☁️Erwin van der Valk

Why Now is an Excellent Time for Backend For Frontend Learn more about Duende's BFFv4 here -> https://lnkd.in/eyuSq3p8 #dotnet #security #identity #bff #react #angular #vue.js

Duende BFFv4 is available now! 🚨 The #BFF security pattern saves the day! Rewatch Erwin van der Valk's demo on Token Management and applying Duende's backend for frontend. A must-watch for devs building modern apps. 📺 https://lnkd.in/e7P5JamT

Final talk of the day at #netassemble "don't let your token be stolen" mstack ☁️Erwin van der Valk Great talk Erwin explained everything about why you should not have your access tokens in the browser. Especially the fact that it is rather easy to "steal" the access tokens and or the refresh tokens. The user won't even notice, if one refresh token can be used multiple times. Now I have to check whether or not this is the case with refresh tokens from #EntraID. Anyway this talk certainly changed my mind on the usefulness of the Backend-for-frontend pattern. #security

We don't want to dunk on Microsoft here, but reading this article on excessive permissions we came across an interesting other flaw that was uncovered: "Insecure Storage of Sensitive Secrets". When using the OneDrive API (and Microsoft Authentication Library (MSAL) as part of it), there's a good chance access/refresh tokens are stored clear text in the browser's session storage. While that works, it's a risk. Malicious actors can try to read the token, and make API calls to your API on your behalf (from another application, even). Using a backend for frontend pattern mitigates this attack vector (and makes the client-side code much simpler as a side effect). By coincidence, we have a livestream coming up showing how this sort of attack can happen, and how building a BFF indeed mitigates this issue. Here's the article: https://lnkd.in/eVUcEmEh And here's the registration page for tomorrow's livestream on how to go about securely using tokens in browser-based apps: https://lnkd.in/e-QDi8gP See you there? #dotnet #security #identity #spa

Ten Years of JSON Web Token (JWT) and Preparing for the Future Ten years ago this week, in May 2015, the JSON Web Token (JWT) became RFC 7519. This was the culmination of a 4.5 year journey to create a simple JSON-based security token format and underlying JSON-based cryptographic standards. The full set of RFCs published together was: - RFC 7515: JSON Web Signature (JWS) - RFC 7516: JSON Web Encryption (JWE) - RFC 7517: JSON Web Key (JWK) - RFC 7518: JSON Web Algorithms (JWA) - RFC 7519: JSON Web Token (JWT) - RFC 7520: Examples of Protecting Content Using JSON Object Signing and Encryption (JOSE) - RFC 7521: Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants - RFC 7522: Security Assertion Markup Language (SAML) 2.0 Profile for OAuth 2.0 Client Authentication and Authorization Grants - RFC 7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants It’s certainly the case that we co-designed JWT and its underpinnings with OpenID Connect, while also attempting to create general-purpose, widely useful standards. Given the adoption that’s ensued, it seems that we succeeded. As I wrote in my post "JWTs helping combat fraudulent and unwanted telephone calls", “It’s often said that one sign of a standard having succeeded is that it’s used for things that the inventors never imagined.” I’m gratified that this applies to JWT and the related specifications. As was written in the post "Essential Moments in the OAuth and OpenID Connect Timeline", it’s now hard to imagine an online security world without these standards. That said, there’s work underway to keep JWTs and the use of them secure for the next decade. Five years ago, the JSON Web Token Best Current Practices specification was created. As I wrote then: "This Best Current Practices specification contains a compendium of lessons learned from real JWT deployments and implementations over that period. It describes pitfalls and how to avoid them as well as new recommended practices that enable proactively avoiding problems that could otherwise arise." My coauthors Yaron Sheffer and Dick Hardt and I are now updating the JWT BCP to describe additional threats and mitigations that have become known in the last five years. Similarly, my coauthors Brian Campbell and Chuck Mortimore of the JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants are updating it and related specifications to address vulnerabilities caused by ambiguities in the audience values of tokens sent to the authorization server. I’m truly grateful that my coauthors John Bradley and Nat Sakimura 💯 and I created something useful and widely used ten years ago, of course with substantial contributions from the OAuth, JOSE, and OpenID Connect working groups. I look forward to what the next decade will bring! See https://lnkd.in/gQjzyibZ for links to specs and articles cited.  #IETF #JWT #JOSE #OAuth #OpenID #OpenIDConnect OpenID Foundation

Looking forward to this https://lnkd.in/eVtaSdCw