Security and Usability, two methodologies that have fought each other since the there was a login. As we have have progressed from a simple thought that even though something is painful developers will use it if it's secure, to an enlightened stage of good security and usability balance and judgement, we have seen the death of many specs and standards. Two open standards are leading the charge for this new auth age: OAuth 2 and OpenID Connect. In this talk we will explore the principles and standards behind API auth security, which will include: Using OAuth 2 and OpenID Connect as the entry point for secure API data auth - How those implementations have cannibalized previous standards to create something both secure and usable - How to practically use these standards.

1. Building on the Ashes of Past Standards
Securing API Data Models
Jonathan LeBlanc
Head of Developer Evangelism (North America)
Github: http://github.com/jcleblanc
Slides: http://slideshare.net/jcleblanc
Twitter: @jcleblanc

2. The Ultimate Decision
Security Usability

4. The Insecure, Unmanageable Start

5. Very Secure, Long to Implement

6. Two Currently Widely Used Specs

8. Fetching a Code
Prepare the Redirect URI
Authorization Endpoint
client_id response_type (code)
scope redirect_uri
nonce state
Browser Redirect
Redirect URI

9. Fetching the Access Token
Fetch the Access Token
Access Token Endpoint
client_id code (query string)
client_secret grant_type
HTTP POST
Access Token Endpoint

10. A few implementation differences
Endpoints
Scopes (dynamic / static)
Using the Access Token in a request

12. How it’s Normally Used
Access user details
Push data through
user social streams

13. But why?
Access token as a
control structure
Improve Existing
Products
Our showcase:
Seamless Checkout

14. A Few Code Links
OAuth2 & OpenID Connect Samples
https://github.com/jcleblanc/oauth
https://github.com/paypal/paypal-access
Log in with PayPal
http://bit.ly/loginwithpaypal

16. http://bit.ly/securing_apis
Thank You! Questions?
Jonathan LeBlanc
Head of Developer Evangelism (North America)
Github: http://github.com/jcleblanc
Slides: http://slideshare.net/jcleblanc
Twitter: @jcleblanc