Hide Your Keys - Speaker Deck

Slide 1

Slide 1 text

Hide Your Keys Matt Biilmann, 2017

Slide 2

Slide 2 text

Matt Biilmann CEO, Netlify

Slide 3

Slide 3 text

Publishing for the modern web

Slide 4

Slide 4 text

No content

Slide 5

Slide 5 text

The Evolution of the Web Unix Model Legacy Web (The site needs to be built EVERY time it’s served) Modern Web ~1970-1997 ~1997-Today Now CLIENT WEB SERVER APP SERVER DATABASE CLIENT SERVER CLIENT CDN SERVICES

Slide 6

Slide 6 text

Authenticating - Client <-> Server Unix Model Legacy Web (The site needs to be built EVERY time it’s served) Modern Web ~1970-1997 ~1997-Today Now CLIENT WEB SERVER APP SERVER DATABASE CLIENT SERVER CLIENT CDN SERVICES Stateful Protocol

Slide 7

Slide 7 text

Slide 8

Slide 8 text

Authenticating - Web Monolith Legacy Web (The site needs to be built EVERY time it’s served) Modern Web ~1997-Today Now CLIENT WEB SERVER APP SERVER DATABASE CLIENT CDN SERVICES HTTP - Stateless Protocol

Slide 9

Slide 9 text

Authenticating - Web Monolith Legacy Web (The site needs to be built EVERY time it’s served) Modern Web ~1997-Today Now CLIENT WEB SERVER APP SERVER DATABASE CLIENT CDN SERVICES Browser Server user/pw Request (Cookie) DB User Lookup Create Session Session ID (Set-Cookie) Lookup Session Response (HTML)

Slide 10

Slide 10 text

Authenticating - Micro Services t Modern Web CLIENT CDN SERVICES ?

Slide 11

Slide 11 text

API Authentication GET /api/v1/sites HTTP/1.1 Host: api.example.com Authorization: Bearer abcd1234 SPA BROWSER CDN API How do we get an access token?

Slide 12

Slide 12 text

API Authentication SPA BROWSER CDN API OAuth2 Auth flow options: Resource Owner Password Credentials Implicit Grant Authorization Code

Slide 13

Slide 13 text

OAuth2 - Resource Owner Password SPA BROWSER CDN API OAuth2 POST /token HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded grant_type=password&username=johndoe&password=A3ddj3w App MUST have a deep trust relationship with API!

Slide 14

Slide 14 text

OAuth2 - Implicit Grant SPA BROWSER CDN API OAuth2 Trust established via redirect URL No need for any API secret

Slide 15

Slide 15 text

OAuth2 - Implicit Grant SPA BROWSER CDN API Redirect to Auth Endpoint document.location.href = endpoint + `client_id=123&` + `response_type=token&` + `redirect_uri=` + document.location.href Auth Endpoint Redirects Back https://example.com/#access_token=abcd1234

Slide 16

Slide 16 text

OAuth2 - Implicit Grant SPA BROWSER CDN API Gotchas The previous example has a security flaw! Should use a “state” query parameter Not widely supported by OAuth providers

Slide 17

Slide 17 text

OAuth2 - Authorization Code SPA BROWSER CDN API Redirect to Auth Endpoint document.location.href = endpoint + `client_id=123&` + `response_type=code&` + `redirect_uri=` + document.location.href Auth Endpoint Redirects Back https://example.com/?code=SplxlOB

Slide 18

Slide 18 text

OAuth2 - Authorization Code SPA BROWSER CDN API Exchange code for access_token POST /token HTTP/1.1 Host: server.example.com Authorization: Basic czZCaGRSa3F0Mz grant_type=authorization_code&code=SplxlOB Auth Endpoint Returns Access Token

Slide 19

Slide 19 text

Slide 20

Slide 20 text

OAuth2 - Authorization Code SPA BROWSER CDN API Always needs a server side component when exchanging the authorization code for an access token or refresh token

Slide 21

Slide 21 text

API Authentication SPA BROWSER CDN API Browser Server Request (Token) DB Lookup Session Response (JSON)

Slide 22

Slide 22 text

Authenticating - Micro Services t Modern Web CLIENT CDN SERVICES ?

Slide 23

Slide 23 text

Authenticating - SPA API

Slide 24

Slide 24 text

Authenticating - JAMstack API API API API API

Slide 25

Slide 25 text

Authenticating - JAMstack API API API API API

Slide 26

Slide 26 text

Authenticating - JAMstack API API Auth API API API API • Tight Coupling • Single Point of Failure • Slow Performance

Slide 27

Slide 27 text

Authenticating - Micro Services t Modern Web CLIENT CDN SERVICES JWT

Slide 28

Slide 28 text

Authenticating - Micro Services t Modern Web CLIENT CDN SERVICES https://tools.ietf.org/html/rfc7519

Slide 29

Slide 29 text

Authenticating - JWTs t Modern Web CLIENT CDN SERVICES What is a JWT? •A JWT is just string •It has 3 parts: header.payload.signature •It is signed with a secret and can be veriﬁed

Slide 30

Slide 30 text

Authenticating - Micro Services t Modern Web CLIENT CDN SERVICES What is a JWT? Header Payload Signature

Slide 31

Slide 31 text

Authenticating - Micro Services t Modern Web CLIENT CDN SERVICES

Slide 32

Slide 32 text

Authenticating - Micro Services t Modern Web CLIENT CDN SERVICES What is a JWT? •Token identiﬁes user (“sub” claim) •Token can authorize the user (“trust”) •Token can include display data

Slide 33

Slide 33 text

Authenticating - JAMstack API API Auth API API API API

Slide 34

Slide 34 text

API API API API API Auth API JWT JWT JWT JW T JWT JW T

Slide 35

Slide 35 text

JWT Authentication SPA BROWSER CDN API Browser API Request (JWT) Response (JSON) Verify Signature + Claims

Slide 36

Slide 36 text

JWT Authentication SPA BROWSER CDN API The API is not mine and doesn’t support JWTs!

Slide 37

Slide 37 text

Authenticating - Micro Services t Modern Web CLIENT CDN SERVICES API Gateways Kong Gotiator AWS API Gateway

Slide 38

Slide 38 text

API Authentication SPA BROWSER CDN API Browser Gateway Request (JWT) API Proxy (token) Response (JSON) Verify Signature + Claims

Slide 39

Slide 39 text

Thank You Stateless Authentication + API Gateways + MicroServices = a decoupled architecture for the web @biilmann · www.netlify.com