Tweet
Tweet

Slide 1

Slide 1 text

All About Auth Tokens, Sessions and Redirects Or, What We Learned Building an Auth Common Service in GoBusiness

Slide 2

Slide 2 text

Why We Started This Journey us SPCP Necessity is the Mother of Production

Slide 3

Slide 3 text

Auth(entication) V. Auth(orization) Verifies entity identity Entity access

Slide 4

Slide 4 text

Authentication vs Authorization According to auth0 Source: https://auth0.com/docs/flows Salt Beef

Slide 5

Slide 5 text

OpenID Connect (OIDC) - OAuth OAuth 2.0 OpenID Connect

Slide 6

Slide 6 text

OIDC

Slide 7

Slide 7 text

OAUTH 2.0

Slide 8

Slide 8 text

SPCP us user

Slide 9

Slide 9 text

SPCP us user

Slide 10

Slide 10 text

SPCP us user auth -wra pper

Slide 11

Slide 11 text

SPCP us user auth -wra pper us us us us

Slide 12

Slide 12 text

SPCP us user auth -wra pper us us us us

Slide 13

Slide 13 text

SPCP us user auth-wrapper gobiz-auth us us us us

Slide 14

Slide 14 text

But wait, doesn’t SPCP have SSO?

Slide 15

Slide 15 text

Taken from SPCP OIDC Interface Specifications v1.5

Slide 16

Slide 16 text

SPCP us user us us us us

Slide 17

Slide 17 text

SPCP us user gobiz-auth us us us us

Slide 18

Slide 18 text

What’s in a Token - Types of JWTs - Why have a refresh and an access token and where to put them

Slide 19

Slide 19 text

JWTs JWT JWS JWE

Slide 20

Slide 20 text

JWT JWS JWE

Slide 21

Slide 21 text

ID, Refresh and Access Tokens - Short-lived - About direct access to resources - Longer-lived - Allows one to refresh access tokens Source: https://auth0.com/blog/refresh-tokens-what-are-they-and-when-to-use-them/

Slide 22

Slide 22 text

Can we do without some kind of server-side storage?

Slide 23

Slide 23 text

SPCP us user gobiz-auth us us us us

Slide 24

Slide 24 text

SPCP us user gobiz-auth us us us us

Slide 25

Slide 25 text

No, we can’t log users out.

Slide 26

Slide 26 text

Eager Server Validation vs Offline Token Validation Why one or the other? = Supporting no concurrent users

Slide 27

Slide 27 text

Hypothetically, /refresh: refreshes your access token /verify: verifies whether an access token is still valid

Slide 28

Slide 28 text

Do we always need a refresh, and an access token?

Slide 29

Slide 29 text

Modes of (Client-Side) Session Elongation A. Calling /refresh on every backend call B. Frontend will call /refresh periodically

Slide 30

Slide 30 text

Between the Storages Type Local Storage Session Storage Cookie GlobalThis Space Size 5MB (at least) 5MB (at least) 4KB (max) Browser Storage Properties Domain access Domain access Domain and subdomain access Domain access Removal Clear browsing data Close tab Set Expiration Clear browsing data

Slide 31

Slide 31 text

No content

Slide 32

Slide 32 text

Standard Ways to Protect a Cookie httpOnly flag (prevents client-side access; for server-side cookies) SameSite=strict (prevents CSRF) secure=true (only sends cookies on HTTPS protocol)

Slide 33

Slide 33 text

Backend vs Frontend Calls User-identifying vs Server-identifying Authentication vs Authorization What’s Secure, Anyway? Encryption vs Masking vs Hashing

Slide 34

Slide 34 text

User Requirements - Coming back to the login page to be auto-redirected to a post-login landing page if currently logged in. - If you already had a login page open - clicking on login button should through-train into the application. - Should a user be logged in when they open a different tab in the same browser? - Will determine where you store your session token - in localStorage, globalThis, Redux, Cookies (more work needed)

Slide 35

Slide 35 text

Why All The Redirects, Anyway - Different Authenticating Service (for e.g. SPCP) - Mysterious, it is

Slide 36

Slide 36 text

Puzzles Non Comprendo - “Protocol Fatigue” - Why do we need so many standards/protocols? - How are they different? - What differing functions do they serve? - Do people earn money when they make a new standard? - What qualifies as a “new standard”? - What is the meaning of life?

Slide 37

Slide 37 text

[Optional] Errors - Why don’t people recognize you as being authenticated

Slide 38

Slide 38 text

The End