SlideShare a Scribd company logo

JWTs in Java for CSRF and Microservices

Stormpath
Stormpath

The document discusses user authentication and application integration methods, focusing on SDK signatures and encoding secrets. It provides pseudo-code for computing signatures using various algorithms, including HS256 and HS512. Additionally, it outlines the different services related to authentication and authorization within the application infrastructure.

Technology
1 of 14
Downloaded 21 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
JWTs in Java for CSRF and Microservices
• • • • •
• • • •
User Data User Workflows Google ID Your Applications Application SDK Application SDK Application SDK ID Integrations Facebook Active Directory SAML
JWTs in Java for CSRF and Microservices
encodeSecret = "4pE8z3PBoHjnV1AhvGk+e8h2p+ShZpOnpr8cwHmMh1w=" computeHMACSHA256( header + "." + payload, base64DecodeToByteArray(encodedSecret) ) Signature Computation Pseudo-code
JWTs in Java for CSRF and Microservices
.signWith( SignatureAlgorithm.HS256, "secret".getBytes("UTF-8") ) Short but not Sweet
String b64EncodedSecret = "Yn2kjibddFAWtnPJ2AFlL8WXmohJMCvigQggaEypa5E="; .signWith( SignatureAlgorithm.HS256, b64EncodedSecret.getBytes("UTF-8") ) You’re Doing it Wrong
String b64EncodedSecret = "Yn2kjibddFAWtnPJ2AFlL8WXmohJMCvigQggaEypa5E="; .signWith( SignatureAlgorithm.HS512, TextCodec.BASE64.decode(b64EncodedSecret) ) Supersize that Secret!
JWTs in Java for CSRF and Microservices
AuthenticationService AuthorizationService ApplicationService OrganizationService DirectoryService AccountService GroupService Database Infrastructure
Database Infrastructure GroupServiceAccountService AuthenticationService AuthorizationService ApplicationService OrganizationService DirectoryService
● ○ ○ ● ● ● ● ● ● ○ ●

More Related Content

What's hot (20)

PDF
Overview of secret management solutions and architecture
Yuechuan (Mike) Chen
 
PDF
What's new in Havana--Keystone
Mirantis
 
PDF
IglooConf 2019 Secure your Azure applications like a pro
Karl Ots
 
PDF
Techorama Belgium 2019: top Azure security fails and how to avoid them
Karl Ots
 
PDF
DevSum - Top Azure security fails and how to avoid them
Karl Ots
 
PPTX
Keycloak for Science Gateways - SGCI Technology Sampler Webinar
marcuschristie
 
PDF
Creating RESTful API’s with Grails and Spring Security
Alvaro Sanchez-Mariscal
 
PPTX
Jenkins Terraform Vault
Shrivatsa Upadhye
 
PDF
Azure vm introduction
Lalit Rawat
 
PPTX
Cloud Computing – Opportunities, Definitions, Options, and Risks (Part-1)
Manoj Kumar
 
PDF
Extending Amazon GuardDuty with Cloud Insight Essentials
Alert Logic
 
PPTX
Secure your app with keycloak
Guy Marom
 
PDF
Azure Penetration Testing
Cheah Eng Soon
 
PDF
Extending Amazon GuardDuty with Cloud Insight Essentials
Alert Logic
 
PPTX
An Introduction to WSO2 Microservices Framework for Java
Sagara Gunathunga
 
PDF
Content as a Service with Umbraco Headless
Filip Bruun Bech-Larsen
 
PPTX
Introduction to WSO2 Microservices Framework for Java - MSF4J - WSO2Con Asia ...
Afkham Azeez
 
PPTX
WSO2ConUS 2015 - Introduction to WSO2 Microservices Server (MSS)
Afkham Azeez
 
PDF
Css sf azure_8-9-17-microsoft_azure_security_overview_babak suzani_msft
Alert Logic
 
PDF
Security in practice with Java EE 6 and GlassFish
Markus Eisele
 
Overview of secret management solutions and architecture
Yuechuan (Mike) Chen
 
What's new in Havana--Keystone
Mirantis
 
IglooConf 2019 Secure your Azure applications like a pro
Karl Ots
 
Techorama Belgium 2019: top Azure security fails and how to avoid them
Karl Ots
 
DevSum - Top Azure security fails and how to avoid them
Karl Ots
 
Keycloak for Science Gateways - SGCI Technology Sampler Webinar
marcuschristie
 
Creating RESTful API’s with Grails and Spring Security
Alvaro Sanchez-Mariscal
 
Jenkins Terraform Vault
Shrivatsa Upadhye
 
Azure vm introduction
Lalit Rawat
 
Cloud Computing – Opportunities, Definitions, Options, and Risks (Part-1)
Manoj Kumar
 
Extending Amazon GuardDuty with Cloud Insight Essentials
Alert Logic
 
Secure your app with keycloak
Guy Marom
 
Azure Penetration Testing
Cheah Eng Soon
 
Extending Amazon GuardDuty with Cloud Insight Essentials
Alert Logic
 
An Introduction to WSO2 Microservices Framework for Java
Sagara Gunathunga
 
Content as a Service with Umbraco Headless
Filip Bruun Bech-Larsen
 
Introduction to WSO2 Microservices Framework for Java - MSF4J - WSO2Con Asia ...
Afkham Azeez
 
WSO2ConUS 2015 - Introduction to WSO2 Microservices Server (MSS)
Afkham Azeez
 
Css sf azure_8-9-17-microsoft_azure_security_overview_babak suzani_msft
Alert Logic
 
Security in practice with Java EE 6 and GlassFish
Markus Eisele
 

Viewers also liked (20)

PPTX
Spring Boot Authentication...and More!
Stormpath
 
PPTX
Custom Data Search with Stormpath
Stormpath
 
PPTX
Instant Security & Scalable User Management with Spring Boot
Stormpath
 
PPTX
Multi-Tenancy with Spring Boot
Stormpath
 
PDF
The Ultimate Guide to Mobile API Security
Stormpath
 
PPTX
Beautiful REST+JSON APIs with Ion
Stormpath
 
PPTX
REST API Security: OAuth 2.0, JWTs, and More!
Stormpath
 
PDF
Building Beautiful REST APIs in ASP.NET Core
Stormpath
 
PPTX
Storing User Files with Express, Stormpath, and Amazon S3
Stormpath
 
PPTX
JWTs for CSRF and Microservices
Stormpath
 
PDF
Mobile Authentication for iOS Applications - Stormpath 101
Stormpath
 
PPTX
Token Authentication in ASP.NET Core
Stormpath
 
PDF
Getting Started With Angular
Stormpath
 
PDF
Build a REST API for your Mobile Apps using Node.js
Stormpath
 
PPTX
Browser Security 101
Stormpath
 
PPTX
Secure API Services in Node with Basic Auth and OAuth2
Stormpath
 
PPTX
Elegant Rest Design Webinar
Stormpath
 
PPTX
Build A Killer Client For Your REST+JSON API
Stormpath
 
PPTX
Building Secure User Interfaces With JWTs (JSON Web Tokens)
Stormpath
 
PDF
Securing Web Applications with Token Authentication
Stormpath
 
Spring Boot Authentication...and More!
Stormpath
 
Custom Data Search with Stormpath
Stormpath
 
Instant Security & Scalable User Management with Spring Boot
Stormpath
 
Multi-Tenancy with Spring Boot
Stormpath
 
The Ultimate Guide to Mobile API Security
Stormpath
 
Beautiful REST+JSON APIs with Ion
Stormpath
 
REST API Security: OAuth 2.0, JWTs, and More!
Stormpath
 
Building Beautiful REST APIs in ASP.NET Core
Stormpath
 
Storing User Files with Express, Stormpath, and Amazon S3
Stormpath
 
JWTs for CSRF and Microservices
Stormpath
 
Mobile Authentication for iOS Applications - Stormpath 101
Stormpath
 
Token Authentication in ASP.NET Core
Stormpath
 
Getting Started With Angular
Stormpath
 
Build a REST API for your Mobile Apps using Node.js
Stormpath
 
Browser Security 101
Stormpath
 
Secure API Services in Node with Basic Auth and OAuth2
Stormpath
 
Elegant Rest Design Webinar
Stormpath
 
Build A Killer Client For Your REST+JSON API
Stormpath
 
Building Secure User Interfaces With JWTs (JSON Web Tokens)
Stormpath
 
Securing Web Applications with Token Authentication
Stormpath
 
Ad

Similar to JWTs in Java for CSRF and Microservices (20)

PDF
Zeronights 2016 - Automating iOS blackbox security scanning
Synack
 
PDF
ZeroNights: Automating iOS blackbox security scanning
Mikhail Sosonkin
 
PDF
Bot 甘苦談，使用者至上
Maxis Kao
 
PPTX
Cryptography 101 for Java Developers - JavaZone2019
Michel Schudel
 
PDF
前端MVC之BackboneJS
Zhang Xiaoxue
 
PDF
The Ring programming language version 1.7 book - Part 33 of 196
Mahmoud Samir Fayed
 
PDF
V8 javascript engine for フロントエンドデベロッパー
Taketoshi 青野健利
 
PPTX
Token Based Authentication Systems with AngularJS & NodeJS
Hüseyin BABAL
 
PPTX
Token Based Authentication Systems
Hüseyin BABAL
 
PDF
sf bay area dfir meetup (2016-04-30) - OsxCollector
Rishi Bhargava
 
PDF
Passkeys and cbSecurity Led by Eric Peterson.pdf
Ortus Solutions, Corp
 
PPTX
TDC2017 | São Paulo - Trilha Cloud Computing How we figured out we had a SRE ...
tdc-globalcode
 
PDF
Demystifying Apple 'Pie' & TouchID
Sebastián Guerrero Selma
 
PDF
7° Sessione - L’intelligenza artificiale a supporto della ricerca, servizi di...
Jürgen Ambrosi
 
PDF
e10sとアプリ間通信
Makoto Kato
 
PPTX
Letgo Data Platform: A global overview
Ricardo Fanjul Fandiño
 
PPTX
ใบงานท 2-8
noeiinoii
 
PPTX
Hack through Injections
Nazar Tymoshyk, CEH, Ph.D.
 
PPTX
Back to Basics, webinar 2: La tua prima applicazione MongoDB
MongoDB
 
PDF
JWT - To authentication and beyond!
Luís Cobucci
 
Zeronights 2016 - Automating iOS blackbox security scanning
Synack
 
ZeroNights: Automating iOS blackbox security scanning
Mikhail Sosonkin
 
Bot 甘苦談，使用者至上
Maxis Kao
 
Cryptography 101 for Java Developers - JavaZone2019
Michel Schudel
 
前端MVC之BackboneJS
Zhang Xiaoxue
 
The Ring programming language version 1.7 book - Part 33 of 196
Mahmoud Samir Fayed
 
V8 javascript engine for フロントエンドデベロッパー
Taketoshi 青野健利
 
Token Based Authentication Systems with AngularJS & NodeJS
Hüseyin BABAL
 
Token Based Authentication Systems
Hüseyin BABAL
 
sf bay area dfir meetup (2016-04-30) - OsxCollector
Rishi Bhargava
 
Passkeys and cbSecurity Led by Eric Peterson.pdf
Ortus Solutions, Corp
 
TDC2017 | São Paulo - Trilha Cloud Computing How we figured out we had a SRE ...
tdc-globalcode
 
Demystifying Apple 'Pie' & TouchID
Sebastián Guerrero Selma
 
7° Sessione - L’intelligenza artificiale a supporto della ricerca, servizi di...
Jürgen Ambrosi
 
e10sとアプリ間通信
Makoto Kato
 
Letgo Data Platform: A global overview
Ricardo Fanjul Fandiño
 
ใบงานท 2-8
noeiinoii
 
Hack through Injections
Nazar Tymoshyk, CEH, Ph.D.
 
Back to Basics, webinar 2: La tua prima applicazione MongoDB
MongoDB
 
JWT - To authentication and beyond!
Luís Cobucci
 
Ad

More from Stormpath (9)

PDF
Building Beautiful REST APIs with ASP.NET Core
Stormpath
 
PPTX
Token Authentication for Java Applications
Stormpath
 
PPTX
How to Use Stormpath in angular js
Stormpath
 
PPTX
Rest API Security
Stormpath
 
PPTX
Secure Your REST API (The Right Way)
Stormpath
 
PPTX
Build a Node.js Client for Your REST+JSON API
Stormpath
 
PPTX
So long scrum, hello kanban
Stormpath
 
PPTX
REST API Design for JAX-RS And Jersey
Stormpath
 
PPTX
Design Beautiful REST + JSON APIs
Stormpath
 
Building Beautiful REST APIs with ASP.NET Core
Stormpath
 
Token Authentication for Java Applications
Stormpath
 
How to Use Stormpath in angular js
Stormpath
 
Rest API Security
Stormpath
 
Secure Your REST API (The Right Way)
Stormpath
 
Build a Node.js Client for Your REST+JSON API
Stormpath
 
So long scrum, hello kanban
Stormpath
 
REST API Design for JAX-RS And Jersey
Stormpath
 
Design Beautiful REST + JSON APIs
Stormpath
 

Recently uploaded (20)

PDF
Book industry state of the nation 2025 - Tech Forum 2025
BookNet Canada
 
PDF
Peak of Data & AI Encore AI-Enhanced Workflows for the Real World
Safe Software
 
PDF
CIFDAQ Market Wrap for the week of 4th July 2025
CIFDAQ
 
PDF
Agentic AI lifecycle for Enterprise Hyper-Automation
Debmalya Biswas
 
PPTX
Designing_the_Future_AI_Driven_Product_Experiences_Across_Devices.pptx
presentifyai
 
PPTX
Digital Circuits, important subject in CS
contactparinay1
 
PDF
“NPU IP Hardware Shaped Through Software and Use-case Analysis,” a Presentati...
Edge AI and Vision Alliance
 
PDF
“Computer Vision at Sea: Automated Fish Tracking for Sustainable Fishing,” a ...
Edge AI and Vision Alliance
 
PDF
Kit-Works Team Study_20250627_한달만에만든사내서비스키링(양다윗).pdf
Wonjun Hwang
 
PPTX
Future Tech Innovations 2025 – A TechLists Insight
TechLists
 
PDF
Newgen 2022-Forrester Newgen TEI_13 05 2022-The-Total-Economic-Impact-Newgen-...
darshakparmar
 
PDF
Go Concurrency Real-World Patterns, Pitfalls, and Playground Battles.pdf
Emily Achieng
 
PDF
Transcript: Book industry state of the nation 2025 - Tech Forum 2025
BookNet Canada
 
PDF
NASA A Researcher’s Guide to International Space Station : Physical Sciences ...
Dr. PANKAJ DHUSSA
 
PDF
UiPath DevConnect 2025: Agentic Automation Community User Group Meeting
DianaGray10
 
PDF
“Squinting Vision Pipelines: Detecting and Correcting Errors in Vision Models...
Edge AI and Vision Alliance
 
PDF
SIZING YOUR AIR CONDITIONER---A PRACTICAL GUIDE.pdf
Muhammad Rizwan Akram
 
PPTX
New ThousandEyes Product Innovations: Cisco Live June 2025
ThousandEyes
 
PDF
The Rise of AI and IoT in Mobile App Tech.pdf
IMG Global Infotech
 
PDF
Newgen Beyond Frankenstein_Build vs Buy_Digital_version.pdf
darshakparmar
 
Book industry state of the nation 2025 - Tech Forum 2025
BookNet Canada
 
Peak of Data & AI Encore AI-Enhanced Workflows for the Real World
Safe Software
 
CIFDAQ Market Wrap for the week of 4th July 2025
CIFDAQ
 
Agentic AI lifecycle for Enterprise Hyper-Automation
Debmalya Biswas
 
Designing_the_Future_AI_Driven_Product_Experiences_Across_Devices.pptx
presentifyai
 
Digital Circuits, important subject in CS
contactparinay1
 
“NPU IP Hardware Shaped Through Software and Use-case Analysis,” a Presentati...
Edge AI and Vision Alliance
 
“Computer Vision at Sea: Automated Fish Tracking for Sustainable Fishing,” a ...
Edge AI and Vision Alliance
 
Kit-Works Team Study_20250627_한달만에만든사내서비스키링(양다윗).pdf
Wonjun Hwang
 
Future Tech Innovations 2025 – A TechLists Insight
TechLists
 
Newgen 2022-Forrester Newgen TEI_13 05 2022-The-Total-Economic-Impact-Newgen-...
darshakparmar
 
Go Concurrency Real-World Patterns, Pitfalls, and Playground Battles.pdf
Emily Achieng
 
Transcript: Book industry state of the nation 2025 - Tech Forum 2025
BookNet Canada
 
NASA A Researcher’s Guide to International Space Station : Physical Sciences ...
Dr. PANKAJ DHUSSA
 
UiPath DevConnect 2025: Agentic Automation Community User Group Meeting
DianaGray10
 
“Squinting Vision Pipelines: Detecting and Correcting Errors in Vision Models...
Edge AI and Vision Alliance
 
SIZING YOUR AIR CONDITIONER---A PRACTICAL GUIDE.pdf
Muhammad Rizwan Akram
 
New ThousandEyes Product Innovations: Cisco Live June 2025
ThousandEyes
 
The Rise of AI and IoT in Mobile App Tech.pdf
IMG Global Infotech
 
Newgen Beyond Frankenstein_Build vs Buy_Digital_version.pdf
darshakparmar
 

JWTs in Java for CSRF and Microservices