.NET Day 2026 How Banks Protect Their Applications with FAPI

Transcript

1. Prep C:\Users\rolan\source\repos\OAuthUpdate
2. How Banks Protect Their Apps with FAPI 2.0 Roland Guijt Duende Software | Microsoft MVP @rolandguijt | roland@duendesoftware.com
3. Assumed Knowledge OpenID Connect/OAuth
4. Meet the Characters Alice Bank Customer Mallory The Attacker FinBuddy Fintech App Alice's Bank OAuth Provider
5. The Story Begins Alice wants to pay €5,000 to a merchant using FinBuddy. · FinBuddy needs access to Alice’s bank account · Uses OAuth 2.0 for authorization · Mallory is lurking on the network...
6. Step 1: Authorization URL Exposed FinBuddy builds authorization URL with sensitive data: https://bank.example/auth? client_id=finbuddy& redirect_uri=app://callback& scope=payments& amount=5000&account=merchant123
7. Where Payment Details Leak · Browser history stores entire URL · Server access logs capture full query string · Analytics tools track the URL · Network proxies can intercept it
8. Step 2: Vague Consent Screen Authorization Request FinBuddy wants to: ✓ Access your payment accounts No details about amount or recipient!
9. Step 3: Bearer Token = Shared Secret · Alice approves; bank issues bearer token · Code is sent via browser: interceptable · Token is just a string with no binding · Anyone with the token can use it · Valid for high-value payment operations
10. Mallory's Attack Vectors · Rogue WiFi network intercepts traffic · Compromised proxy · Server log files left unsecured · Cross-site scripting (XSS) attack
11. Mallory Strikes! · Mallory intercepts the bearer token from logs · Replays token from her own machine · Changes payment destination to her account · Bank API can't distinguish legitimate vs. stolen token
12. Alice's Money Goes to Mallory Everyone followed an OAuth tutorial... Yet the payment still moved where it shouldn't!
13. We’ve implemented OAuth, so we’re secure.
14. FAPI 2.0 to the Rescue Security profile for high value scenarios Protects APIs and clients Set of OAuth BCPs (Best Current Practices)
15. Sent sensitive data in the authorize request Thou Shall Not Main FAPI Rules Use unconstrained access tokens Use unbound codes when using code flow Authenticate clients using a “password” Use Resource Owner Password Credentials Support public clients
16. Client Aut n o i t a z i r ho m o r f de Co Browser t s e u req Identity Provider t n i o ndp r o h t au e n o i izat Authorization Code Response type: code Scope: openid
17. Code to token endpoint Client m o r f de Co Browser Identity Provider t n i o ndp r o h t au e n o i izat Authorization Code Response type: code Scope: openid
18. Authorization Code Interception Attack Authorization Code Flow Problems Malicious apps can register a URL scheme matching the code target Attacker could gain access to logs Public clients are extra vulnerable (no client secret) Solution: bind code to client
19. code_challenge (hash of code_verifier) code_challenge_method (hash type) Code to token endpoint code_verifier Identity Provider t n i o p d n e n o i t a z i r o h t u a m o Code fr Browser Authorization Code with PKCE Response type: code Scope: openid
20. Demo PKCE
21. PAR (Pushed Authorization Request) POST Client Id Scopes ResponseType Redirect URI Server application Browser Requires client authentication PAR endpoint Identity Provider
22. PAR JSON: RequestUri (ID), ExpiresIn Authorization endpoint Server application Identity Provider RequestUri RequestUri Browser
23. Demo PAR
24. DPoP Demonstrating Proof of Possession mTLS came before it Purpose: bind access tokens to the client
25. DPoP Generate private-public key pair Client Identity Provider
26. DPoP DPoP proof: JWT Standard token request parameters Client Request info Public key Signature Identity Provider
27. DPoP Includes public key Client Identity Provider
28. DPoP JWT Request info Signature Verify DPoP proof using public key in token API Client The client demonstrated proof of possession of the private key
29. Demo DPoP
30. private_key_jwt JWT Public-Private key pair Scopes Pre-registered Public key JwtId Subject IssuedAt Signature Client Identity Provider
31. private_key_jwt Client Identity Provider
32. Demo private_key_jwt
33. Which Flow? User involved? (Interactive client) No Client Credentials Yes Authorization Code + PKCE
34. Working with SPAs Are you really using Authorization Code Flow? Solution: BFF
35. BFF BFF (Server) /account/login SPA Identity Provider
36. BFF BFF (Server) SPA Identity Provider
37. BFF BFF (Server) /account/user SPA Identity Provider
38. BFF BFF (Server) /account/user SPA Identity Provider
39. BFF: External APIs BFF (Server) Identity Provider API SPA
40. Demo BFF
41. Next Steps Read the FAPI profile, no really https://openid.net/specs/fapi-security-profile-2_0-final.html https://openid.net/specs/fapi-attacker-model-2_0-final.html
42. Thanks! Please rate this session Roland Guijt Freelance Trainer and Consultant | Microsoft MVP @rolandguijt | roland.guijt@gmail.com