21–30 of 93 posts
https://fastapi.tiangolo.com/tutorial/security/
After getting familiar, I self hosted Keycloak and integrated it with my FastAPI server.
Though not exactly a course, learning by doing helped me :)
It's a topic I'd be interested in writing more about, and I'm happy to start here if you would find it useful.
Earlier quoted context omitted.
I would add: * on the client side, store the token as a secure https only cookie, as local storage is accessible by any module of your app, see supply-chain attacks. * be extra careful with oAuth [1] * for APIs, be strict with CORS [2] [1] https://salt.security/blog/oh-auth-abusing-oauth-to-take-ove... [2] https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
I'm having to deal with this stuff right now. Firebase stores their refresh token in local storage and that allows minting new session tokens once they expire, are they wrong? Is there any other way to remain signed in "forever"? (until logout or until token is revoked)
Huh, I always forget a lot of programmers weren't around when this stuff was invented. It's all actually pretty simple, and very little complexity. However, there are so many "gotchas" (that can result in zero security) that anyone writing a guide like this would probably have you sign a waiver, then any company you work for sign a waiver, and include your firstborn child. For example, user/pass is pretty simple on t…
Actually, I think we're doing a huge disservice to our profession as programmers when we call stuff like this "an insane number of gotchas". This is no critique of you or your post specifically, mind you, and I know where you're coming from. But it's a critique of a general tendency among programmers to call anything that requires a bit of knowledge and thought beyond the simplest surface level solution "complex" or…
I was trying to say exactly what you are saying, and that is just get in there and learn. It isn't that complex to implement this stuff yourself if you need to. I've implemented this stuff myself dozens of times over the years... but I try to use a library before implementing it myself. Interestingly, over the years, I've reviewed libraries and found bugs in them. So, do read the code of the library you're using. Once you've reviewed a few of them (and implemented it yourself a few times), you kinda get an idea of what to look for.
Earlier quoted context omitted.
I'm having to deal with this stuff right now. Firebase stores their refresh token in local storage and that allows minting new session tokens once they expire, are they wrong? Is there any other way to remain signed in "forever"? (until logout or until token is revoked)
I didn't work with Firebase myself, isn't this something relevant? https://firebase.google.com/docs/auth/admin/manage-cookies
I have not seen a course that covers all of the things you are asking for. The best courses on the oidc/oauth and saml I have seen were the paid ones here: https://www.hackmanit.de/en/training/portfolio On linkedinlearning this one was quite ok: https://www.linkedin.com/learning/web-security-oauth-and-ope... Free ressources check: - https://aaronparecki.com/ -OAuth 2.0 and OpenID Connect (in plain English): https://m…
The Nuts and Bolts of OAuth 2.0
https://www.udemy.com/course/oauth-2-simplified/
Advanced OAuth Security
I have not seen a course that covers all of the things you are asking for. The best courses on the oidc/oauth and saml I have seen were the paid ones here: https://www.hackmanit.de/en/training/portfolio On linkedinlearning this one was quite ok: https://www.linkedin.com/learning/web-security-oauth-and-ope... Free ressources check: - https://aaronparecki.com/ -OAuth 2.0 and OpenID Connect (in plain English): https://m…
all of that, plus the rfcs for oauth2 and oidc are pretty great as well!
Also follow the BCP that will remain in a draft state forever(at least for the near future): https://datatracker.ietf.org/doc/html/draft-ietf-oauth-secur...
https://datatracker.ietf.org/doc/html/rfc6749
The introduction will give you a bit of a background. The most important to read (for now) is just the introduction up to chapter 2.
Security & IAM - https://cloud.google.com/architecture/security-iam
Other - https://cloud.google.com/architecture?_ga=2.121060044.-59389...