Auth Best Practices
Lessons learned writing the most
amazing auth library ever.
@rdegges
Slide 2
Slide 2 text
I’m Randall Degges
Developer Evangelist at
Stormpath
Python / Node / Go
Hacker
Slide 3
Slide 3 text
● User account storage /
encryption.
● Authentication.
● Authorization.
● REST API management.
● Social login.
End
User
Your Webserver
Stormpath API
Stormpath
Slide 4
Slide 4 text
Part 1: Passwords
Slide 5
Slide 5 text
Creating users
Slide 6
Slide 6 text
What happens if?
You leak a
copy of your
DB.
Accidental
console.log().
Your co-worker
steals some
passwords.
How do you set cookies?
body
{
"Content-Type": "text/html",
"Set-Cookie": "session=12345"
}
body
{
"User-Agent": "cURL/1.2.3",
"Accept": "*/*",
"Host": "localhost:3000",
"Cookie": "session=12345"
}
Slide 16
Slide 16 text
But what do you store?
User IDs, normally.
Slide 17
Slide 17 text
Using session cookies
Slide 18
Slide 18 text
No content
Slide 19
Slide 19 text
Reading session cookies
Slide 20
Slide 20 text
Part 3: CSRF
Slide 21
Slide 21 text
*ssholes
Hey Randall,
Check out this picture of my dog! It’s sooo cute!
PS: Don’t forget to log into your bank account
first! <333
Slide 22
Slide 22 text
Preventing CSRF attacks
Slide 23
Slide 23 text
Part 4: Basic Auth
body
{
"Content-Type": "application/json",
"Authorization": "Basic: asdfjasdgasa",
}