Mischief Managed - Protecting your Serverless Functions (Memphis Web Workers)
•
0 likes•58 views
The difficulty of building a website grows exponentially when taking into account security. Even a basic webpage quickly evolves with the need to interact with data sources, protect API credentials, etc. In this talk, we will discuss what Serverless Functions are, why you might use them, and how to protect them. We'll talk through common security holes you need to address while touching on topics like authentication, authorization, and JSON Web Tokens (JWTs). After this talk, you should walk away confident in your mischief managing abilities.
Recommended
More Related Content
Similar to Mischief Managed - Protecting your Serverless Functions (Memphis Web Workers)
Similar to Mischief Managed - Protecting your Serverless Functions (Memphis Web Workers) (20)
More from James Quick
More from James Quick (14)
Recently uploaded
Recently uploaded (20)
Mischief Managed - Protecting your Serverless Functions (Memphis Web Workers)
- 2. @jamesqquick Who Am I @jamesqquick Developer. Speaker. Teacher. Developer Advocate, Auth0 Twilio Champion and Media Developer Export https://www.jamesqquick.com
- 5. @jamesqquick I want to build an app… …and I want it to be as easy as possible
- 6. @jamesqquick
- 7. @jamesqquick How do I build it? …and in the quickest/easiest way possible
- 12. @jamesqquick Static Hosting •No server •Continuous Integration •Fast and secure
- 13. @jamesqquick
- 14. @jamesqquick Where can I store/get data? …and without me having to work very hard
- 17. @jamesqquick How can I add functionality? …like send a text or an email, etc.
- 18. “Static assets don’t necessarily mean static experiences”
- 19. Give Me All the Services
- 20. @jamesqquick How do I interface to those services? …and again…without having to work very hard
- 21. Their goal (the services) is to make it easy for you
- 23. @jamesqquick API Key? Secret Key? Auth Token?App ID? HUH?!
- 24. @jamesqquick How do I protect my credentials?!? …because you know…developers just love to HACK stuff.
- 25. The browser is not safe…your source code is not safe!
- 26. @jamesqquick
- 27. @jamesqquick “I thought APIs/services did the hard stuff for me…”☹
- 28. @jamesqquick
- 29. @jamesqquick Maybe I’ll look into Serverless Functions …I’ve heard they are the new hotness and easy to work with
- 30. @jamesqquick Why Serverless? •Serverless…not quite •Easy to use •Simplicity of hosting •Fits into the JAMstack •Damn cool!! !
- 31. @jamesqquick Protect your private environment variables
- 32. @jamesqquick
- 34. @jamesqquick
- 36. @jamesqquick You just created a Proxy…
- 37. @jamesqquick
- 38. @jamesqquick Maybe CORS Can Help? …that’s a thing right?!
- 39. @jamesqquick CORS is only a protection in the browser.
- 41. @jamesqquick
- 42. @jamesqquick Well, what about authentication? …that’ll stop ‘em…right?!
- 43. @jamesqquick
- 44. @jamesqquick
- 45. @jamesqquick
- 46. @jamesqquick
- 48. @jamesqquick
- 49. Frontend “security” is not security!
- 50. @jamesqquick Fine! What about some sort of token? …and also what the hell are tokens?
- 54. Access tokens allow an application access to an API
- 55. @jamesqquick Opaque vs JWT Access Tokens • Unique identifier • Need to be verified by the issuer • Easier to revoke • JWT = Json Web Token • Verifiable/validatable (?) • Embedded information
- 56. @jamesqquick Ok, tell me more about these fancy JWTs …and also what the hell are JWTs?
- 60. JWTs have three parts
- 64. Body { "sub": "1234567890", "name": "John Doe", "iat": 1516239022 }
- 66. Verify Signature HMACSHA256( base64UrlEncode(header) + "." + base64UrlEncode(payload), ✨your-256-bit-secret✨ )
- 68. @jamesqquick Where do these magical tokens come from?
- 70. @jamesqquick “IDK and IDC” - Serverless Function
- 73. JWTs can be verified
- 74. @jamesqquick How do I parse and validate these JWTs?
- 75. @jamesqquick Tokens must be attached to API requests
- 77. @jamesqquick Parse from the authorization header
- 79. @jamesqquick Then validate that thing!
- 82. @jamesqquick Take it one step further with persmissions
- 85. @jamesqquick Best Practices -Store tokens securely -Use HTTPS -Don’t share keys -Use token expiration
- 86. @jamesqquick
- 87. @jamesqquick Let’s get out of here!