This document summarizes a talk on Connect security given by Peter Brownlow from Atlassian. It discusses authentication using JSON Web Tokens (JWT) to verify who sent a message, as well as authorization to control what users are allowed to do through scopes and dynamic permissions. Some potential areas of improvement mentioned include enhancing JWT security with header and body hashes, improving usability of JWT expirations, and implementing three-legged OAuth flows between applications and servers. The talk emphasized balancing security with usability according to Atlassian's value of not upsetting customers.

1. June 3-5, 2014 | Berlin, Germany

2. Peter Brownlow, Senior Java Developer, Atlassian
Connect Security

3. Connect add-ons
3.500
installs from Marketplace

4. in-process plugins
1.500.000
installs from Marketplace

5. grow 500x
tension between security & usability
overtake in-process plugins

6. Don’t #@!% the customer.
- Atlassian value
”
“

7. Questions
Sneak Peeks
Authorization
Authentication
Connect Security

8. Authentication
who said that?
”“

10. Who sent the letter?
sender
signature

11. Was the letter tampered with?
!!!
tampering
“looks wrong”

12. Was the letter re-sent?
too long ago?
postmark

13. JSON Web Tokens
host product add-on
params, token
params, token
e.g. https://mycompany.com/awsome?user.key=peter&jwt=…
also “Authorization” HTTP header

14. JSON Web Tokens
• structured
• header JSON
• claims JSON
• signature
• base-64 encoded
{“typ":"JWT", “alg":"HS256"}
.
{“iss”:"myId", “exp":1300819380}
.
“signature”
eyJ0eXAiOi12KL98udNfg8z…

15. JSON Web Tokens
Letter
!
• sender
• signature
• changes “look wrong”
• postmark date
JWT
!
• issuer claim
• cryptographic signature
• signature, query hash claim
• expiry claim

16. Questions
Sneak Peeks
Authorization
Authentication
Connect Security

17. Authorization
can you do that?
”“

19. Authorization
Scopes: compare to white-list
Who can see the aliens?
generals interns

20. Authorization

21. Authorization
“How did that guy get in here?”
How to avoid “security surprise”?
Scopes displayed on installation
!!!

22. Authorization

23. Authorization
Personal access changes arbitrarily.
Add-on user permissions
How to accurately
allow access?

24. Authorization

25. Authorization

26. Questions
Sneak Peeks
Authorization
Authentication
Connect Security

27. Sneak Peeks
ideas in motion
”“

28. • Headers hash
• Body hash
More Custom JWT Claims?

29. • User loads page
• Goes to lunch
• Comes back, clicks link…
• Expired!
• Secure! But less usable.
JWT expiry improvements
• On click: no expiry
• JavaScript API?

30. • Act as a specified user
• Authorized by users
• Server to server
• 3LA Granted?
• Query parameters
• REST resource
Three Legged Auth

31. Recap
• Authentication
• Who said that?
• JWT claims
• JWT signature
• Authorization
• Can you do that?
• Scopes (static)
• User permissions (dynamic)

32. Questions
Sneak Peeks
Authorization
Authentication
Connect Security

33. Questions?
go.atlassian.com/ac-security