César Hernández, profile picture
Uploaded byCésar Hernández
PDF, PPTX88 views

2018 ecuador deconstruyendo y evolucionando la seguridad en servicios rest

César Hernández discusses evolving security in REST services, focusing on topics like OAuth 2.0, JWT, and securing APIs beyond basic authentication. He highlights the performance metrics for different authentication methods and the challenges associated with each. The presentation emphasizes the importance of secure token handling and modern practices in securing RESTful applications.

Embed presentation

Download as PDF, PPTX
1 / 105
2 / 105
3 / 105
4 / 105
5 / 105
6 / 105
7 / 105
8 / 105
9 / 105
10 / 105
11 / 105
12 / 105
13 / 105
14 / 105
15 / 105
16 / 105
17 / 105
18 / 105
19 / 105
20 / 105
21 / 105
22 / 105
23 / 105
24 / 105
25 / 105
26 / 105
27 / 105
28 / 105
29 / 105
30 / 105
31 / 105
32 / 105
33 / 105
34 / 105
35 / 105
36 / 105
37 / 105
38 / 105
39 / 105
40 / 105
41 / 105
42 / 105
43 / 105
44 / 105
45 / 105
46 / 105
47 / 105
48 / 105
49 / 105
50 / 105
51 / 105
52 / 105
53 / 105
54 / 105
55 / 105
56 / 105
57 / 105
58 / 105
59 / 105
60 / 105
61 / 105
62 / 105
63 / 105
64 / 105
65 / 105
66 / 105
67 / 105
68 / 105
69 / 105
70 / 105
71 / 105
72 / 105
73 / 105
74 / 105
75 / 105
76 / 105
77 / 105
78 / 105
79 / 105
80 / 105
81 / 105
82 / 105
83 / 105
84 / 105
85 / 105
86 / 105
87 / 105
88 / 105
89 / 105
90 / 105
91 / 105
92 / 105
93 / 105
94 / 105
95 / 105
96 / 105
97 / 105
98 / 105
99 / 105
100 / 105
101 / 105
102 / 105
103 / 105
104 / 105
105 / 105
EcuadorJUG2018 #RESTSecurity @CesarHgt @tomitribe Deconstruyendo y evolucionando la seguridad en servicios REST César Hernández Tomitribe
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 César Hernández • Senior Software Engineer at Tomitribe • Java Champion • Duke’s Choice Award 2016 y 2017 • Oracle Certified Professional • +10 experience with Java EE • Open Source advocate, teacher and public speaker
Diapositivas https://tribestream.io/ecuadorjug
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 “The nice thing about standards is you have so many to choose from.” - Andrew S. Tanenbaum
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Áreas de Enfoque • Más allá de Basic Auth • Teoría de OAuth 2.0 • Introducción a JWT • Google/Facebook style API security • Arquitectura Stateless versus Stateful • HTTP Signatures • Amazon EC2 style API security
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Línea Base 1000 usuarios x 3 TPS 4 saltos 3000 TPS frontend 12000 TPS backend
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Basic Auth (y sus problemas)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Mensaje en Basic Auth POST /painter/color/object HTTP/1.1 Host: localhost:8443 Authorization: Basic c25vb3B5OnBhc3M= User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 45 {"color":{"b":255,"g":0,"name":"blue","r":0}}
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Basic Auth Password Sent 3000 TPS (HTTP+SSL) username+password Base64 (no auth) (LDAP) 12000 TPS (HTTP) 3000 TPS
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Basic Auth Password Sent 3000 TPS (HTTP+SSL) username+password Base64 username+password Base64 15000 TPS (LDAP) Password Sent 12000 TPS (HTTP)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Basic Auth Password Sent 3000 TPS (HTTP+SSL) username+password Base64 IP whitelisting 3000 TPS (LDAP) 12000 TPS (HTTP)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 “Dame toda la información del salario de José.” “No se quien eres, … pero por supuesto!”
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Ataque desde Latveria
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Ataque de fuerza bruta: Basic Auth Password válidos 3000 TPS (HTTP+SSL) IP whitelisting 9000 TPS (LDAP) 12000 TPS (HTTP) Passwords inválidos 6000 TPS (HTTP+SSL)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2.0 (y sus problemas)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2 - Password Grant (LDAP) (Token Store) POST /oauth2/token Host: api.superbiz.io User-Agent: curl/7.43.0 Accept: */* Content-Type: application/x-www-form-urlencoded Content-Length: 54 grant_type=password&username=snoopy&password=woodstock HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Cache-Control: no-store Pragma: no-cache { "access_token":"2YotnFZFEjr1zCsicMWpAA", "expires_in":3600, "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA", } Verificación de Password Generación de Token
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2 - Password Grant (LDAP) (Token Store) POST /oauth2/token Host: api.superbiz.io User-Agent: curl/7.43.0 Accept: */* Content-Type: application/x-www-form-urlencoded Content-Length: 54 grant_type=password&username=snoopy&password=woodstock Verificación de Password Generación de Token HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Cache-Control: no-store Pragma: no-cache { "access_token":"2YotnFZFEjr1zCsicMWpAA", "expires_in":3600, "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA", }
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2.0 Message POST /painter/color/object HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 45 {"color":{"r":0,"g":0,"b":255,"name":"blue"}}
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2.0 Message POST /painter/color/palette HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 45 {"color":{"r":0,"g":255,"b":0,"name":"green"}}
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2.0 Message POST /painter/color/select HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 44 {"color":{"r":255,"g":0,"b":0,"name":"red"}}
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2.0 Message POST /painter/color/fill HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 49 {"color":{"r":0,"g":255,"b":255,"name":"yellow"}}
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2.0 Message POST /painter/color/stroke HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 49 {"color":{"r":255,"g":200,"b":255,"name":"orange"}}
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 401
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2 - Refresh Grant (LDAP) (Token Store) Verify Password Generate Token POST /oauth2/token Host: api.superbiz.io User-Agent: curl/7.43.0 Accept: */* Content-Type: application/x-www-form-urlencoded Content-Length: 54 grant_type=refresh_token&refresh_token=tGzv3JOkF0XG5Qx2TlKWIA HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Cache-Control: no-store Pragma: no-cache { "access_token":"6Fe4jd7TmdE5yW2q0y6W2w", "expires_in":3600, "refresh_token":"hyT5rw1QNh5Ttg2hdtR54e", }
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2 - Refresh Grant (LDAP) (Token Store) Verify Password Generate Token POST /oauth2/token Host: api.superbiz.io User-Agent: curl/7.43.0 Accept: */* Content-Type: application/x-www-form-urlencoded Content-Length: 54 grant_type=refresh_token&refresh_token=tGzv3JOkF0XG5Qx2TlKWIA HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Cache-Control: no-store Pragma: no-cache { "access_token":"6Fe4jd7TmdE5yW2q0y6W2w", "expires_in":3600, "refresh_token":"hyT5rw1QNh5Ttg2hdtR54e", }
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Old pair • Access Token 2YotnFZFEjr1zCsicMWpAA • Refresh Token tGzv3JOkF0XG5Qx2TlKWIA New pair • Access Token 6Fe4jd7TmdE5yW2q0y6W2w • Refresh Token hyT5rw1QNh5Ttg2hdtR54e
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2.0 Message POST /painter/color/palette HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 6Fe4jd7TmdE5yW2q0y6W2w User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 46 {"color":{"r":0,"g":255,"b":0,"name":"green"}}
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2.0 Message POST /painter/color/select HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 6Fe4jd7TmdE5yW2q0y6W2w User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 44 {"color":{"r":255,"g":0,"b":0,"name":"red"}}
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2.0 Message POST /painter/color/fill HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 6Fe4jd7TmdE5yW2q0y6W2w User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 49 {"color":{"r":0,"g":255,"b":255,"name":"yellow"}}
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 ¿Qué hemos logrado?
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Ahora tenemos más passwords (al menos tus dispositivos los tienen)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Terminología de nuevo… • Password Grant??? • Logging in • Token? • Un password ligeramente ofuscado • Equivalente a un HTTP session ID mejorado levemente
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2 Request enviados (Authorization: Bearer …) 3000 TPS (HTTP+SSL) 3000 TPS (Verificaciones de tokens) Password enviados (post oauth2/token …) 1000/daily (HTTP+SSL) OAuth 2 (LDAP) 4 saldos 12000 TPS backend
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 “Quién es 6Fe4jd7TmdE5y W2q0y6W2w ???????” “No tengo idea. Pregúntale al servidor de tokens.”
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2 Tokens Sent 3000 TPS (HTTP+SSL) 3000 TPS (token checks) Password Sent 1000/daily (HTTP+SSL) OAuth 2 (LDAP) 12000 TPS (token checks) 8 hops 24000 TPS backend
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2 Tokens Sent 3000 TPS (HTTP+SSL) IP whitelisting 3000 TPS (token checks) Password Sent 1000/daily (HTTP+SSL) OAuth 2 (LDAP) 12000 TPS (token checks) 8 hops 24000 TPS backend 55% of all traffic
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2 Tokens Sent 3000 TPS (HTTP+SSL) IP whitelisting 0 TPS (token checks) Password Sent 1000/daily (HTTP+SSL) OAuth 2 (LDAP) 0 TPS (token checks) 0 hops 0 TPS backend
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2 Pointer Pointer State
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Access Token Access Pointer? Access Primary Key?
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2.0 High Frequency Password Exchange Algorithm?
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Hashing, Signing Symmetric and Asymmetric
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Hashing Data Tiene como entrada un conjunto de elementos, que suelen ser cadenas, y los convierte en un rango de salida finito, normalmente cadenas de longitud fija.
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 More Bits the Better digests (hash values)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 99 Bottles of Beer mingus:~/bar 04:16:42 $ hashes all /tmp/party-time.txt XxHash32 9237490d XxHash64 81c4196cc7a01049 MD5 963462e4849e7c266df928b44b004190 SHA-1 b3be8c8879b31e7af4067f2769e4df37e6dd7690 SHA-256 0ef285da8792e1b78825f14ffc485a3843c66c4f481411978d0b4612be963383 SHA-512 376a589fd4b7f070119a8193e6d922df05d2f200c96927351bef66b688bffcca 3e990aa2f720494e95967bcbbfc804e86ec2eefea2f820e9a1aa2f3da5146fe7
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 99 Bottles of Water? mingus:~/home 04:27:14 $ hashes all /tmp/party-time.txt #modified XxHash32 2045608c XxHash64 774507c9e384ea35 MD5 662028bba25e1e398ff8538cae9cd7c6 SHA-1 e11c127c072e09119fd7b3f35bc7ce1fd52b9b7a SHA-256 671d8e4af11d7ee65c1d51ab29303a1afc7439402c2eb61505cfb5c698ff419c SHA-512 fe0674683808e37bcad624d98426977c0936c15280922b2057efc33e4ca28127 8ea852d5450181fae726807e9c6e5e36a6823e7750948df89c6095ddbdaa4816
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Protegiendo el Hash HMAC (Symmetric) RSA (Asymmetric) (public key)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Asymmetric key: https://youtu.be/E5FEqGYLL0o
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2.0 + JSon Web Tokens (JWT)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 JSon Web Token • Pronunciado “YOT” • JSON map con data de usuario • Base64 URL Encoded • Digitally Signed (RSA-SHA256, HMAC-SHA512, etc) • Mecanismo de expiración
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Previamente un Access Token • 6Fe4jd7TmdE5yW2q0y6W2w
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Access Token ahora (JWT) • eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbi 10eXBlIjoiYWNjZXNzLXRva2VuIiwidXNlcm5hbWUiOiJzb m9vcHkiLCJhbmltYWwiOiJiZWFnbGUiLCJpc3MiOiJodHRw czovL2RlbW8uc3VwZXJiaXouY29tL29hdXRoMi90b2tlbiI sInNjb3BlcyI6WyJ0d2l0dGVyIiwibWFucy1iZXN0LWZyaW VuZCJdLCJleHAiOjE0NzQyODA5NjMsImlhdCI6MTQ3NDI3O TE2MywianRpIjoiNjY4ODFiMDY4YjI0OWFkOSJ9.DTfSdMz IIsC0j8z3icRdYO1GaMGl6j1I_2DBjiiHW9vmDz8OAw8Jh8 DpO32fv0vICc0hb4F0QCD3KQnv8GVM73kSYaOEUwlW0k1Ta Elxc43_Ocxm1F5IUNZvzlLJ_ksFXGDL_cuadhVDaiqmhct0 98ocefuv08TdzRxqYoEqYNo
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Access Token Now • header (JSON > Base64 URL Encoded) • Describe como la firma (signature) del token puede ser verificada • payload (JSON > Base64 URL Encoded) • Json map de información que desees incluir • Campo estándar como el de Expiración • signature (Binary > Base64 URL Encoded) • La firma digital • Hecha exclusivamente por el endpoint: /oauth2/token
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 • { "alg": “RS256", "typ": “JWT" } • { "token-type": "access-token", "username": "snoopy", "animal": "beagle", "iss": "https://demo.superbiz.com/oauth2/token", "scopes": [ “twitter”, "mans-best-friend" ], "exp": 1474280963, "iat": 1474279163, "jti": "66881b068b249ad9" } • DTfSdMzIIsC0j8z3icRdYO1GaMGl6j1I_2DBjiiHW9vmDz8OAw8Jh8DpO32fv 0vICc0hb4F0QCD3KQnv8GVM73kSYaOEUwlW0k1TaElxc43_Ocxm1F5IUNZvzl LJ_ksFXGDL_cuadhVDaiqmhct098ocefuv08TdzRxqYoEqYNo
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Ligero pero con alto impacto en la arquitectura
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 ¿Qué tenemos hasta el momento? (repaso)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 (LDAP) Data completa del usuario desde ldap
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 (LDAP) Generación de Access Token (pointer)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 (LDAP) Ambos se insertan en la BD
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 (LDAP) Envío del Access Token (pointer) hacia el cliente
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Resultado final cliente permanece con el Pointer Server almacena State
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 ¿Qué podemos hacer ahora? (Hello JWT!)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 (LDAP) Data completa del usuario desde ldap
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 (LDAP) La data se representa en JSON
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 (LDAP) JSON es firmado RSA-SHA 256
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 (LDAP) Se inserta solamente el pointer en la DB (para revocaciones)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 (LDAP) Envío del Access Token (estado) hacia el cliente
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Cliente permanece con State Server almacena el Pointer Resultado obtenido
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2 - Password Grant (LDAP) (Token ID Store) POST /oauth2/token Host: api.superbiz.io User-Agent: curl/7.43.0 Accept: */* Content-Type: application/x-www-form-urlencoded Content-Length: 54 grant_type=password&username=snoopy&password=woodstock Verifica Password Genera Token Firmado (Signed)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2 - Password Grant (LDAP) (Token ID Store) Verify Password Generate Signed Token HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Cache-Control: no-store Pragma: no-cache { "access_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9. eyJ0b2tlbi10eXBlIjoiYWNjZXNzLXRva2VuIiwidXNlcm5hb WUiOiJzbm9vcHkiLCJhbmltYWwiOiJiZWFnbGUiLCJpc3M iOiJodHRwczovL2RlbW8uc3VwZXJiaXouY29tL29hdXRoM i90b2tlbiIsInNjb3BlcyI6WyJ0d2l0dGVyIiwibWFucy1iZXN0 LWZyaWVuZCJdLCJleHAiOjE0NzQyODA5NjMsImlhdCI6M TQ3NDI3OTE2MywianRpIjoiNjY4ODFiMDY4YjI0OWFkOSJ 9.DTfSdMzIIsC0j8z3icRdYO1GaMGl6j1I_2DBjiiHW9vmDz8 OAw8Jh8DpO32fv0vICc0hb4F0QCD3KQnv8GVM73kSYaO EUwlW0k1TaElxc43_Ocxm1F5IUNZvzlLJ_ksFXGDL_cuadh VDaiqmhct098ocefuv08TdzRxqYoEqYNo", "expires_in":3600, "refresh_token":"eyJhbGctGzv3JOkF0XG5Qx2TlKWIAkF0X. eyJ0b2tlbi10eXBlIjoiYWNjZXNzLXRva2VuIiwidXNlcm5hb WUiOiJzbm9vcHkiLCJhbmltYWwiOiJiZWFnbGUiLCJpc3M iOiJodHRwczovL", }
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Mensaje OAuth 2.0 con JWT POST /painter/color/palette HTTP/1.1
 Host: api.superbiz.io
 Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbi10eXBlIjoiYWNjZXNzLXR va2VuIiwidXNlcm5hbWUiOiJzbm9vcHkiLCJhbmltYWwiOiJiZWFnbGUiLCJpc3MiOiJodHRwczovL2RlbW8uc3VwZXJ iaXouY29tL29hdXRoMi90b2tlbiIsInNjb3BlcyI6WyJ0d2l0dGVyIiwibWFucy1iZXN0LWZyaWVuZCJdLCJleHAiOjE0NzQy ODA5NjMsImlhdCI6MTQ3NDI3OTE2MywianRpIjoiNjY4ODFiMDY4YjI0OWFkOSJ9.DTfSdMzIIsC0j8z3icRdYO1GaMGl 6j1I_2DBjiiHW9vmDz8OAw8Jh8DpO32fv0vICc0hb4F0QCD3KQnv8GVM73kSYaOEUwlW0k1TaElxc43_Ocxm1F5IUNZ vzlLJ_ksFXGDL_cuadhVDaiqmhct098ocefuv08TdzRxqYoEqYNo User-Agent: curl/7.43.0
 Accept: */*
 Content-Type: application/json
 Content-Length: 46
 
 {"color":{"b":0,"g":255,"r":0,"name":"green"}}
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2 + JWT Tokens enviados 3000 TPS (HTTP+SSL) 0.55 TPS (Verificaciones refresh token) OAuth 2 (LDAP) 4 saltos 12000 TPS backend 3000 TPS (signature verification) 12000 TPS (signature verification) Password enviados (post oauth2/token …) 1000/daily (HTTP+SSL)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 “No!” “Dame toda la información del salario de José.”
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 “Claro!” “Dame toda la información del salario de José.”
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2 + JWT Valid Tokens Sent 3000 TPS (HTTP+SSL) IP whitelisting 0.55 TPS (refresh token checks) Password Sent 1000/daily (HTTP+SSL) (LDAP) 4 hops 12000 TPS backend 9000 TPS (signature verification) 12000 TPS (signature verification) Invalid Tokens Sent 6000 TPS (HTTP+SSL)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 https://connect2id.com/products/nimbus-jose-jwt Librería JWT https://github.com/jwtk/jjwt https://github.com/auth0/java-jwt
Demo #RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 HTTP Signatures (Amazon EC2 style API Security)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 HTTP Signatures • Ningún “secreto” toca el cable • El firmar el mensaje completo • Provee identidad • Previene el compromiso o alteración del mensaje • Soporta firmas Symmetric or Asymmetric • IETF Draft • https://tools.ietf.org/html/draft-cavage-http-signatures • Extremadamente simple • No eliminate el beneficio del JWT
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Signature Message POST /painter/color/palette HTTP/1.1
 Host: api.superbiz.io
 Authorization: Signature keyId=“El-Nombre-De-Mi-Llave”, algorithm="hmac-sha256", headers="content-length host date (request-target)”, signature="j050ZC4iWDW40nVx2oVwBEymXzwvsgm+hKBkuw04b+w="
 Date: Mon, 19 Sep 2016 16:51:35 PDT Accept: */*
 Content-Type: application/json
 Content-Length: 46
 
 {"color":{"b":0,"g":255,"r":0,"name":"green"}}
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Signature closeup Signature keyId=“my-key-name", algorithm="hmac-sha256", headers="content-length host date (request-target)”, signature="j050ZC4iWDW40nVx2oVwBEymXzwvsgm+hKBkuw04b+w=
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Signature Auth Passwords enviados 0 TPS (HTTP) Signature (no auth) 3000 TPS (LDAP o Keystore) 12000 TPS (HTTP)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Signature Auth Signature Signature 3000 TPS (LDAP o Keystore) 12000 TPS (HTTP) Passwords enviados 0 TPS (HTTP)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 “Hola, Larry! Claro!” Issue Returns (bad) “Dame toda la información del salario de José.”
Demo #RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2.0 Con prueba de posesión (JWT + HTTP Signatures)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Key Value Información de Identidad (JWT) Key ID Prueba de identidad (HTTP Signature)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 { "alg": “RS256", "typ": “JWT" } { "token-type": "access-token", "username": "snoopy", "iss": "https://demo.superbiz.com/oauth2/token", "scopes": ["twitter”, "mans-best-friend"], "exp": 1474280963, "iat": 1474279163, "jti": "66881b068b249ad9" } DTfSdMzIIsC0j8z3icRdYO1GaMGl6j1I_2DBjiiHW9vmDz8OAw8Jh8DpO32fv0vICc 0hb4F0QCD3KQnv8GVM73kSYaOEUwlW0k1TaElxc43_Ocxm1F5IUNZvzlLJ_ksF XGDL_cuadhVDaiqmhct098ocefuv08TdzRxqYoEqYNo Access Token
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 { "alg": “RS256", "typ": “JWT" } { "token-type": "pop", "cnf":{ "kid": "green-1234" } "username": "snoopy", "iss": "https://demo.superbiz.com/oauth2/token", "scopes": ["twitter”, "mans-best-friend"], "exp": 1474280963, "iat": 1474279163, "jti": "66881b068b249ad9" } DTfSdMzIIsC0j8z3icRdYO1GaMGl6j1I_2DBjiiHW9vmDz8OAw8Jh8DpO32fv0vICc 0hb4F0QCD3KQnv8GVM73kSYaOEUwlW0k1TaElxc43_Ocxm1F5IUNZvzlLJ_ksF XGDL_cuadhVDaiqmhct098ocefuv08TdzRxqYoEqYNo Access Token
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2 - Password Grant (LDAP) (Token ID Store) POST /oauth2/token Host: api.superbiz.io User-Agent: curl/7.43.0 Accept: */* Content-Type: application/x-www-form-urlencoded Content-Length: 54 grant_type=password&username=snoopy&password=woodstock Verifica Password Generate Signed Token Genera HMAC Key (Key Store)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2 - Password Grant (LDAP) (Token ID Store) Verifica Password Genera Signed Token HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Cache-Control: no-store Pragma: no-cache { "access_token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc 3MiOiJodHRwczovL3NlcnZlci5leGFtcGxlLmNvbSIsImV4cCI6M TMxMTI4MTk3MCwiaWF0IjoxMzExMjgwOTcwLCJjbmYiOnsia2", "token_type":"pop", "expires_in":3600, "refresh_token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc 3MiOiJodHRwczovL2FzZGZhc2RzZGZzZXJ2ZXIuZXhhbXBsZS5 jb20iLCJleHAiOjEzMTEyODE5NzAsImlhdCI6MTMxMTI4MDk3M", "key":"eyJrdHkiOiJvY3QiLCJ1c2UiOiJzaWciLCJraWQiOiJvcmFuZ 2UteXlqOUQwZWgiLCJrIjoiVlotMFFHTFoyUF9SUFVTVzEwQ0l1 MFdNeVhxLU5EMnBtRFl6QTBPVEtXVEhscDVpYWM1SzRWZWlS ci1fQk9vWEo0WDJmU1R0NG5Id29fcXV0YTdqSkpLVDRQRVd5W WFuQlNGc2kwRFc3b3dULUhFeEFHRHlKdEhVdE53NXhzczhOajZ PeE5QdjZyUk9FLWtldmhMMndCOWNxZ2RJc2NidkRocmFzMzljd 2ZzIiwiYWxnIjoiSFMyNTYifQ" } Genera HMAC Key (Key Store)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 JSON Web Key (encoded) eyJrdHkiOiJvY3QiLCJ1c2UiOiJzaWciLCJraWQiOiJvcmFuZ2Ut eXlqOUQwZWgiLCJrIjoiVlotMFFHTFoyUF9SUFVTVzEwQ0l1M FdNeVhxLU5EMnBtRFl6QTBPVEtXVEhscDVpYWM1SzRWZ WlSci1fQk9vWEo0WDJmU1R0NG5Id29fcXV0YTdqSkpLVDRQ RVd5WWFuQlNGc2kwRFc3b3dULUhFeEFHRHlKdEhVdE53N XhzczhOajZPeE5QdjZyUk9FLWtldmhMMndCOWNxZ2RJc2Nid kRocmFzMzljd2ZzIiwiYWxnIjoiSFMyNTYifQ
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 JSON Web Key (decoded) { "kty": "oct", "use": "sig", "kid": "orange-1234", "k": "VZ-0QGLZ2P_RPUSW10CIu0WMyXq-ND2pmDYzA0OTKW THlp5iac5K4VeiRr-_BOoXJ4X2fSTt4nHwo_quta7j JJKT4PEWyYanBSFsi0DW7owT-HExAGDyJtHUtNw5xs s8Nj6OxNPv6rROE-kevhL2wB9cqgdIscbvDhras39c wfs", "alg": "HS256" }
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Signed OAuth 2.0 Message POST /painter/color/palette HTTP/1.1
 Host: api.superbiz.io
 Authorization: Signature keyId=“orange-1234", algorithm="hmac-sha256", headers="content-length host date (request-target)”, signature="j050ZC4iWDW40nVx2oVwBEymXzwvsgm+hKBkuw04b+w=" Bearer: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbi10eXBlIjoiYWNjZXNzLXRva2VuIiwidXNlcm5h bWUiOiJzbm9vcHkiLCJhbmltYWwiOiJiZWFnbGUiLCJpc3MiOiJodHRwczovL2RlbW8uc3VwZXJiaXouY29t L2 9hdXRoMi90b2tlbiIsInNjb3BlcyI6WyJ0d2l0dGVyIiwibWFucy1iZXN0LWZyaWVuZCJdLCJleHAiOjE0NzQyO DA5NjMsImlhdCI6MTQ3NDI3OTE2MywianRpIjoiNjY4ODFiMDY4YjI0OWFkOSJ9.DTfSdMzIIsC0j8z3icRdY O1GMGl6j1I_2DBjiiHW9vmDz8OAw8Jh8DpO32fv0vICc0hb4F0QCD3KQnv8GVM73kSYaOEUwlW0k1TaEl xc43_Ocxm1F5IUNZvzlLJ_ksFXGDL_cuadhVDaiqmhct098ocefuv08TdzRxqYoEqYNo
 Date: Mon, 19 Sep 2016 16:51:35 PDT Accept: */*
 Content-Type: application/json
 Content-Length: 46
 
 {"color":{"b":0,"g":255,"r":0,"name":"green"}}
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 OAuth 2 + JWT + Tokens Sent 3000 TPS (HTTP+SSL) 0.55 TPS (refresh token checks) Password Sent 1000/daily (HTTP+SSL) OAuth 2 (LDAP) 4 hops 12000 TPS backend 3000 TPS (signature verification) 12000 TPS (signature verification)
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 https://tools.ietf.org/html/draft-ietf-oauth-pop-key-distribution Specification Reference
#RESTSecurity @CesarHgt @tomitribe EcuadorJUG2018 Observations • HTTP Signatures the only HTTP friendly approach • Signatures does not solve the “Identity Load” problem • OAuth 2 with JWT significantly improves IDP load • Plain OAuth 2 • HTTP Session-like implications • OAuth 2 with JWT • Signed cookie • Signing key to the future
Gracias Diapositivas y Gateway Sign-up https://tribestream.io/ecuadorjug/ #RESTSecurity Ecuador JUG

More Related Content

PDF
Deconstructing and Evolving REST security
byJonathan Gallimore
 
PDF
Seguridad en microservicios via micro profile jwt
byCésar Hernández
 
PDF
2018 colombia deconstruyendo y evolucionando la seguridad en servicios rest
byCésar Hernández
 
PDF
Stateless Microservice Security via JWT and MicroProfile - ES
byOtavio Santana
 
PDF
Stateless Microservice Security via JWT and MicroProfile - Guatemala
byOtávio Santana
 
PDF
Stateless Microservice Security via JWT and MicroProfile - Mexico
byOtávio Santana
 
PDF
2018 SDJUG Deconstructing and Evolving REST Security
byDavid Blevins
 
PDF
Dublin JUG Stateless Microservice Security via JWT, TomEE and MicroProfile
byJean-Louis MONTEIRO
 
Deconstructing and Evolving REST security
byJonathan Gallimore
 
Seguridad en microservicios via micro profile jwt
byCésar Hernández
 
2018 colombia deconstruyendo y evolucionando la seguridad en servicios rest
byCésar Hernández
 
Stateless Microservice Security via JWT and MicroProfile - ES
byOtavio Santana
 
Stateless Microservice Security via JWT and MicroProfile - Guatemala
byOtávio Santana
 
Stateless Microservice Security via JWT and MicroProfile - Mexico
byOtávio Santana
 
2018 SDJUG Deconstructing and Evolving REST Security
byDavid Blevins
 
Dublin JUG Stateless Microservice Security via JWT, TomEE and MicroProfile
byJean-Louis MONTEIRO
 

What's hot

PDF
[OPD 2019] Attacking JWT tokens
byOWASP
 
PDF
Dodging WebCrypto API Landmines
byErnie Turner
 
PPTX
Cryptography 101 for Java developers
byMichel Schudel
 
PDF
Python Cryptography & Security
byJose Manuel Ortega Candel
 
PDF
"Revenge of The Script Kiddies: Current Day Uses of Automated Scripts by Top ...
byPROIDEA
 
PPTX
Passwords presentation
byGreg MacPherson
 
PDF
"A rootkits writer’s guide to defense" - Michal Purzynski
byPROIDEA
 
PPTX
My Bro The ELK
byTripwire
 
PDF
2018 jPrime Deconstructing and Evolving REST Security
byDavid Blevins
 
PDF
2018 Denver JUG Deconstructing and Evolving REST Security
byDavid Blevins
 
PDF
Password Security
byCSCJournals
 
PDF
Deconstructing and Evolving REST Security
byRoberto Cortez
 
PDF
2018 Boulder JUG Deconstructing and Evolving REST Security
byDavid Blevins
 
PDF
2017 Devoxx MA Deconstructing and Evolving REST Security
byDavid Blevins
 
PDF
2016 JavaOne Deconstructing REST Security
byDavid Blevins
 
PDF
2017 dev nexus_deconstructing_rest_security
byDavid Blevins
 
PPTX
JWTs and JOSE in a flash
byEvan J Johnson (Not a CISSP)
 
PDF
Side-Channels on the Web: Attacks and Defenses
byTom Van Goethem
 
PDF
Da APK al Golden Ticket
byGiuseppe Trotta
 
PPTX
Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...
byOpenDNS
 
[OPD 2019] Attacking JWT tokens
byOWASP
 
Dodging WebCrypto API Landmines
byErnie Turner
 
Cryptography 101 for Java developers
byMichel Schudel
 
Python Cryptography & Security
byJose Manuel Ortega Candel
 
"Revenge of The Script Kiddies: Current Day Uses of Automated Scripts by Top ...
byPROIDEA
 
Passwords presentation
byGreg MacPherson
 
"A rootkits writer’s guide to defense" - Michal Purzynski
byPROIDEA
 
My Bro The ELK
byTripwire
 
2018 jPrime Deconstructing and Evolving REST Security
byDavid Blevins
 
2018 Denver JUG Deconstructing and Evolving REST Security
byDavid Blevins
 
Password Security
byCSCJournals
 
Deconstructing and Evolving REST Security
byRoberto Cortez
 
2018 Boulder JUG Deconstructing and Evolving REST Security
byDavid Blevins
 
2017 Devoxx MA Deconstructing and Evolving REST Security
byDavid Blevins
 
2016 JavaOne Deconstructing REST Security
byDavid Blevins
 
2017 dev nexus_deconstructing_rest_security
byDavid Blevins
 
JWTs and JOSE in a flash
byEvan J Johnson (Not a CISSP)
 
Side-Channels on the Web: Attacks and Defenses
byTom Van Goethem
 
Da APK al Golden Ticket
byGiuseppe Trotta
 
Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...
byOpenDNS
 

Similar to 2018 ecuador deconstruyendo y evolucionando la seguridad en servicios rest

PDF
JavaOne 2014 - Securing RESTful Resources with OAuth2
byRodrigo Cândido da Silva
 
PPTX
OAuth2 para desarrolladores
byLuis Ruiz Pavón
 
PDF
AllTheTalks.Online 2020: "Basics of OAuth 2.0 and OpenID Connect"
byAndreas Falk
 
PPTX
Single-Page-Application & REST security
byIgor Bossenko
 
PDF
Stateless authentication for microservices - Spring I/O 2015
byAlvaro Sanchez-Mariscal
 
PDF
Stateless authentication for microservices
byAlvaro Sanchez-Mariscal
 
PPTX
OAuth2 and OpenID with Spring Boot
byGeert Pante
 
PDF
Top X OAuth 2 Hacks
byAntonio Sanso
 
PDF
2018 JavaLand Deconstructing and Evolving REST Security
byDavid Blevins
 
PDF
2017 JavaOne Deconstructing and Evolving REST Security
byDavid Blevins
 
PDF
2018 Madrid JUG Deconstructing REST Security
byBruno Baptista
 
PDF
2018 IterateConf Deconstructing and Evolving REST Security
byDavid Blevins
 
PDF
2019 ITkonekt Stateless REST Security with MicroProfile JWT
byJean-Louis MONTEIRO
 
PDF
ConFoo 2015 - Securing RESTful resources with OAuth2
byRodrigo Cândido da Silva
 
PPTX
UC2013 Speed Geeking: Intro to OAuth2
byAaron Parecki
 
PDF
Stateless authentication for microservices - Greach 2015
byAlvaro Sanchez-Mariscal
 
PDF
Stateless authentication for microservices - GR8Conf 2015
byAlvaro Sanchez-Mariscal
 
PPTX
OAuth - Don’t Throw the Baby Out with the Bathwater
byApigee | Google Cloud
 
PDF
Stateless authentication for microservices applications - JavaLand 2015
byAlvaro Sanchez-Mariscal
 
PDF
Stateless token-based authentication for pure front-end applications
byAlvaro Sanchez-Mariscal
 
JavaOne 2014 - Securing RESTful Resources with OAuth2
byRodrigo Cândido da Silva
 
OAuth2 para desarrolladores
byLuis Ruiz Pavón
 
AllTheTalks.Online 2020: "Basics of OAuth 2.0 and OpenID Connect"
byAndreas Falk
 
Single-Page-Application & REST security
byIgor Bossenko
 
Stateless authentication for microservices - Spring I/O 2015
byAlvaro Sanchez-Mariscal
 
Stateless authentication for microservices
byAlvaro Sanchez-Mariscal
 
OAuth2 and OpenID with Spring Boot
byGeert Pante
 
Top X OAuth 2 Hacks
byAntonio Sanso
 
2018 JavaLand Deconstructing and Evolving REST Security
byDavid Blevins
 
2017 JavaOne Deconstructing and Evolving REST Security
byDavid Blevins
 
2018 Madrid JUG Deconstructing REST Security
byBruno Baptista
 
2018 IterateConf Deconstructing and Evolving REST Security
byDavid Blevins
 
2019 ITkonekt Stateless REST Security with MicroProfile JWT
byJean-Louis MONTEIRO
 
ConFoo 2015 - Securing RESTful resources with OAuth2
byRodrigo Cândido da Silva
 
UC2013 Speed Geeking: Intro to OAuth2
byAaron Parecki
 
Stateless authentication for microservices - Greach 2015
byAlvaro Sanchez-Mariscal
 
Stateless authentication for microservices - GR8Conf 2015
byAlvaro Sanchez-Mariscal
 
OAuth - Don’t Throw the Baby Out with the Bathwater
byApigee | Google Cloud
 
Stateless authentication for microservices applications - JavaLand 2015
byAlvaro Sanchez-Mariscal
 
Stateless token-based authentication for pure front-end applications
byAlvaro Sanchez-Mariscal
 

More from César Hernández

PDF
Creando microservicios con Java MicroProfile y TomEE - OGBT
byCésar Hernández
 
PDF
Creando microservicios con Java, Microprofile y TomEE - Baranquilla JUG
byCésar Hernández
 
PDF
7 recomendaciones para migrar tus aplicaciones a Jakarta EE utilizando Apache...
byCésar Hernández
 
PDF
Pavimentando el Camino con Jakarta EE 9 y Apache TomEE 9.0.0
byCésar Hernández
 
PDF
Paving the road with Jakarta EE and Apache TomEE - JCON 2021
byCésar Hernández
 
PDF
Pavimentando el camino con Jakarta EE 9 y Apache TomEE
byCésar Hernández
 
PDF
7 Recomendaciones para migrar tus aplicaciones a Jakarta EE utilizando Apache...
byCésar Hernández
 
PDF
Creando microservicios con java micro profile y tomee - CUNORI 2020
byCésar Hernández
 
PDF
Creando microservicios con Java y Microprofile - Nicaragua JUG
byCésar Hernández
 
PDF
Es fácil contribuir al open source - Bolivia JUG 2020
byCésar Hernández
 
PDF
Paving the way with Jakarta EE and apache TomEE at cloudconferenceday
byCésar Hernández
 
PDF
It is easy contributing to Open Source - ECLIPSE CON 2020
byCésar Hernández
 
PDF
Its easy! contributing to open source - Devnexus 2020
byCésar Hernández
 
PDF
Paving the way with Jakarta EE and Apache TomEE - JCConf
byCésar Hernández
 
PDF
It is easy contributing to open source - JCON 2020
byCésar Hernández
 
PDF
Paving the way with Jakarta EE and Apache TomEE - itkonekt 2020
byCésar Hernández
 
PDF
Keeping brazil's medical industry safe with Micro Profile [TDC 2021]
byCésar Hernández
 
PDF
Aprende, contribuye, y surfea Cloud Native Java - GuateJUG 2021
byCésar Hernández
 
PDF
Keeping brazil's medical industry safe with Micro Profile and JakartaEE - Jak...
byCésar Hernández
 
PDF
Keeping brazil's medical industry safe with Micro Profile and JakartaEE - Jak...
byCésar Hernández
 
Creando microservicios con Java MicroProfile y TomEE - OGBT
byCésar Hernández
 
Creando microservicios con Java, Microprofile y TomEE - Baranquilla JUG
byCésar Hernández
 
7 recomendaciones para migrar tus aplicaciones a Jakarta EE utilizando Apache...
byCésar Hernández
 
Pavimentando el Camino con Jakarta EE 9 y Apache TomEE 9.0.0
byCésar Hernández
 
Paving the road with Jakarta EE and Apache TomEE - JCON 2021
byCésar Hernández
 
Pavimentando el camino con Jakarta EE 9 y Apache TomEE
byCésar Hernández
 
7 Recomendaciones para migrar tus aplicaciones a Jakarta EE utilizando Apache...
byCésar Hernández
 
Creando microservicios con java micro profile y tomee - CUNORI 2020
byCésar Hernández
 
Creando microservicios con Java y Microprofile - Nicaragua JUG
byCésar Hernández
 
Es fácil contribuir al open source - Bolivia JUG 2020
byCésar Hernández
 
Paving the way with Jakarta EE and apache TomEE at cloudconferenceday
byCésar Hernández
 
It is easy contributing to Open Source - ECLIPSE CON 2020
byCésar Hernández
 
Its easy! contributing to open source - Devnexus 2020
byCésar Hernández
 
Paving the way with Jakarta EE and Apache TomEE - JCConf
byCésar Hernández
 
It is easy contributing to open source - JCON 2020
byCésar Hernández
 
Paving the way with Jakarta EE and Apache TomEE - itkonekt 2020
byCésar Hernández
 
Keeping brazil's medical industry safe with Micro Profile [TDC 2021]
byCésar Hernández
 
Aprende, contribuye, y surfea Cloud Native Java - GuateJUG 2021
byCésar Hernández
 
Keeping brazil's medical industry safe with Micro Profile and JakartaEE - Jak...
byCésar Hernández
 
Keeping brazil's medical industry safe with Micro Profile and JakartaEE - Jak...
byCésar Hernández
 

Recently uploaded

PDF
One Agent to Rule Them All - The Fellowship of AI Agents
byIvo Andreev
 
PPTX
Fast-tracking quality for hundreds applications with automated testing layers
byBogdan Plieshka
 
PDF
Kiến trúc hướng dịch vụ UET!!!!!!!!!!!!!!!!!!!!!!!
bydoquangminh962004
 
PPTX
Computer_Virus_Presentation_With_Slide7.pptx
byHEVISLIVE
 
PPTX
NSF Converter Software to Convert NSF to PST, EML, MSG
byNSF Converter Software
 
PPTX
Road_Quality_Indicator using deeplearning algorithms and computer vision
byDHARUNPRASHOBMM
 
PPTX
Custom chat gpt integration services.pptx
byChetu
 
PPTX
Code Assessment Tools .pptx
byCodexpro
 
PDF
DSD-INT 2025 Latest Developments for HydroMT and wflow - Meshgi
byDeltares
 
PPTX
Lecture 3 - Scheduling - Operating System
bynurulalomador
 
PPTX
Python-Functions-A-Comprehensive-Overview.pptx
byMuhammad Fahad Bashir
 
PPTX
Membershipanywhere - Digital Membership Card - USA , Canada, Australia.pptx
bymembershipanywhere
 
PDF
Jeremy Millul - An NYU Computer Science Graduate
byJeremy Millul
 
PPTX
AI Agent Overview - Why we need AI Agent
byAlokGope
 
PDF
TNG_Architecting Green Software - An Introduction_Nils-Oliver Linden&Alexande...
byQAware GmbH
 
PPTX
OTT Content Analytics Enhanced by ALTBalaji Data Scraping.pptx
byyashpatric
 
PDF
Design and Analysis of Algorithms(DAA): Unit-II Asymptotic Notations and Basi...
byKuvempu University
 
PDF
DSD-INT 2025 Introduction to Hydrology Suite - Slootjes
byDeltares
 
PDF
Database Management Systems(DBMS):UNIT-II Relational Data Model BCA SEP SEM ...
byKuvempu University
 
PDF
DSD-INT 2025 Stochastic flood event generation using wflow and a diffusion do...
byDeltares
 
One Agent to Rule Them All - The Fellowship of AI Agents
byIvo Andreev
 
Fast-tracking quality for hundreds applications with automated testing layers
byBogdan Plieshka
 
Kiến trúc hướng dịch vụ UET!!!!!!!!!!!!!!!!!!!!!!!
bydoquangminh962004
 
Computer_Virus_Presentation_With_Slide7.pptx
byHEVISLIVE
 
NSF Converter Software to Convert NSF to PST, EML, MSG
byNSF Converter Software
 
Road_Quality_Indicator using deeplearning algorithms and computer vision
byDHARUNPRASHOBMM
 
Custom chat gpt integration services.pptx
byChetu
 
Code Assessment Tools .pptx
byCodexpro
 
DSD-INT 2025 Latest Developments for HydroMT and wflow - Meshgi
byDeltares
 
Lecture 3 - Scheduling - Operating System
bynurulalomador
 
Python-Functions-A-Comprehensive-Overview.pptx
byMuhammad Fahad Bashir
 
Membershipanywhere - Digital Membership Card - USA , Canada, Australia.pptx
bymembershipanywhere
 
Jeremy Millul - An NYU Computer Science Graduate
byJeremy Millul
 
AI Agent Overview - Why we need AI Agent
byAlokGope
 
TNG_Architecting Green Software - An Introduction_Nils-Oliver Linden&Alexande...
byQAware GmbH
 
OTT Content Analytics Enhanced by ALTBalaji Data Scraping.pptx
byyashpatric
 
Design and Analysis of Algorithms(DAA): Unit-II Asymptotic Notations and Basi...
byKuvempu University
 
DSD-INT 2025 Introduction to Hydrology Suite - Slootjes
byDeltares
 
Database Management Systems(DBMS):UNIT-II Relational Data Model BCA SEP SEM ...
byKuvempu University
 
DSD-INT 2025 Stochastic flood event generation using wflow and a diffusion do...
byDeltares
 

2018 ecuador deconstruyendo y evolucionando la seguridad en servicios rest