Secure API Services in Node with Basic Auth and OAuth2

In this presentation, Lead Developer Evangelist Randall Degges will go over how API authentication works via HTTP Basic Auth and OAuth2 (Client Credentials), and will show you how to secure an Express.js API service with both of them using Stormpath!

Sign up for Stormpath: https://api.stormpath.com/register
More from Stormpath: https://stormpath.com/blog

Transcript

1. Secure API Services in Node.js
2. Welcome! • Agenda • Stormpath 101 (5 mins) • How to secure an API (25 mins) • Q&A (30 mins) • Claire Hunsaker VP of Marketing & Customer Success • Randall Degges Node.js Evangelist
3. Customer Identity Poses Major Challenges
4. Speed to Market & Cost Reduction • Complete Identity solution out-of-the-box • Security best practices and updates by default • Clean & elegant API/SDKs • Little to code, no maintenance Focus on Your Core Competency
5. Stormpath User Management User Data User Workflows Google ID Your Applications Application SDK Application SDK Application SDK ID Integrations Facebook Active Directory SAML
6. Features • Secure, flexible Authentication (Password, Token, OAuth, API) • Deep Authorization Groups, Roles Customer Organizations Permissions • Customer Profile Data • Single Sign-On Across Your Apps • Hosted User Screens
7. What’s the Goal of This Talk?
8. D’oh! API Server(s) API Client API Client API Client API Client Internet
9. API Server(s) API Server(s) Browser / Mobile Web API Client Client-to-API Server-to-API
10. Basic Auth OAuth2 What’s the Goal of This Talk?
11. About API Keys…
12. randall@stormpath.com iLOVEc00kies! API Server(s) Website
13. 163e087c36c34fa4b4635995c29cf9b5:b6e7bd4c74cf430493fe03b2e30225f8 API Secret Long, random strings (uuids).
14. Let Users Have Multiple API Keys Key 1 Key 2 ID: 3c511ea2ef424dd88bc1575e7e5a2bd7 Secret: 1ae8120c1ec940638913f4e258b8f7fe ID: cc463f7aabfd4132a2211006886d05f1 Secret: 85172ea5aef144038f019b3111b5e11a
15. Creating API Keys with Stormpath req.user.createApiKey(function(err, apiKey) { if (err) throw err; console.log('New API key created!'); console.log('API Key ID:', apiKey.id); console.log('API Key Secret:', apiKey.secret); });
16. LET’S SET UP STORMPATH!
17. LET’S WRITE SOME CODE!
18. How Does Basic Auth Work? API Server(s) Authorization: Basic <base64(id:secret)> $ curl --user id:secret http://localhost:3000/api/test
19. How Does OAuth2 Work? (Step 1) API Server(s) Authorization: Basic <base64(id:secret)> Access Token $ curl --user id:secret \ -X POST \ --data grant_type=client_credentials \ http://localhost:3000/oauth/token
20. How Does OAuth2 Work? (Step 2) API Server(s) Authorization: Bearer <token> $ curl -H “Authorization: Bearer <token>” \ http://localhost:3000/api/test
21. Node & Express Resources • Talking to OAuth2 Services with Node.js https://stormpath.com/blog/talking-to-oauth2-services-with-nodejs • What the Heck is OAuth? https://stormpath.com/blog/what-the-heck-is-oauth/ • Stormpath Express Library http://docs.stormpath.com/nodejs/express/latest/ • All Our JavaScript Integrations http://docs.stormpath.com/nodejs/
22. QUESTIONS?
23. THANK YOU