Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Intro to OAuth
Search
Frost
May 23, 2014
Technology
0
530
Intro to OAuth
Introduction to OAuth talk, given at PHP[tek] 2014
Frost
May 23, 2014
Tweet
Share
More Decks by Frost
See All by Frost
Mocking Dependencies in PHPUnit
mfrost503
0
360
Mocking Dependencies in PHPUnit
mfrost503
1
400
Other Decks in Technology
See All in Technology
[RSJ25] Feasible RAG: Hierarchical Multimodal Retrieval with Feasibility-Aware Embodied Memory for Mobile Manipulation
keio_smilab
PRO
0
120
DDD集約とサービスコンテキスト境界との関係性
pandayumi
2
270
ZOZOマッチのアーキテクチャと技術構成
zozotech
PRO
3
1.3k
Obsidian応用活用術
onikun94
1
430
Kubernetes における cgroup driver のしくみ: runwasi の bugfix より
z63d
2
250
バイブスに「型」を!Kent Beckに学ぶ、AI時代のテスト駆動開発
amixedcolor
2
380
シークレット管理だけじゃない!HashiCorp Vault でデータ暗号化をしよう / Beyond Secret Management! Let's Encrypt Data with HashiCorp Vault
nnstt1
3
230
RSCの時代にReactとフレームワークの境界を探る
uhyo
10
3.2k
共有と分離 - Compose Multiplatform "本番導入" の設計指針
error96num
1
210
Language Update: Java
skrb
2
280
Codeful Serverless / 一人運用でもやり抜く力
_kensh
7
350
おやつは300円まで!の最適化を模索してみた
techtekt
PRO
0
290
Featured
See All Featured
Large-scale JavaScript Application Architecture
addyosmani
512
110k
Fantastic passwords and where to find them - at NoRuKo
philnash
52
3.4k
Done Done
chrislema
185
16k
Building Better People: How to give real-time feedback that sticks.
wjessup
368
19k
The Power of CSS Pseudo Elements
geoffreycrofte
77
5.9k
Optimising Largest Contentful Paint
csswizardry
37
3.4k
Java REST API Framework Comparison - PWX 2021
mraible
33
8.8k
A better future with KSS
kneath
239
17k
Design and Strategy: How to Deal with People Who Don’t "Get" Design
morganepeng
131
19k
The MySQL Ecosystem @ GitHub 2015
samlambert
251
13k
Embracing the Ebb and Flow
colly
87
4.8k
Producing Creativity
orderedlist
PRO
347
40k
Transcript
Intro to OAuth Matt Frost @shrtwhitebldguy https://joind.in/10630
Who Am I? • Senior Engineer - Synacor • Author
• OSS Contributor • Mentoring Proponent • Podcast co-host
What is OAuth?
None
Tokens
Statelessness
Applications have tokens too
So what you’re saying is…
Yep!
Tokens can be stolen though
This is bad
Good news though!
There are different versions
Technically OAuth 1 is deprecated
Just like the mysql extension You’re probably going to run
into it at some point anyway….
So here’s the plan
None
OAuth 1.0 Client
So we need tokens, right?
Token Definitions
Consumer Tokens
Temporary Credentials
Access Tokens
Token Request Flow
Super simple right? https://developer.yahoo.com/oauth/guide/oauth-auth-flow.html
Let’s break this down, eh?
You need an application
Request the temporary tokens
If you signed it right…
You’ll have temporary credentials
You now use these to request Access Tokens
If you sign that request right…
You’ll have your actual Access Tokens!
You can store them in a session or database and
use them now!
Remember all that signing talk?
This is the hardest part…
Base String
<?php! ! $params = [! 'oauth_nonce' => $this->getNonce(),! ! 'oauth_callback'
=> $this->getCallback(),! ! 'oauth_signature_method' => $this->getSignatureMethod(),! ! 'oauth_timestamp' => time(),! ! 'oauth_consumer_key' => $this->getConsumerKey(),! ! 'oauth_token' => '',! ! 'oauth_version' => '1.0',! ];
HTTP Method and URI
Let’s see how this actually works
<?php! $httpMethod = 'POST';! $uri = ‘http://api.example.com/request_tokens';! ! $params =
[! 'oauth_nonce' => $this->getNonce(),! 'oauth_callback' => $this->getCallback(),! 'oauth_signature_method' => $this->getSignatureMethod(),! 'oauth_timestamp' => time(),! ‘oauth_consumer_key' => $this->getConsumerKey(),! 'oauth_token' => ‘',! 'oauth_version' => '1.0',! ];! ! $tempArray = [];! ksort($params);! foreach($params as $key => $value) {! ! $tempArray = $key . '=' . rawurlencode($value);! }! ! $baseString = $httpMethod . '&';! $baseString .= rawurlencode($uri) . '&';! $baseString .= implode('&', $tempArray);
Composite Key This is way easier…
Cram the 2 secrets together…
$consumer_secret = 'VERYSECRETZ';! $access_secret = 'SUCHSECURITY';! ! $composite_key = rawurlencode($consumer_secret)
.'&'. rawurlencode($access_secret);
Signing with HMAC-SHA1
$signature = base64_encode(hash_hmac(! ! 'sha1',! ! $baseString,! ! $compositeKey,! !
true! )); Here’s your signature!
There are other signature types but…
However…
None
Authorization Header
$params = [! 'oauth_nonce' => $this->getNonce(),! ! 'oauth_callback' => $this->getCallback(),!
! 'oauth_signature_method' => $this->getSignatureMethod(),! ! 'oauth_timestamp' => time(),! ! 'oauth_consumer_key' => $this->getConsumerKey(),! ! 'oauth_token' => '',! ! 'oauth_version' => '1.0',! ];! ! $params[‘oauth_signature’] = $signature; You probably remember this array?
$header = “Authorization: OAuth “;! $tempArray = [];! ! foreach($params
as $key => $value) {! $tempArray[] = $key . ‘=“‘. rawurlencode($value);! }! ! $header .= implode(‘,’, $tempArray);! We’ve seen similar code before…
Authorization: OAuth oauth_consumer_key="xxxxxxxxx", oauth_nonce="fklj2324kljfksjf234k", oauth_signature="8xJAdrE00wGH21w87P 6N%2F8c0XZfeo%3D", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1399488541", oauth_token="xxxxxxxxx", oauth_version="1.0"
This is the final result
Whew! That was some work
OAuth 1.0 Server
Token Generation
Recreate the signature with the info you received
If they match, they win!
If not…
None
Access Control…
OAuth 2 Client
Good news!
No signatures
Must use SSL/TLS
Consumer Credentials
Access Token
Grants
Authorization Code Grant
Authorization example - Foursquare
http://foursquare.com/oauth2/authenticate? client_id=XXXXXXXXX&response_type=code&redirect_uri=htt p://oauth.dev/examples/Foursquare/callback.php
Token Request
http://oauth.dev/examples/ Foursquare/callback.php? code=<CODE>
https://foursquare.com/oauth2/access_token? client_id=<CLIENT_ID>&client_secret=<CLIENT_SECRET >&code=<CODE>&callback=http://oauth.dev/examples/ Foursquare/callback.php&grant_type=authorization_code
If you can use this, you should
Implicit Grant
http://foursquare.com/oauth2/authenticate? client_id=XXXXXXXXX&response_type=token&redirect_uri=ht tp://oauth.dev/examples/Foursquare/callback.php
Resource Owner Credentials Grant
Client Credentials Grant
Scopes
“Scopes” in OAuth 1
Scopes in OAuth 2
None
Important Note on Scopes
Provides an ACL Framework
Refresh Tokens
Same Scope
OAuth 2 Server
Issuing Tokens
Should I Support All The Grants?
Maybe…
Authorization/Implicit Grants
Storing Token Info
Scopes
Reading Tokens
Query String, Header, Both?
A Caution Against Rolling Your Own
RFCs OAuth 1 RFC 5849 - http://tools.ietf.org/html/rfc5849 OAuth 2 RFC
6749 - http://tools.ietf.org/html/rfc6749
Questions?
Thank you! Matt Frost @shrtwhitebldguy https://joind.in/10630