Securing Web APIs from JavaScript/SPA Applications

on YouTube ↗59m

" summary

Explains concrete patterns: use OpenID Connect + OAuth2 to get an ID token (for UI) and an access token (for APIs), prefer the authorization code flow with PKCE from browsers, and avoid refresh tokens in SPAs today. Demonstrates the oidc-client JavaScript library talking to IdentityServer, storing tokens in sessionStorage, doing silent renew via an iframe (prompt=none) and validating bearer tokens on the API. Covers CSP, CSRF and same-site cookie tradeoffs and how each approach actually prevents specific attacks.

AI-written summary · about

" chapters (16)

1. 0:00Start
2. 2:00Outline
3. 2:38Styles of JavaScript browser-based apps
4. 4:25Threats against JavaScript apps
5. 10:48CSRF mitigation with anti-forgery tokens
6. 16:11Token based authentication
7. 18:02Client, token server, and API
8. 18:36Protocol flows
9. 21:17Token server endpoints
10. 21:49Discovery endpoint
11. 22:22Authorization request
12. 24:15Authorization response
13. 27:43Token endpoint exchange
14. 40:29Validating access tokens at API
15. 57:59Renewing access tokens
16. 58:12Summary

" related talks

• 57mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier, Brock Allen · NDC Porto 2019
• 58mBuilding JavaScript and mobile/native Clients for Token-based ArchitecturesDominick Baier, Brock Allen · NDC London 2017
• 01h 01mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier · NDC Copenhagen 2019
• 39mSecuring your apps with OAuth2 and OpenID ConnectRoland Guijt · Codemotion Rome 2015
• 37mOAuth2 and OpenID Connect for Single Page ApplicationsPhilippe De Ryck · OWASP Global AppSec Virtual 2020
• 44mThe Art of Authentication for Web AppsKim Maida · Build Stuff 2022
• 30mStandards-based authentication for JavaScript sitesKim Maida · backendlessConf_ 2019
• 01h 00mOAuth – the good PartsAnders Abel · NDC Security 2023