1. Introduction to API
security with OAUTH 2.0
Kevin Johnson

2. Basics

3. Authentication -> ID card
Authentication

4. Authorization -> Driver’s Licence
Delegated Authorization
Authorization

5. Authorization Code Grant
Implicit Grant For Browser-Based
Client-Side Applications
Resource Owner Password-Based
Grant
Client Credentials Grant
OAUTH
Flows
Four Primary
Grant Types

6. App Specific Info
Redirect URI
client_id
client_secret
Authorization Server Specific Info
Authorization Endpoint
Token Endpoint
Registration
Of Client App

7. Authorization Code
Grant

8. ConsentForm
Credentials

9. Authorization
Code Grant:
Actors

10. Authorization
Code Grant:
Moving Parts

11. ConsentForm
Credentials
Authorization
Code Grant:
Step 1

15. Authorization
Server:
3 Components
1. Authentication Component
• Identity Provider(LDAP, Active
Directory)
2. Consent Component
• Consent Server
3. Token Infrastructure Provider
• Token Values:
Access Token
Refresh Token
• Token Attributes:
when created?, valid?, revoked?

16. ConsentForm
Credentials
Authorization
Code Grant:
Step 1

17. ConsentForm
Credentials

18. Authorization
Code Grant:
Step 2

19. Authorization
Code:
Auth Endpoint

20. Authorization
Code:
Auth Endpoint
HTTP GET Request
GET /authorize?
response_type=code&
client_id=123456789&
redirect_uri=https%3A%2F%2Fclient
%2Eexample%2Ecom%2Fcb&
scope=followers%20tweet_feed&
state=aFodshfj(klMN
HTTP/1.1
Host: server.oauth_provider.com

21. Authorization
Code:
Redirect
Endpoint
HTTP Response
HTTP/1.1 302 Found
Location: https://client.example.com/cb?
code=SplxrhJY654090l&
state=aFodshfj(klMN

22. Authorization
Code:
Token Endpoint

23. Authorization
Code:
Token
Endpoint
HTTP POST Request
POST /token HTTP/1.1
Host: server.oauth_provider.com
Content-Type: application/x-www-form-
urlencoded
Authorization: Basic
czZCaGRSa3F0MzpnWDFmQmF0M2JW
grant_type=authorization_code&
code=SplxrhJY654090l&
redirect_uri=https%3A%2F%2Fclient
%2Eexample%2Ecom%2Fcb

24. Authorization
Code:
Token
Endpoint
NOT RECOMMENDED
POST /token HTTP/1.1
Host: server.example.com
Content-Type: application/x-www-
form-urlencoded
grant_type=refresh_token&
refresh_token=tGzv3JOkF0XG5Qx2TlK
WIA&
client_id=s6BhdRkqt3&
client_secret=7Fjfp0ZBr1KtDRbnfVd
mIw

25. Authorization
Code:
Token
Endpoint
HTTP Response
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
Cache-Control: no-store
Pragma: no-cache
{
"access_token":"2YotnFZFEjr1zCsicMWpAA",
"token_type":"example",
"expires_in":3600,
"refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
“example_parameter":"example_value"
}

26. Authorization
Code Grant:
Step 2

27. ConsentForm
Credentials

28. Authorization
Code Grant:
Step 3

29. Authorization
Code Grant:
Step 3

30. Authorization
Code:
Resource
Server API
Call
HTTP GET Request: Bearer Token
GET /resource/1 HTTP/1.1
Host: example.com
Authorization: Bearer mF_9.B5f-4.1JqM

31. Authorization
Code:
Resource
Server API
Call
HTTP GET Request: MAC Token
GET /resource/1 HTTP/1.1
Host: example.com
Authorization: MAC
id=“h480djs93hd8",
nonce=“274312:dj83hs9s”,
mac="kDZvddkndxvhGRXZhvuDjE
WhGeE="

32. Authorization
Code Grant:
Step 3

33. Basics:
Implicit Grant Type

34. ConsentForm
Credentials

35. Implicit
Grant:
Get Request
for auth token
GET /authorize?
response_type=token&
client_id=s6BhdRkqt3&state=xyz&
redirect_uri=https%3A%2F
%2Fclient%2Eexample%2Ecom%2Fcb
HTTP/1.1
Host: server.example.com

36. Implicit
Grant:
Get Request
for auth token
HTTP/1.1 302 Found
Location: http://example.com/cb#
access_token=2YotnFZFEjr1zCsicMWpAA&
state=xyz&
token_type=example&
expires_in=3600

37. Criticism

38. Criticism:
Lack Of
Interoperability
Many Optional Components
Partially/Fully Undefined Components
Client Registration
Authorization Server Capabilities
Endpoint Discovery
Future work will define prescriptive
profiles and extensions necessary to
achieve full web-scale interoperability.

39. Framework
<-> Protocol

43. Outdated
Designed for 2006
Hosted Applications Centric
mobile
native
js

44. Bearer
Tokens
Don’t put your eggs in one basket
Defense in Depth
is the humble realization that, of all the security measures
you implement, a few will fail because of your own
stupidity. It’s good to have a few backups, just in case

45. Alternative

46. Oz
Three JS Modules:
Iron: JavaScript object and turn it into a
verifiable encoded blob.
Hawk: is a client-server authentication
protocol providing a rich set of features for
a wide range of security needs.
Oz: leverages the other two

47. Oz
Builds on top of experience of Oauth 1.0/2.0
Highly Opinionated Decisions
Client Side Cryptography: Hawk

48. Functional Imperative
functionalimperative.com
(647) 405-8994
@func_i