REST security essentials
summary
Covers concrete tradeoffs: use HTTPS; avoid Basic auth; session IDs force server-side storage and sticky sessions; prefer authorization code grant for confidential clients and short-lived access tokens with server-checked refresh tokens; use signed JWTs (HMAC or RSA/ECDSA) to make services stateless but plan for token revocation via blacklist or very short expiry; mitigate XSS/CSRF by using HttpOnly cookies for refresh tokens and keeping access tokens in memory; explores HTTP signatures (digest + signature header + keyId) to prove key possession.
AI-written summary · about
chapters (13)
- 0:00Intro
- 1:46BASIC AUTH
- 7:44OAUTH2 ROLES
- 9:22OAUTH 2 PROTOCOL FLOW
- 9:56OAUTH2 GRANTS
- 13:06OAUTH2 TOKENS
- 18:38JWT STRUCTURE
- 20:07JWT BENEFITS
- 23:10DRAWBACKS
- 23:57SECURITY CONSIDERATIONS OF JWT
- 25:19JWT SECURITY CONSIDERATIONS
- 27:05HTTP SIGNATURES
- 30:26CONCLUSION
related talks
53mCommon API Security Pitfalls
50mCommon API security pitfalls
37mCommon REST API security pitfalls
26mSecuring Single Page Applications with Token Based Authentication
47mDeconstructing and Evolving REST Security
01h 02mLock That Sh*t Down! Auth Security Patterns for Apps, APIs, and Infra
35mSecure JAX-RS
38mAuthentication as a Microservice: Portable Customer Identity Management