JWTs for CSRF & Microservices

In this talk, I show how to use JWTs in two code examples. The first replaces the standard Spring Security CSRF (cross site request forgery) token mitigation with a JWT version. The second is a basic microservices example that demonstrates how to establish trust between two microservices using JWTs.

References for the source-code, this desk, and other resources can be found at: https://github.com/dogeared/JavaRoadStorm_CactusCon_2017

Transcript

3. Welcome! • Agenda • JWT with CSRF & Microservices (40 mins) • Okta 101 (5 mins) • Q&A (5 mins)
5. encodeSecret = "4pE8z3PBoHjnV1AhvGk+e8h2p+ShZpOnpr8cwHmMh1w=" computeHMACSHA256( header + "." + payload, base64DecodeToByteArray(encodedSecret) ) Signature Computation Pseudo-code
7. .signWith( SignatureAlgorithm.HS256, "secret".getBytes("UTF-8") ) Short but not Sweet
8. String b64EncodedSecret = "Yn2kjibddFAWtnPJ2AFlL8WXmohJMCvigQggaEypa5E="; .signWith( SignatureAlgorithm.HS256, b64EncodedSecret.getBytes("UTF-8") ) You’re Doing it Wrong
9. String b64EncodedSecret = "Yn2kjibddFAWtnPJ2AFlL8WXmohJMCvigQggaEypa5E="; .signWith( SignatureAlgorithm.HS512, TextCodec.BASE64.decode(b64EncodedSecret) ) Supersize that Secret!
10. "Microservices are awesome, but they're not free." - Les Hazlewood
11. Monolithic SOA AuthenticationService AuthorizationService ApplicationService OrganizationService DirectoryService AccountService GroupService Database Infrastructure
12. Microservices Database Infrastructure GroupService AccountService AuthenticationService AuthorizationService ApplicationService OrganizationService DirectoryService
13. Okta Enables Companies to Do Both IT & API Identity & Mobility Service: Identity Management Mobility Management Strong Authentication developer.okta.com Identity API Products: Identity API for Any App Developer Tools and Community Employees, Contractors Partners, Customers
14. Resources • Repos used in today’s preso: ◦ github.com/jwtk/jjwt ◦ github.com/dogeared/JavaRoadStorm2016 • https://afitnerd.com/JavaRoadStorm2016/ • JJWT Guest Post on Baeldung - bit.ly/29ZPZAd • OIDC Playground - https://okta-oidc-fun.herokuapp.com • Stormpath Microservices Screencast - bit.ly/29Wi6iw • JWT Inspector - jwtinspector.io • HTTPie - github.com/jkbrzt/httpie • What are Microservices? ◦ martinfowler.com/articles/microservices.html • @afitnerd @OktaDev