Securing your Web API with OAuth

Loading...

Flash Player 9 (or above) is needed to view presentations.
We have detected that you do not have it on your computer. To install it, go here.

0 comments

Post a comment

    Post a comment
    Embed Video
    Edit your comment Cancel

    2 Favorites

    Securing your Web API with OAuth - Presentation Transcript

    1. Securing your Web API with OAuth
      • Mohanaraj Gopala Krishnan
      • MYOSS Meetup 4 Dec 2008
      • mohangk.org/blog
    2. Questions for you
      • Experience with OAuth?
        • Developed, read spec, heard of ?
      • Application that exposes a Web API ?
        • Authentication ?
      • Experience using BBAuth, Authsub, Flickr Auth etc. ?
    3. What is OAuth?
      • A simple open standard for Web API authorization
      • End Users
        • Share information between online services without disclosing passwords
      • Web service (Service providers)
        • Allow for secure access to your API in a user controlled, secure manner
      • 3rd Party application (Consumers)
        • A standard authorization scheme for the web
    4. Valet key for your web http://toyotaownersclub.com/forums/index.php?showtopic=77384
    5. VS
    6. http://www.flickr.com/photos/leelefever/133949029/
    7. OpenID vs OAuth
      • Goals are different
        • OpenID is about sharing a single identity with different consumers
        • OAuth is about sharing your data with different consumers without sharing your identity
      • Not mutually exclusive
    8. OpenID vs OAuth
      • Commonality
        • Open protocols - community driven
        • Involves 3 parties
        • Involves moving the users between consumer and service provider
        • Involves laying a claim that is verified by the service/identity provider
          • OpenID - “I own this URL”
          • OAuth - “I own this resource”
    9. Love triangle End user Service provider Consumer
    10. WTF ?!
    11. “ Passwords are not confetti. Please stop throwing them around. Especially if they’re not yours ” Chris Messina http://www.slideshare.net/carsonified/how-oauth-and-portable-data-can-revolutionize-your-web-app-chris-messina-presentation/
    12. OAuth interaction demo
      • Simple demo
        • http://oauth.kg23.com /
    13. OAuth dance steps http://flickr.com/photos/wigwam/2255831538/
    14. OAuth dance steps consumer key An identifier for the consumer to the service provider consumer secret Secret used to establish ownership of the consumer key request token A value that is used to obtain authorization from the user. Finally traded in for an access token. access token Value used to gain access to a protected resource on behalf of the user without requiring the users credentials token secret Secret used to establish ownership of a given token
    15. OAuth dance steps
      • http://www.googlecodesamples.com/oauth_playground/
    16.  
    17. OAuth roles
      • Service provider
        • Implement three service endpoints
          • Get request token
          • Authenticate request token
          • Exchange request token for access token
        • Provides a form of authentication
        • Validates following requests (post OAuth dance)
        • Provides a mechanism to maintain authorization
        • Additional API services
          • e.g. Access token lifecycle management - revocation, extension
      • Service providers need to allow for end users to manage their authorizations
    18. OAuth roles
      • Consumer
        • Acquire consumer key / consumer secret
        • Communication with service provider
          • Over HTTP - header, POST, GET query
        • Signing requests
          • HMAC-SHA1,RSA-SHA1,PLAINTEXT
        • Keep track of access tokens
          • Store association of users to access token
          • Service providers have different policy as to token lifetime-e.g. Goog vs Y!
          • Must be treated as securely as passwords
    19. OAuth security http://icanhascheezburger.com/2007/11/27/meh-security-system-let-me-showz-u-him/
    20. OAuth security
      • Signing - allows for security beyond HTTP basic auth
        • No secret over the wire beyond the dance
        • Request is verifiable - untampered
      • Nonce & timestamps - mitigate replay attacks
      • Delegation of credentials instead of direct credentials
      • HTTPS still required for mitigating MITM - but if not too critical, request signing should suffice
    21. Signature HMAC-SHA1 HTTP method Base URL Normalized parameters oauth parameters oauth_consumer_key, oauth_token, oauth_nonce, oauth_timestamp, oauth_signature_mothod, oauth_version request parameters param1,param2 oauth_signature = HMAC-SHA1(text,secret) consumer_secret & oauth_token_secret *also base64 encoded + urlencoded
    22. Signature RSA-SHA1 HTTP method Base URL Normalized parameters oauth parameters oauth_consumer_key, oauth_token, oauth_nonce, oauth_timestamp, oauth_signature_mothod, oauth_version request parameters param1,param2 oauth_signature* = RSA-SHA1(text,secret) consumer_secret (consumer private key ) *also base64 encoded + urlencoded
    23. OAuth usage environments
      • Web application
        • Standard case
      • Gadgets
        • contained within a larger consumer - OAuth Gadget extension
      • 2-legged OAuth
        • No user involved - the consumer has been put in a position of trust - e.g. Google domain administrator or accessing public data
        • Extension implemented by Goog - Only HMAC-SHA1, no oauth_token, additional - xoauth_requestor_id - user to imitate, must be explicitly enabled
      • Desktop apps / JS apps
        • Consumer secret can be easily compromised - trust levels
        • Doesn’t compromise authorization
    24. Why bother?
      • Large adoption - Goog, Y!, MySpace
      • Interop - Leverage the services
      • Can be used as a replacement for HTTP basic auth
        • SSL might not be always necessary
      • Part of the Open web stack
        • Atompub + OpenID + OAuth + XRDS +OpenSocial
    25. Why bother ? “ OpenID + OAuth is the Final Nail in the Coffin of the WS-* vs. REST Discussion” Dare Obsanjo http:// www.25hoursaday.com/weblog/2007/11/12/OpenIDOAuthIsTheFinalNailInTheCoffinOfTheWSVsRESTDiscussion.aspx
    26. State of OAuth
      • OAuth Core 1.0, IETF Draft
      • Different use environments being worked out via extensions
      • Library support - extensive, but varying quality
      • OpenID + OAuth hybrid models
      • Usability funkiness
    27. Implementations
      • Libraries
        • oauth.net/code
        • http://github.com/search?q=oauth&x=0&y=0
      • Server implementations
        • PHP - http://code.google.com/p/oauth-php/
        • Ruby - http://github.com/pelle/oauth/tree/master
    28. Thanks

    + Mohanaraj Gopala KrishnanMohanaraj Gopala Krishnan, 7 months ago

    custom

    786 views, 2 favs, 0 embeds more stats

    A talk given by me at http://foss.org.my/meetups/kl more

    More info about this document

    © All Rights Reserved

    Go to text version

    • Total Views 786
      • 786 on SlideShare
      • 0 from embeds
    • Comments 0
    • Favorites 2
    • Downloads 16
    Most viewed embeds

    more

    All embeds

    less

    Flagged as inappropriate Flag as inappropriate
    Flag as inappropriate

    Select your reason for flagging this presentation as inappropriate. If needed, use the feedback form to let us know more details.

    Cancel
    File a copyright complaint
    Having problems? Go to our helpdesk?

    Categories

    Tags