Auth Best Practices - Lessons Learned Writing the Most Amazing Auth Library Ever

This talk covers some quick best practices for authentication in general (with code samples given in Node). It covers password hashing, session management, cookies, CSRF, SSL, Basic Auth, and API authentication.

Transcript

1. Auth Best Practices
   Lessons learned writing the most
   amazing auth library ever.
   @rdegges
   

   View Slide

2. I’m Randall Degges
   Developer Evangelist at
   Stormpath
   Python / Node / Go
   Hacker
   

   View Slide

3. ● User account storage /
   encryption.
   ● Authentication.
   ● Authorization.
   ● REST API management.
   ● Social login.
   End
   User
   Your Webserver
   Stormpath API
   Stormpath
   

   View Slide

4. Part 1: Passwords
   

   View Slide

5. Creating users
   

   View Slide

6. What happens if?
   You leak a
   copy of your
   DB.
   Accidental
   console.log().
   Your co-worker
   steals some
   passwords.
   

   View Slide

7. View Slide

8. Password hashing!
   Give me your
   passwords!
   

   View Slide

9. View Slide

10. IMPOSSIBLE TO REVERSE!
    Dude, lam
    e :(
    

    View Slide

11. Popular algorithms
    ● md5
    ● sha1
    ● sha256
    ● sha512
    ● bcrypt
    ● scrypt
    

    View Slide

12. Storing password (safely)
    

    View Slide

13. Part 2: Sessions
    

    View Slide

14. browser server
    cookies
    Cookies!
    

    View Slide

15. How do you set cookies?
    body
    {
    "Content-Type": "text/html",
    "Set-Cookie": "session=12345"
    }
    body
    {
    "User-Agent": "cURL/1.2.3",
    "Accept": "*/*",
    "Host": "localhost:3000",
    "Cookie": "session=12345"
    }
    

    View Slide

16. But what do you store?
    User IDs, normally.
    

    View Slide

17. Using session cookies
    

    View Slide

18. View Slide

19. Reading session cookies
    

    View Slide

20. Part 3: CSRF
    

    View Slide

21. *ssholes
    Hey Randall,
    Check out this picture of my dog! It’s sooo cute!
    PS: Don’t forget to log into your bank account
    first! <333
    

    View Slide

22. Preventing CSRF attacks
    

    View Slide

23. Part 4: Basic Auth
    body
    {
    "Content-Type": "application/json",
    "Authorization": "Basic: asdfjasdgasa",
    }
    

    View Slide

24. Authorization header
    Authorization: Basic:
    id:secret
    base64(id:secret)
    

    View Slide

25. Using basic auth
    

    View Slide

26. Specifying creds
    

    View Slide

27. Part 5: Best Practices
    

    View Slide

28. ALWAYS USE SSL!
    user server
    secret
    

    View Slide

29. Secure cookies
    

    View Slide

30. USE BASIC AUTH FOR
    SIMPLE STUFF
    

    View Slide

31. Part 6: In Practice
    

    View Slide

32. View Slide

33. View Slide

34. View Slide

35. But what about customization?
    

    View Slide

36. Thanks!
    @gostormpath
    @rdegges
    

    View Slide