I would like cover basic username/password auth, OAuth and Active Directory, security keys and everything in between. Would like to do this in a linear fashion, ie like a coursera course with practice problems.
Ask HN: Any comprehensive courses on Auth?
1–10 of 93 posts
Re: Ask HN: Any comprehensive courses on Auth?
#2I'm also interested in this, but specifically something that covers authentication between services and in particular situations where a user authenticates against service a and now service a needs to ask service b to do something on behalf of the user. Not just a handwavy "use OAuth" but more concrete and thorough.
Re: Ask HN: Any comprehensive courses on Auth?
#3What made me understand these things the most, was setting this up just for myself.
For example host your own instance of Zitadel, Authentik or whatever you find most appealing. Tinker a bit around with it. Then use that instance to authenticate yourself somewhere, i.e. another service where you can set up your own oauth provider. Take a look at the API requests, take a look the code of some OAuth implementation, for example in projects like Gitea, Nextcloud.
May not be it for everyone, though I really like learning by doing.
Re: Ask HN: Any comprehensive courses on Auth?
#4I think auth0 has some, which are free but maybe based too much around there product, which I use and think very good.
Re: Ask HN: Any comprehensive courses on Auth?
#5Re: Ask HN: Any comprehensive courses on Auth?
#6Huh, I always forget a lot of programmers weren't around when this stuff was invented. It's all actually pretty simple, and very little complexity. However, there are so many "gotchas" (that can result in zero security) that anyone writing a guide like this would probably have you sign a waiver, then any company you work for sign a waiver, and include your firstborn child.
For example, user/pass is pretty simple on the surface:
1. app sends server user/password.
2. check if it matches the password in the database.
3. if so, respond with a token the app can send back that is associated with the user. if not, return with a 401.
The number of gotchas in this simple 3-step process is insane... here's some off the top of my head (not exhaustive):
- make sure the login form includes a CSRF token.
- do not store the password in plaintext in the db. or encrypted, probably. Since an attacker can possibly get the encryption key and then decrypt all your passwords. Use strong, slow hashes.
- rate limit your logins to prevent brute-forcing (slow hashes work great here)
- use constant-time comparisons to check if the password matches (e.g., hash_equals() in PHP), RTFM for whatever constant time check you are using or you will open yourself up to timing attacks.
That's the issue with security stuff, there are so many gotchas that anyone writing a course would open themselves up to getting sued (at least in the US) just for missing a gotcha or someone with Dunning-Kruger thinking they know everything and getting hacked ... it's too risky. You have to just get into the industry and learn it the hard way. At least that's how I learned everything I learned.
Re: Ask HN: Any comprehensive courses on Auth?
#7I have not seen a course that covers all of the things you are asking for.
The best courses on the oidc/oauth and saml I have seen were the paid ones here: https://www.hackmanit.de/en/training/portfolio
On linkedinlearning this one was quite ok: https://www.linkedin.com/learning/web-security-oauth-and-ope...
Free ressources check: -https://aaronparecki.com/
-OAuth 2.0 and OpenID Connect (in plain English): https://m.youtube.com/watch?v=996OiexHze0
https://speakerdeck.com/nbarbettini/oauth-and-openid-connect...
-OAuth/OpenID by Nat Sakimura(chairman openid foundation) https://m.youtube.com/playlist?list=PLRUD_uiAYejRvQWkS2xjgFW...
For the active directory topic I don't know good ressources
Re: Ask HN: Any comprehensive courses on Auth?
#8I'm also interested in this, but specifically something that covers authentication between services and in particular situations where a user authenticates against service a and now service a needs to ask service b to do something on behalf of the user. Not just a handwavy "use OAuth" but more concrete and thorough.
To be honest, my first instinct was to give a hand wavy "use OAuth". But to elaborate a but further, oauth is made for this and is the industry standard for this kind of thing. There's lots out there on oauth that tells you more than "just use it", it's just a couple searches away. So I don't think I really understand the question.
Re: Ask HN: Any comprehensive courses on Auth?
#9I’ve learned a lot about these things by working on a project using Ory Kratos. The documentation is a bit patchy but it’s open source so you can dive into the gritty details of how a fairly large id provider implements the various aspects of OAuth and so on.
(One nice thing about Azure Active Directory is that it supports OAuth2 integrations so if you understand and can implement OAuth2 then you can also implement AD).
I know it’s not a linear learning answer but hope it helps you perhaps later. Good luck!
Re: Ask HN: Any comprehensive courses on Auth?
#10Huh, I always forget a lot of programmers weren't around when this stuff was invented. It's all actually pretty simple, and very little complexity. However, there are so many "gotchas" (that can result in zero security) that anyone writing a guide like this would probably have you sign a waiver, then any company you work for sign a waiver, and include your firstborn child. For example, user/pass is pretty simple on t…
I would add:
* on the client side, store the token as a secure https only cookie, as local storage is accessible by any module of your app, see supply-chain attacks.
* be extra careful with oAuth [1]
* for APIs, be strict with CORS [2]
[1] https://salt.security/blog/oh-auth-abusing-oauth-to-take-ove...