Securing .NET Core, ASP.NET Core applications

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Securing .NET Core,
ASP.NET Core
applications
• Damien Bowden
• https://damienbod.com
• @damien_bod

Application Security today
OpenID Connect, OAuth
An introduction to Self Sovereign Identity

WAF
HTTPS everywhere, Certs Protected Zone

WAF
HTTPS everywhere, Certs Protected Zone

Authentication, Authorization, Accounting
Session Protection HTTP headers
HTTPS Certificates TLS 1.2, 1.3
Hosting
GDPR, Da...

Authentication, Authorization, Accounting
Session Protection HTTP headers
HTTPS Certificates TLS 1.2, 1.3
Hosting
GDPR, Da...

Authentication
Authorization
Signout
Session

USE Standards
Don’t implement this yourself, use
certified libs, packages, tested

OAuth2
OpenID Connect Authentication
Authorization
Delegated

OpenID Connect
http://openid.net/connect/
• Standard, Specification
• Authentication and Authorization
• built on top of O...

Open ID Connect (OIDC) is
supported by almost all systems.
Azure AD, Auth0, OKTA, IdentityServer4, google accounts,
Openid...

Authentication
Authorization
Signout
Session

OpenID Connect,
OAuth

OpenID Connect
Flows
OAuth2 Flows
http://openid.net/specs/openid-
connect-core-1_0.html
OAuth2 Resource Owner Credentials ...

id token
token (access token)
reference / self contained token
refresh token
scope
Back-Channel
Front-Channel
User Agent

OAuth2 Resource
Owner Credentials
Flow
• MC to MC applications
• trusted client
• grant_type=client_credenti
al&client_id=...

OAuth2 Resource Owner Credentials Flow

OpenID Connect
Authorization Code
flow + PKCE + secret
• Server to server
applications with User
• Can keep secrets, is tr...

OIDC Authorization Code flow

OIDC Hybrid flow
• Mix of the Code and
Implicit Flow
• Can be used for Web
applications with server
side rendering.
• resp...

OIDC Hybrid flow

Native App / SPA
Authorization Code
Flow + PKCE
• RFC 7636
• No secret for public clients
• https://tools.ietf.org/html/r
...

Single Page
Applications
• Cookies
• OIDC Code Flow with PKCE
• OIDC Implicit Flow

OpenID Connect Code flow
with PKCE
• For browser applications, SPAs
• Client is not authenticated, or trusted
• response_t...

Difference between Native
APPS and SPA
• Native apps use different Redirect URLs
• Storage for persisting tokens is differ...

OAuth Device Flow
• RFC 7636
• https://tools.ietf.org/html/d
raft-ietf-oauth-device-flow-12

OAuth On Behalf of
OBO Flow
• - RFC 6749
• https://tools.ietf.org/html/r
fc6749
• https://docs.microsoft.com/
en-us/azure/...

src: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow

Azure Managed
identities

src: https://www.youtube.com/watch?v=vYUKC0mZFqI

Thank you
@damienbod

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 37 Ad

View on Slideshare

1 of 37 Ad