61. MADRID · NOV 21-22 · 2014 Introducing JWT JSON Web Token is a compact URL-safe means of representing claims to be transferred between two parties. The claims are encoded as a JSON object that is digitally signed by hashing it using a shared secret between the parties.
  • 62. Introducing JWT... in Plain English A secure way to encapsulate arbitrary data that can be sent over unsecure URL’s. MADRID · NOV 21-22 · 2014
  • 63. MADRID · NOV 21-22 · 2014 When can JWT be useful? ● When generating “one click” action emails. ○ Eg: “delete this comment”, “add this to favorites”. ● To achieve Single Sign-On. ○ Sharing the JWT between different applications. ● Whenever you need to securely send a payload. ○ Eg: to “obscure” URL parameters or POST bodies.
  • 64. Header Claims MADRID · NOV 21-22 · 2014 How does a JWT look like? eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9. eyJleHAiOjE0MTY0NzE5MzQsInVzZXJfbmFtZSI6InV zZXIiLCJzY29wZSI6WyJyZWFkIiwid3JpdGUiXSwiYX V0aG9yaXRpZXMiOlsiUk9MRV9BRE1JTiIsIlJPTEVfV VNFUiJdLCJqdGkiOiI5YmM5MmE0NC0wYjFhLTRjNWUt YmU3MC1kYTUyMDc1YjlhODQiLCJjbGllbnRfaWQiOiJ teS1jbGllbnQtd2l0aC1zZWNyZXQifQ. AZCTD_fiCcnrQR5X7rJBQ5rO-2Qedc5_3qJJf-ZCvVY Signature
  • 65. MADRID · NOV 21-22 · 2014 JWT Header { "alg": "HS256", "typ": "JWT" }
  • 66. MADRID · NOV 21-22 · 2014 JWT Claims { "exp": 1416471934, "user_name": "user", "scope": [ "read", "write" ], "authorities": [ "ROLE_ADMIN", "ROLE_USER" ], "jti": "9bc92a44-0b1a-4c5e-be70-da52075b9a84", "client_id": "my-client-with-secret" }
  • 67. MADRID · NOV 21-22 · 2014 Signature HMACSHA256( base64(header) + "." + base64(payload), "secret" )
  • 68. Sample access token response MADRID · NOV 21-22 · 2014 { "access_token": "eyJhbGciOiJIUzI1NiJ9. eyJleHAiOjE0MTY0NzEwNTUsInVzZXJfbmFtZSI6InVzZXIiLCJzY29wZS I6WyJyZWFkIiwid3JpdGUiXSwiYXV0aG9yaXRpZXMiOlsiUk9MRV9BRE1J TiIsIlJPTEVfVVNFUiJdLCJqdGkiOiIzZGJjODE4Yi0wMjAyLTRiYzItYT djZi1mMmZlNjY4MjAyMmEiLCJjbGllbnRfaWQiOiJteS1jbGllbnQtd2l0 aC1zZWNyZXQifQ. Wao_6hLnOeMHS4HEel1UGWt1g86ad9N0qCexr1IL7IM", "token_type": "bearer", "expires_in": 43199, "scope": "read write", "jti": "3dbc818b-0202-4bc2-a7cf-f2fe6682022a" }
  • 69. MADRID · NOV 21-22 · 2014 Achieving statelessness ● Instead of storing the access token / principal relationship in a stateful way, do it on a JWT. ● Access tokens with the JWT-encoded principal can be securely stored on the client’s browser. ● That way you are achieving one of the basic principles of REST: State Transfer.
  • 70. MADRID · NOV 21-22 · 2014 Tips for using JWT ● JWT claims are just signed by default (JWS - JSON Web Signature). ○ It prevents the content to be tampered. ● Use encryption to make it bomb proof. ○ Use any algorithm supported by JWE - JSON Web Encryption.
  • 71. MADRID · NOV 21-22 · 2014 Agenda 1. Authentication in monolithic applications vs microservices. 2. Introduction to OAuth 2.0. 3. Achieving statelessness with JWT. 4. Demo. 5. Q&A.
  • 72. MADRID · NOV 21-22 · 2014 Agenda 1. Authentication in monolithic applications vs microservices. 2. Introduction to OAuth 2.0. 3. Achieving statelessness with JWT. 4. Demo. 5. Q&A.
  • 73. MADRID · NOV 21-22 · 2014 Thanks! Álvaro Sánchez-Mariscal Web Architect Daniel Ortega Segura Senior Grails Developer