Death to Cookies Long Live Tokens - Gluecon 2014

Cookies have been around for decades and have served us well. Nobody questions their usefulness. However, modern apps demand a better approach. This session is all about the natural successor to cookies: using a token-based design. Tokens help build apps that are assembled on multiple stacks, that use your own and 3rd party APIs, that run on-premises and the cloud. They help easily “flow” user identity across all layers and security contexts, regardless of how they authenticated. And help you deal with CORS and XSRF. Join a code session in which we’ll implement a token-based app using AngularJs and an API.

Code for this presentation is here
https://github.com/auth0/death-to-cookies-gluecon

Transcript

1. Death to Cookies Long Live Tokens @woloski @eugenio_pace #tokensftw
2. Browser Web Server auth C C Most of the web
3. Browser Web Server (Python) Realtime (Node) C M modern apps
4. Browser Web Server (Python) Realtime (Node) C M ! Cookies are coupled to the web framework modern apps
5. Browser Web Server (Python) Realtime (Node) C M API (Node) A Phones Tablets A modern apps
6. Browser Web Server (Python) Realtime (Node) C M API (Node) A Set-Cookie + CORS = doesn’t play well Phones Tablets A modern apps
7. Browser Web Server (Python) Realtime (Node) C M API (Ruby) API (Node) A A Phones Tablets A modern apps
8. Browser Web Server (Python) Realtime (Node) C M API (Ruby) API (Node) A A AWS S3 S Phones Tablets A modern apps
9. Browser Web Server (Python) Realtime (Node) C M API (Ruby) API (Node) A A ! Cookies don’t “flow” AWS S3 S Phones Tablets A modern apps
10. http://tools.ietf.org/html/draft-ietf-oauth-json-web-token A better approach Token-based Authentication
11. https://github.com/ auth0/death-to-cookies- gluecon Demos
12. How it works? jwt.io
13. Browser modern apps Web Server (Python) Realtime (Node) API (Ruby) API (Node) AWS S3 Phones Tablets
14. Learn more at the Auth0 booth codecademy
15. Thanks! @woloski @eugenio_pace auth0.com jwt.io