Download as PDF, PPTX
![JavaOne
#RESTSecurity @dblevins @tomitribe
• { "alg": “RS256", "typ": “JWT" }
• {
"token-type": "access-token",
"username": "snoopy",
"animal": "beagle",
"iss": "https://demo.superbiz.com/oauth2/token",
"scopes": [
“twitter”, "mans-best-friend"
],
"exp": 1474280963,
"iat": 1474279163,
"jti": "66881b068b249ad9"
}
• DTfSdMzIIsC0j8z3icRdYO1GaMGl6j1I_2DBjiiHW9vmDz8OAw8Jh8DpO32fv0vIC
c0hb4F0QCD3KQnv8GVM73kSYaOEUwlW0k1TaElxc43_Ocxm1F5IUNZvzlLJ_ks
FXGDL_cuadhVDaiqmhct098ocefuv08TdzRxqYoEqYNo](https://image.slidesharecdn.com/2016javaonedeconstructingrestsecurity-161012192137/85/2016-JavaOne-Deconstructing-REST-Security-47-320.jpg)
Uploaded byDavid Blevins
2016 JavaOne Deconstructing REST Security
The document discusses REST security, focusing on various authentication and authorization mechanisms including basic auth, OAuth 2.0, and JSON Web Tokens (JWT). It highlights the performance metrics, potential security issues, and architectural changes when implementing these security models. Additionally, the document emphasizes the advantages of using JWT over traditional methods for improved security and efficiency in user authentication.
More Related Content
![[CB20]-U25 Automated Hunting for Cross-Server Xrefs in Microsoft RPC and COM ...](https://cdn.slidesharecdn.com/ss_thumbnails/u25saichengyongqingheandzhiminwangcb20-210112140344-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to 2016 JavaOne Deconstructing REST Security
![[OSSParis 2015] The OpenID Connect Protocol](https://cdn.slidesharecdn.com/ss_thumbnails/poss2015openidconnect-151120084012-lva1-app6891-thumbnail.jpg?width=640&height=640&fit=bounds)
2016 JavaOne Deconstructing REST Security
- 1. JavaOne #RESTSecurity @dblevins @tomitribe DeconstructingREST Security David Blevins Tomitribe
- 2. JavaOne #RESTSecurity @dblevins @tomitribe “Thenice thing about standards is you have so many to choose from.” - Andrew S. Tanenbaum
- 3. JavaOne #RESTSecurity @dblevins @tomitribe FocusAreas • Beyond Basic Auth • Theory of OAuth 2.0 • Introduction of JWT • Google/Facebook style API security • Stateless vs Stateful Architecture • HTTP Signatures • Amazon EC2 style API security
- 4. JavaOne #RESTSecurity @dblevins @tomitribe BaselineArchitecture 1000 users x 3 TPS 4 hops 3000 TPS frontend 12000 TPS backend
- 5. JavaOne #RESTSecurity @dblevins @tomitribe BasicAuth (and its problems)
- 6. JavaOne #RESTSecurity @dblevins @tomitribe BasicAuth Message POST /painter/color/object HTTP/1.1 Host: localhost:8443 Authorization: Basic c25vb3B5OnBhc3M= User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 45 {"color":{"b":255,"g":0,"name":"blue","r":0}}
- 7. JavaOne #RESTSecurity @dblevins @tomitribe BasicAuth Password Sent 3000 TPS (HTTP+SSL) username+password Base64 (no auth) 3000 TPS (LDAP) 12000 TPS (HTTP)
- 8. JavaOne #RESTSecurity @dblevins @tomitribe BasicAuth Password Sent 3000 TPS (HTTP+SSL) username+password Base64 username+password Base64 15000 TPS (LDAP) Password Sent 12000 TPS (HTTP)
- 9. JavaOne #RESTSecurity @dblevins @tomitribe BasicAuth Password Sent 3000 TPS (HTTP+SSL) username+password Base64 IP whitelisting 3000 TPS (LDAP) 12000 TPS (HTTP)
- 10. JavaOne #RESTSecurity @dblevins @tomitribe “Hey,give me all of Joe’s salary information.” “I don’t know who you are, … but sure!”
- 11.
- 12. JavaOne #RESTSecurity @dblevins @tomitribe BasicAuth - Attacks Valid Password Sent 3000 TPS (HTTP+SSL) IP whitelisting 9000 TPS (LDAP) 12000 TPS (HTTP) Invalid Password Sent 6000 TPS (HTTP+SSL)
- 13. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2.0 (and its problems)
- 14.
- 15.
- 16.
- 17.
- 18. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2 - Password Grant (LDAP) (Token Store) POST /oauth2/token Host: api.superbiz.io User-Agent: curl/7.43.0 Accept: */* Content-Type: application/x-www-form-urlencoded Content-Length: 54 grant_type=password&username=snoopy&password=woodstock HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Cache-Control: no-store Pragma: no-cache { "access_token":"2YotnFZFEjr1zCsicMWpAA", "expires_in":3600, "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA", } Verify Password Generate Token
- 19. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2.0 Message POST /painter/color/object HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 45 {"color":{"b":255,"g":0,"r":0,"name":"blue"}}
- 20. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2.0 Message POST /painter/color/palette HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 46 {"color":{"b":0,"g":255,"r":0,"name":"green"}}
- 21. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2.0 Message POST /painter/color/select HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 44 {"color":{"b":255,"g":0,"r":0,"name":"red"}}
- 22. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2.0 Message POST /painter/color/fill HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 49 {"color":{"b":255,"g":255,"r":0,"name":"yellow"}}
- 23. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2.0 Message POST /painter/color/stroke HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 49 {"color":{"b":255,"g":200,"r":0,"name":"orange"}}
- 24.
- 25. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2 - Refresh Grant (LDAP) (Token Store) Verify Password Generate Token POST /oauth2/token Host: api.superbiz.io User-Agent: curl/7.43.0 Accept: */* Content-Type: application/x-www-form-urlencoded Content-Length: 54 grant_type=refresh_token&refresh_token=tGzv3JOkF0XG5Qx2TlKWIA HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Cache-Control: no-store Pragma: no-cache { "access_token":"6Fe4jd7TmdE5yW2q0y6W2w", "expires_in":3600, "refresh_token":"hyT5rw1QNh5Ttg2hdtR54e", }
- 26. JavaOne #RESTSecurity @dblevins @tomitribe Oldpair • Access Token 2YotnFZFEjr1zCsicMWpAA • Refresh Token tGzv3JOkF0XG5Qx2TlKWIA New pair • Access Token 6Fe4jd7TmdE5yW2q0y6W2w • Refresh Token hyT5rw1QNh5Ttg2hdtR54e
- 27. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2.0 Message POST /painter/color/palette HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 6Fe4jd7TmdE5yW2q0y6W2w User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 46 {"color":{"b":0,"g":255,"r":0,"name":"green"}}
- 28. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2.0 Message POST /painter/color/select HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 6Fe4jd7TmdE5yW2q0y6W2w User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 44 {"color":{"b":255,"g":0,"r":0,"name":"red"}}
- 29. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2.0 Message POST /painter/color/fill HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 6Fe4jd7TmdE5yW2q0y6W2w User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 49 {"color":{"b":255,"g":255,"r":0,"name":"yellow"}}
- 30. JavaOne #RESTSecurity @dblevins @tomitribe Whathave we achieved?
- 31. JavaOne #RESTSecurity @dblevins @tomitribe Youhave more passwords (at least your devices do)
- 32. JavaOne #RESTSecurity @dblevins @tomitribe TermAlert • Password Grant??? • Logging in • Token? • Slightly less crappy password • Equally crappy HTTP Session ID
- 33. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2 Tokens Sent 3000 TPS (HTTP+SSL) IP whitelisting 3000 TPS (token checks) Password Sent 1000/daily (HTTP+SSL) OAuth 2 (LDAP) 4 hops 12000 TPS backend
- 34.
- 35. JavaOne #RESTSecurity @dblevins @tomitribe “Whothe heck is 6Fe4jd7TmdE5y W2q0y6W2w ???????” “No idea, dude. Ask the token server.”
- 36. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2 Tokens Sent 3000 TPS (HTTP+SSL) IP whitelisting 3000 TPS (token checks) Password Sent 1000/daily (HTTP+SSL) OAuth 2 (LDAP) 12000 TPS (token checks) 8 hops 24000 TPS backend
- 37. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2 Tokens Sent 3000 TPS (HTTP+SSL) IP whitelisting 3000 TPS (token checks) Password Sent 1000/daily (HTTP+SSL) OAuth 2 (LDAP) 12000 TPS (token checks) 8 hops 24000 TPS backend 55% of all traffic
- 38. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2 Tokens Sent 3000 TPS (HTTP+SSL) IP whitelisting 0 TPS (token checks) Password Sent 1000/daily (HTTP+SSL) OAuth 2 (LDAP) 0 TPS (token checks) 0 hops 0 TPS backend
- 39. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2 Pointer Pointer State
- 40. JavaOne #RESTSecurity @dblevins @tomitribe AccessToken Access Pointer? Access Primary Key?
- 41. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2.0 High Frequency Password Exchange Algorithm?
- 42. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2.0 + JSon Web Tokens (JWT)
- 43. JavaOne #RESTSecurity @dblevins @tomitribe JSonWeb Token • Pronounced “JOT” • Fancy JSON map • Base64 URL Encoded • Digitally Signed (RSA-SHA256, HMAC-SHA512, etc) • Built-in expiration
- 44. JavaOne #RESTSecurity @dblevins @tomitribe AccessToken Previously • 6Fe4jd7TmdE5yW2q0y6W2w
- 45. JavaOne #RESTSecurity @dblevins @tomitribe AccessToken Now • eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbi10eXBlIjoi YWNjZXNzLXRva2VuIiwidXNlcm5hbWUiOiJzbm9vcHkiLCJhb mltYWwiOiJiZWFnbGUiLCJpc3MiOiJodHRwczovL2RlbW8uc3 VwZXJiaXouY29tL29hdXRoMi90b2tlbiIsInNjb3BlcyI6WyJ0d2l 0dGVyIiwibWFucy1iZXN0LWZyaWVuZCJdLCJleHAiOjE0NzQy ODA5NjMsImlhdCI6MTQ3NDI3OTE2MywianRpIjoiNjY4ODFi MDY4YjI0OWFkOSJ9.DTfSdMzIIsC0j8z3icRdYO1GaMGl6j1I_2 DBjiiHW9vmDz8OAw8Jh8DpO32fv0vICc0hb4F0QCD3KQnv8 GVM73kSYaOEUwlW0k1TaElxc43_Ocxm1F5IUNZvzlLJ_ksFXG DL_cuadhVDaiqmhct098ocefuv08TdzRxqYoEqYNo
- 46. JavaOne #RESTSecurity @dblevins @tomitribe AccessToken Now • header (JSON > Base64 URL Encoded) • describes how the token signature can be checked • payload (JSON > Base64 URL Encoded) • Basically a map of whatever you want to put in it • Some standard keys such as expiration • signature (Binary > Base64 URL Encoded • The actual digital signature • made exclusively by the /oauth2/token endpoint • If RSA, can be checked by anyone
- 47. JavaOne #RESTSecurity @dblevins @tomitribe •{ "alg": “RS256", "typ": “JWT" } • { "token-type": "access-token", "username": "snoopy", "animal": "beagle", "iss": "https://demo.superbiz.com/oauth2/token", "scopes": [ “twitter”, "mans-best-friend" ], "exp": 1474280963, "iat": 1474279163, "jti": "66881b068b249ad9" } • DTfSdMzIIsC0j8z3icRdYO1GaMGl6j1I_2DBjiiHW9vmDz8OAw8Jh8DpO32fv0vIC c0hb4F0QCD3KQnv8GVM73kSYaOEUwlW0k1TaElxc43_Ocxm1F5IUNZvzlLJ_ks FXGDL_cuadhVDaiqmhct098ocefuv08TdzRxqYoEqYNo
- 48. JavaOne #RESTSecurity @dblevins @tomitribe SubtleBut High Impact Architectural Change
- 49. JavaOne #RESTSecurity @dblevins @tomitribe Whatwe had (quick recap)
- 50. JavaOne #RESTSecurity @dblevins @tomitribe (LDAP) PullUser Info From IDP
- 51. JavaOne #RESTSecurity @dblevins @tomitribe (LDAP) Generatean Access Token (pointer)
- 52.
- 53. JavaOne #RESTSecurity @dblevins @tomitribe (LDAP) SendAccess Token (pointer) to client
- 54. JavaOne #RESTSecurity @dblevins @tomitribe Results ClientHolds Pointer Server Holds State
- 55. JavaOne #RESTSecurity @dblevins @tomitribe Whatwe can do now (Hello JWT!)
- 56. JavaOne #RESTSecurity @dblevins @tomitribe (LDAP) PullUser Info From IDP
- 57. JavaOne #RESTSecurity @dblevins @tomitribe (LDAP) Formatthe data as JSON
- 58.
- 59. JavaOne #RESTSecurity @dblevins @tomitribe (LDAP) Insertonly pointer into DB (for revocation)
- 60. JavaOne #RESTSecurity @dblevins @tomitribe (LDAP) SendAccess Token (state) to client
- 61. JavaOne #RESTSecurity @dblevins @tomitribe ClientHolds State Server Holds Pointer Desired Results
- 62.
- 63. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2 - Password Grant (LDAP) (Token ID Store) POST /oauth2/token Host: api.superbiz.io User-Agent: curl/7.43.0 Accept: */* Content-Type: application/x-www-form-urlencoded Content-Length: 54 grant_type=password&username=snoopy&password=woodstock Verify Password Generate Signed Token HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Cache-Control: no-store Pragma: no-cache { "access_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9. eyJ0b2tlbi10eXBlIjoiYWNjZXNzLXRva2VuIiwidXNlcm5hb WUiOiJzbm9vcHkiLCJhbmltYWwiOiJiZWFnbGUiLCJpc3M iOiJodHRwczovL2RlbW8uc3VwZXJiaXouY29tL29hdXRoM i90b2tlbiIsInNjb3BlcyI6WyJ0d2l0dGVyIiwibWFucy1iZXN0 LWZyaWVuZCJdLCJleHAiOjE0NzQyODA5NjMsImlhdCI6M TQ3NDI3OTE2MywianRpIjoiNjY4ODFiMDY4YjI0OWFkOSJ 9.DTfSdMzIIsC0j8z3icRdYO1GaMGl6j1I_2DBjiiHW9vmDz8 OAw8Jh8DpO32fv0vICc0hb4F0QCD3KQnv8GVM73kSYaO EUwlW0k1TaElxc43_Ocxm1F5IUNZvzlLJ_ksFXGDL_cuadh VDaiqmhct098ocefuv08TdzRxqYoEqYNo", "expires_in":3600, "refresh_token":"eyJhbGctGzv3JOkF0XG5Qx2TlKWIAkF0X. eyJ0b2tlbi10eXBlIjoiYWNjZXNzLXRva2VuIiwidXNlcm5hb WUiOiJzbm9vcHkiLCJhbmltYWwiOiJiZWFnbGUiLCJpc3M iOiJodHRwczovL", }
- 64. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2.0 Message with JWT POST /painter/color/palette HTTP/1.1 Host: api.superbiz.io Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbi10eXBlIjoiYWNjZXNzLXR va2VuIiwidXNlcm5hbWUiOiJzbm9vcHkiLCJhbmltYWwiOiJiZWFnbGUiLCJpc3MiOiJodHRwczovL2RlbW8uc3VwZXJ iaXouY29tL29hdXRoMi90b2tlbiIsInNjb3BlcyI6WyJ0d2l0dGVyIiwibWFucy1iZXN0LWZyaWVuZCJdLCJleHAiOjE0NzQy ODA5NjMsImlhdCI6MTQ3NDI3OTE2MywianRpIjoiNjY4ODFiMDY4YjI0OWFkOSJ9.DTfSdMzIIsC0j8z3icRdYO1GaMGl 6j1I_2DBjiiHW9vmDz8OAw8Jh8DpO32fv0vICc0hb4F0QCD3KQnv8GVM73kSYaOEUwlW0k1TaElxc43_Ocxm1F5IUNZ vzlLJ_ksFXGDL_cuadhVDaiqmhct098ocefuv08TdzRxqYoEqYNo User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 46 {"color":{"b":0,"g":255,"r":0,"name":"green"}}
- 65. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2 + JWT Tokens Sent 3000 TPS (HTTP+SSL) IP whitelisting 0.55 TPS (refresh token checks) Password Sent 1000/daily (HTTP+SSL) OAuth 2 (LDAP) 4 hops 12000 TPS backend 3000 TPS (signature verification) 12000 TPS (signature verification)
- 66. JavaOne #RESTSecurity @dblevins @tomitribe “Hey,give me all of Joe’s salary information.” “Not a chance!”
- 67. JavaOne #RESTSecurity @dblevins @tomitribe “Hey,give me all of Joe’s salary information.” “Sure thing!”
- 68. JavaOne #RESTSecurity @dblevins @tomitribe OAuth2 + JWT Valid Tokens Sent 3000 TPS (HTTP+SSL) IP whitelisting 0.55 TPS (refresh token checks) Password Sent 1000/daily (HTTP+SSL) (LDAP) 4 hops 12000 TPS backend 9000 TPS (signature verification) 12000 TPS (signature verification) Invalid Tokens Sent 6000 TPS (HTTP+SSL)
- 69.
- 70. JavaOne #RESTSecurity @dblevins @tomitribe HTTPSignatures (Amazon EC2 style API Security)
- 71. JavaOne #RESTSecurity @dblevins @tomitribe HTTPSignatures • No “secret” ever hits the wire • Signs the message itself • Proves identity • Prevents message tampering • Symmetric or Asymmetric signatures • IETF Draft • https://tools.ietf.org/html/draft-cavage-http-signatures • Extremely simple • Does NOT eliminate benefits of JWT (they’
- 72. JavaOne #RESTSecurity @dblevins @tomitribe SignatureMessage POST /painter/color/palette HTTP/1.1 Host: api.superbiz.io Authorization: Signature keyId=“my-key-name", algorithm="hmac-sha256", headers="content-length host date (request-target)”, signature="j050ZC4iWDW40nVx2oVwBEymXzwvsgm+hKBkuw04b+w=" Date: Mon, 19 Sep 2016 16:51:35 PDT Accept: */* Content-Type: application/json Content-Length: 46 {"color":{"b":0,"g":255,"r":0,"name":"green"}}
- 73. JavaOne #RESTSecurity @dblevins @tomitribe SignatureAuth Password Sent 0 TPS (HTTP) Signature (no auth) 3000 TPS (LDAP or Keystore) 12000 TPS (HTTP)
- 74. JavaOne #RESTSecurity @dblevins @tomitribe SignatureAuth Password Sent 0 TPS (HTTP) Signature Signature 3000 TPS (LDAP or Keystore) 12000 TPS (HTTP)
- 75. JavaOne #RESTSecurity @dblevins @tomitribe “Hey,give me all of Joe’s salary information.” “Hey, Larry! Sure!”
- 76. JavaOne #RESTSecurity @dblevins @tomitribe OAuthand Signatures Password Sent 3000 TPS (HTTP+SSL) OAuth 2 Signature 12000 TPS (HTTP)
- 77. JavaOne #RESTSecurity @dblevins @tomitribe “Hey,give me all of Joe’s salary information.” “Sure thing, Larry! Tell Joe I said hi.”
- 78. JavaOne #RESTSecurity @dblevins @tomitribe OAuthand Signatures Password Sent 3000 TPS (HTTP+SSL) OAuth 2 Signature 12000 TPS (HTTP) Joe Larry Stan
- 79. JavaOne #RESTSecurity @dblevins @tomitribe Observations •HTTP Signatures the only HTTP friendly approach • Signatures does not solve the “Identity Load” problem • OAuth 2 with JWT significantly improves IDP load • Plain OAuth 2 • HTTP Session-like implications • OAuth 2 with JWT • Signed cookie • Signing key to the future
- 80.