JWTs for CSRF and Microservices

Stormpath Java Developer Evangelist, Micah Silverman, takes a deep dive into using JWTs to protect microservices from CSRF and more. Micah will explain how JWTs can be used to secure web applications built with Java, OAuth2 and JWTs, and 'unsafe' clients, while supporting security best practices and even improving application performance and scale.

Sign up for Stormpath: https://api.stormpath.com/register
More from Stormpath: https://stormpath.com/blog

Transcript

1. JWTs for CSRF and Microservices
2. Welcome! • Agenda • Stormpath 101 (5 mins) • JWT with CSRF & Microservices (40 mins) • Q&A (15 mins) • Claire Hunsaker VP of Marketing • Micah Silverman Java Developer Evangelist
3. Speed to Market & Cost Reduction • Complete Identity solution out-of-the-box • Security best practices and updates by default • Clean & elegant API/SDKs • Little to code, no maintenance
4. Stormpath User Management User Data User Workflows Google ID Your Applications Application SDK Application SDK Application SDK ID Integrations Facebook Active Directory SAML
5. Let’s talk about CSRF!
6. encodeSecret = "4pE8z3PBoHjnV1AhvGk+e8h2p+ShZpOnpr8cwHmMh1w=" computeHMACSHA256( header + "." + payload, base64DecodeToByteArray(encodedSecret) ) Signature Computation Pseudo-code
7. JWT Secret Anti-Patterns
8. .signWith( SignatureAlgorithm.HS256, "secret".getBytes("UTF-8") ) Short but not Sweet
9. String b64EncodedSecret = "Yn2kjibddFAWtnPJ2AFlL8WXmohJMCvigQggaEypa5E="; .signWith( SignatureAlgorithm.HS256, b64EncodedSecret.getBytes("UTF-8") ) You’re Doing it Wrong
10. String b64EncodedSecret = "Yn2kjibddFAWtnPJ2AFlL8WXmohJMCvigQggaEypa5E="; .signWith( SignatureAlgorithm.HS512, TextCodec.BASE64.decode(b64EncodedSecret) ) Supersize that Secret!
11. "Microservices are awesome, but they're not free." - Les Hazlewood, Stormpath CTO
12. Monolithic SOA AuthenticationService AuthorizationService ApplicationService OrganizationService DirectoryService AccountService GroupService Database Infrastructure
13. Microservices Database Infrastructure GroupService AccountService AuthenticationService AuthorizationService ApplicationService OrganizationService DirectoryService
14. Resources • Repos used in today’s preso: ◦ github.com/jwtk/jjwt ◦ github.com/stormpath/roadstorm-jwt-csrf-tutorial ◦ github.com/stormpath/roadstorm-jwt-microservices-tutorial • JJWT Guest Post on Baeldung - bit.ly/29ZPZAd • Stormpath Microservices Screencast - bit.ly/29Wi6iw • JWT Inspector - jwtinspector.io • HTTPie - github.com/jkbrzt/httpie • What are Microservices? ◦ martinfowler.com/articles/microservices.html • @afitnerd @goStormpath support@stormpath.com