Death to cookies - JSConf.UY

Transcript

1. Death to Cookies Long Live Tokens @woloski @jfroma
4. Client Database auth persistent connection 1990’s Client Server Life was easy
5. Workstation Browser Database auth 2000’s Intranet Web Server Active Directory kerberos token Life inside corp
6. Workstation Browser Database Internet Web Server auth C C E-commerce
7. Browser Database Today’s applications Web Server (Scala) API (Ruby) API (Node) Phones Tablets Realtime (Sockets) API (Facebook) C M A A A AT
8. +80K Views
10. Cookie-based auth is a sub- optimal solution for today’s systems
11. Set-Cookie + CORS = doesn’t play well 1
12. Cookies are coupled to the web framework ! If you try to reuse a cookie issued by Java in Node, not easy 2
13. APIs don’t use cookies, native apps either 3
14. Cookies lead to CSRF attacks <iframe  style="display:none"  name="hidden"></iframe>   <form  name="csrf"                action="http://example.org/account/edit"                method="post"                target="hidden">   <input  type="hidden"  name="email"  value="attacker@email.tld"  />   <script>document.csrf.submit();</script> 4
15. http://tools.ietf.org/html/draft-ietf-oauth-json-web-token
16. How it works?
17. Not everything is pink color
18. art: http://abeon-hosting.com/security-blog/xss-attack-in-action-cookie-stealer/ Tokens XSS
19. Sanitize and encode everything ! Google Caja https://developers.google.com/caja/
20. Try token-based authentication in your next project
21. TOOOOOOOOKEEEENS
22. Thanks! @woloski @jfroma blog.auth0.com jwt.io
23. Browser Database Today Web Server (Scala) API (Ruby) API (Node) Phones Tablets Realtime (Sockets) API (Facebook) JWT JWT JWT JWT JWT AT JWT
27. JWT JSON Web Tokens eyJ0eXAiOiJKV1QiLC JhbGciOiJIUzI1NiJ9   .eyJ1c2VyX2lkIjoiM TIzNDUiLCJlbWFpbCI 6ImZvb0BiYXIuY29tI iwiZXhwIjoxMzkyMzI zMzQwLCJpYXQiOjEzO TIzMTYxNDB9   .KQma3tquGF_zKbLdX HV4zNJAupdHJdIk6L2 g6R8kcAY   ! ! {        "typ":"JWT",      "alg":"HS256"   } {        "user_id":  "12345",      "email"  :  "foo@bar.com",      "exp":  1392323340,      "iat":  1392316140   } HMACSHA256(            base64UrlEncode(header)        +  "."  +      base64UrlEncode(payload),        "secret")   ! header payload signature encoded decoded
28. Token expires, deal with refresh
29. Confidential info, encrypt it
30. Social auth
31. Tokens can get big Don’t over engineer Don’t do fine grained permissions Define scopes
32. How to deal with protected images? https://github.com/hueniverse/hawk#single-uri-authorization Create signed requests (single URI authorization)