Death To Cookies: Long Live JSON Web Tokens

Cookies have been around for decades and have served us well. Nobody questions their usefulness. However, modern apps demand a better approach. This session is all about the natural successor to cookies: using a token-based design. Tokens help build apps that are assembled on multiple stacks, that use your own and 3rd party APIs, that run on-premises and the cloud. They help easily “flow” user identity across all layers and security contexts, regardless of how they authenticated. And they help you deal with CORS and XSRF. Join a code session in which we’ll implement a token-based app using AngularJs and an API.

Transcript

1. Death to Cookies Long Live JSON Web Tokens
2. CTO & Founder Auth0 @woloski @mgonto Dev Advocate Auth0
3. Identity made simple for developers
4. The Following SESSION is Rated R for Live Coding on Stage it has been approved for ALL Developers
5. Authentication for Modern Applications using Tokens angular-­‐storage
 angular-­‐jwt   jwt-­‐decode
6. Browser Web Server auth C C Most of the web
7. Browser Web Server (PHP) Realtime (Node) C M modern apps
8. Browser Web Server (PHP) Realtime (Node) C M Cookies are coupled to the web framework modern apps
9. Browser Web Server (PHP) Realtime (Node) C M API (Node) A Phones Tablets A modern apps
10. Browser Web Server (PHP) Realtime (Node) C M API (Node) A APIs don’t use Cookies Phones Tablets A modern apps
11. Browser Web Server (PHP) Realtime (Node) C M API (Ruby) API (Node) A A Phones Tablets A modern apps
12. Browser Web Server (PHP) Realtime (Node) C M API (Ruby) API (Node) A A AWS S3 S Phones Tablets A modern apps
13. Browser Web Server (Python) Realtime (Node) C M API (Ruby) API (Node) A A Cookies don’t “flow” AWS S3 S Phones Tablets A modern apps
14. A better approach Token-based Authentication JSON Web Tokens https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-30
15. auth0/angularjs-jwt-authentication-tutorial Demo time! auth0/spa-jwt-authentication-tutorial
16. TouchID Ask User to Login with TouchID Is Private Key on KeyChain? Generate Key Pair and store in KeyChain Store Public Key on Server Generate JWT & Sign with Private Key Validate JWT with Public Key on Server Yes No
17. auth0/TouchIDAuth pod “TouchIDAuth”
18. Browser modern apps Web Server (Python) Realtime (Node) API (Ruby) API (Node) AWS S3 Phones Tablets
19. Win a Drone with JWTs! auze.ro/win-drone
20. T-shirts Bitcoins Stickers Drones Thanks!
21. Appendix
24. Token expires, deal with refresh
25. Confidential info, encrypt it
26. Social auth
27. Tokens can get big Don’t over engineer Don’t do fine grained permissions Define scopes
28. How to deal with protected images? https://github.com/hueniverse/hawk#single-uri-authorization Create signed requests (single URI authorization)