SOUJava 2018 Deconstructing REST Security

SOUJava
#RESTSecurity @JLouisMonteiro @tomitribe
Deconstruc0ng REST Security
Jean-Louis Monteiro
Tomitribe

SOUJava
Why am I here today?
Microservices architecture case
Security op0ons
OAuth2 with JWT
HTTP Signatures
Demo with MP-JWT and TomEE

SOUJava
Microservices
(SOA with a sexy name)

@dblevins @tomitribe
SOUJava
Tradi0onal system
Component A
Component B
Component CComponent D
System
(Monolithic)

SOUJava
… and its tradi0onal security

SOUJava
Microservices - the technical perspec0ve
• Cloud
• Containers
• Virtualiza1on
• Large scale

SOUJava
The organiza0onal perspec0ve
• Agile methodology
• Small teams
• HR / organiza1onal changes free

SOUJava
But there are new challenges
• Scalability
• Cost reduc1on
• Resilience
• Monitoring
• Security

SOUJava
Baseline Architecture
1000 users
x 3 TPS
4 hops
3000 TPS
frontend
12000 TPS
backend

SOUJava
Microservices security op0ons

SOUJava
Op0ons
• Basic Auth
• OAuth2
• OpenID Connect
• JWT - Facebook / Google way
• HTTP Signatures - Amazon way
• « In-house » solu1on
• And many more …

SOUJava
“The nice thing about standards is
you have so many to choose from.”
- Andrew S. Tanenbaum

SOUJava
Basic Auth
(and its problems)

SOUJava
Basic Auth Message
POST /painter/color/object HTTP/1.1
Host: localhost:8443
Authorization: Basic c25vb3B5OnBhc3M=
User-Agent: curl/7.43.0
Accept: */*
Content-Type: application/json
Content-Length: 45
{"color":{"b":255,"g":0,"name":"blue","r":0}}

SOUJava
Basic Auth
Password Sent
3000 TPS
(HTTP+SSL)
username+password
Base64
(no auth)
3000 TPS
(LDAP)
12000 TPS
(HTTP)

SOUJava
Basic Auth
Password Sent
3000 TPS
(HTTP+SSL)
username+password
Base64
username+password
Base64
15000 TPS
(LDAP)
Password Sent
12000 TPS
(HTTP)

SOUJava
Basic Auth - AQacks
Valid
Password Sent
3000 TPS
(HTTP+SSL) No auth
9000 TPS
(LDAP)
12000 TPS
(HTTP)
Invalid
Password Sent
6000 TPS
(HTTP+SSL)

SOUJava
OAuth 2.0
(and its problems)

SOUJava
The theory behind it

SOUJava
Based on tokens

SOUJava
OAuth 2 - Password Grant
(LDAP)
(Token Store)
POST /oauth2/token
Host: api.superbiz.io
Accept: */*
Content-Type: application/x-www-form-urlencoded
Content-Length: 54
grant_type=password&username=snoopy&password=woodstock
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
Cache-Control: no-store
Pragma: no-cache
{
"access_token":"2YotnFZFEjr1zCsicMWpAA",
"expires_in":3600,
"refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
}
Verify
Password
Generate
Token

SOUJava
OAuth 2.0 Message
POST /painter/color/object HTTP/1.1
Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA
Accept: */*
Content-Length: 45
{"color":{"r":0,"g":0,"b":255,"name":"blue"}}

SOUJava
OAuth 2.0 Message
POST /painter/color/palette HTTP/1.1
Accept: */*
Content-Length: 45
{"color":{"r":0,"g":255,"b":0,"name":"green"}}

SOUJava
OAuth 2.0 Message
POST /painter/color/select HTTP/1.1
Accept: */*
Content-Length: 44
{"color":{"r":255,"g":0,"b":0,"name":"red"}}

SOUJava
OAuth 2.0 Message
POST /painter/color/fill HTTP/1.1
Accept: */*
Content-Length: 49
{"color":{"r":0,"g":255,"b":255,"name":"yellow"}}

SOUJava
OAuth 2.0 Message
POST /painter/color/stroke HTTP/1.1
Accept: */*
Content-Length: 49
{"color":{"r":255,"g":200,"b":255,"name":"orange"}}

SOUJava
401

SOUJava
OAuth 2 - Refresh Grant
(LDAP)
(Token Store)
Verify and
Generate
Token
POST /oauth2/token
Accept: */*
Content-Length: 54
grant_type=refresh_token&refresh_token=tGzv3JOkF0XG5Qx2TlKWIA
HTTP/1.1 200 OK
Pragma: no-cache
{
"access_token":"6Fe4jd7TmdE5yW2q0y6W2w",
"expires_in":3600,
"refresh_token":"hyT5rw1QNh5Ttg2hdtR54e",
}

SOUJava
OAuth 2.0 Message
POST /painter/color/palette HTTP/1.1
Authorization: Bearer 6Fe4jd7TmdE5yW2q0y6W2w
Accept: */*
Content-Length: 46
{"color":{"r":0,"g":255,"b":0,"name":"green"}}

SOUJava
OAuth 2.0 Message
POST /painter/color/select HTTP/1.1
Accept: */*
Content-Length: 44
{"color":{"r":255,"g":0,"b":0,"name":"red"}}

SOUJava
OAuth 2.0 Message
POST /painter/color/fill HTTP/1.1
Accept: */*
Content-Length: 49
{"color":{"r":0,"g":255,"b":255,"name":"yellow"}}

SOUJava
What have we achieved?
• Avoid high rate username + password transit on wire
• Replaced by a blind « token » referencing a state on the server
side
• Generate many « short live » passwords stored on devices
• Create a new …. HTTP Session architecture

SOUJava
New terms, really?
• Password Grant?
• Logging in
• Token?
• Slightly less crappy password
• Equally crappy HTTP Session ID

SOUJava
OAuth 2
Tokens Sent
3000 TPS
(HTTP+SSL)
No auth
3000 TPS
(token checks)
Password Sent
1000/daily
(HTTP+SSL)
OAuth 2
(LDAP)
4 hops
12000 TPS
backend

SOUJava
OAuth 2
Tokens Sent
3000 TPS
(HTTP+SSL)
IP
whitelis1ng
3000 TPS
(token checks)
Password Sent
1000/daily
(HTTP+SSL)
OAuth 2
(LDAP)
12000 TPS
(token checks)
backend

SOUJava
OAuth 2
Tokens Sent
3000 TPS
(HTTP+SSL)
IP
whitelis1ng
3000 TPS
(token checks)
Password Sent
1000/daily
(HTTP+SSL)
OAuth 2
(LDAP)
12000 TPS
(token checks)
backend
55% of all traﬃc

SOUJava
OAuth 2
Tokens Sent
3000 TPS
(HTTP+SSL)
IP
whitelis1ng
0 TPS
(token checks)
Password Sent
1000/daily
(HTTP+SSL)
OAuth 2
(LDAP)
0 TPS
(token checks)
0 hops
0 TPS
backend

SOUJava
OAuth 2.0
+
JSON Web Tokens (JWT)

SOUJava
JSON Web Token
• Pronounced “JOT”
• SAML like but less verbose
• Fancy JSON map
• Base64 URL Encoded
• Digitally Signed (RSA-SHA256, HMAC-SHA512, etc)
• Possibly encrypted
• Built-in expira1on

SOUJava
Access Token Previously
• 6Fe4jd7TmdE5yW2q0y6W2w

SOUJava
Access Token Now
• eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbi
10eXBlIjoiYWNjZXNzLXRva2VuIiwidXNlcm5hbWUiOiJzb
m9vcHkiLCJhbmltYWwiOiJiZWFnbGUiLCJpc3MiOiJodHRw
czovL2RlbW8uc3VwZXJiaXouY29tL29hdXRoMi90b2tlbiI
sInNjb3BlcyI6WyJ0d2l0dGVyIiwibWFucy1iZXN0LWZyaW
VuZCJdLCJleHAiOjE0NzQyODA5NjMsImlhdCI6MTQ3NDI3O
TE2MywianRpIjoiNjY4ODFiMDY4YjI0OWFkOSJ9.DTfSdMz
IIsC0j8z3icRdYO1GaMGl6j1I_2DBjiiHW9vmDz8OAw8Jh8
DpO32fv0vICc0hb4F0QCD3KQnv8GVM73kSYaOEUwlW0k1Ta
Elxc43_Ocxm1F5IUNZvzlLJ_ksFXGDL_cuadhVDaiqmhct0
98ocefuv08TdzRxqYoEqYNo

SOUJava
Access Token Now
• { "alg": “RS256", "typ": “JWT" }
• {
"token-type": "access-token",
"username": "snoopy",
"animal": "beagle",
"iss": "https://demo.superbiz.com/oauth2/token",
"scopes": [
“twitter”, "mans-best-friend"
],
"exp": 1474280963,
"iat": 1474279163,
"jti": "66881b068b249ad9"
}
• DTfSdMzIIsC0j8z3icRdYO1GaMGl6j1I_2DBjiiHW9vmDz8OAw8Jh8DpO32fv0vICc0hb4F0QCD3
KQnv8GVM73kSYaOEUwlW0k1TaElxc43_Ocxm1F5IUNZvzlLJ_ksFXGDL_cuadhVDaiqmhct098oc
efuv08TdzRxqYoEqYNo

SOUJava
Access Token Now
• Header (JSON > Base64 URL Encoded)
• Describes how the token signature can be checked
• Payload (JSON > Base64 URL Encoded)
• Basically a map of whatever you want to put in it
• Some standard entries (called claims) such as expira1on
• Signature (Binary > Base64 URL Encoded
• The actual digital signature
• Made exclusively by the /oauth2/token endpoint
• If RSA, can be checked by anyone

SOUJava
Subtle But High Impact
Architectural Change

SOUJava
What we had
(quick recap)

SOUJava
Client Holds Pointer Server Holds State

SOUJava
What we can do now
(Hello JWT!)

SOUJava
Client Holds State Server Holds Pointer

SOUJava
OAuth 2 - Password Grant
(LDAP)
(Token ID Store)
POST /oauth2/token
Accept: */*
Content-Length: 54
grant_type=password&username=snoopy&password=woodstock
Verify
Password
Generate
Signed
Token
HTTP/1.1 200 OK
Pragma: no-cache
{
"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.
eyJ0b2tlbi10eXBlIjoiYWNjZXNzLXRva2VuIiwidXNlcm5hb
WUiOiJzbm9vcHkiLCJhbmltYWwiOiJiZWFnbGUiLCJpc3M
iOiJodHRwczovL2RlbW8uc3VwZXJiaXouY29tL29hdXRoM
i90b2tlbiIsInNjb3BlcyI6WyJ0d2l0dGVyIiwibWFucy1iZXN0
LWZyaWVuZCJdLCJleHAiOjE0NzQyODA5NjMsImlhdCI6M
TQ3NDI3OTE2MywianRpIjoiNjY4ODFiMDY4YjI0OWFkOSJ
9.DTfSdMzIIsC0j8z3icRdYO1GaMGl6j1I_2DBjiiHW9vmDz8
OAw8Jh8DpO32fv0vICc0hb4F0QCD3KQnv8GVM73kSYaO
EUwlW0k1TaElxc43_Ocxm1F5IUNZvzlLJ_ksFXGDL_cuadh
VDaiqmhct098ocefuv08TdzRxqYoEqYNo",
"expires_in":3600,
"refresh_token":"eyJhbGctGzv3JOkF0XG5Qx2TlKWIAkF0X.
eyJ0b2tlbi10eXBlIjoiYWNjZXNzLXRva2VuIiwidXNlcm5hb
WUiOiJzbm9vcHkiLCJhbmltYWwiOiJiZWFnbGUiLCJpc3M
iOiJodHRwczovL",
}

SOUJava
OAuth 2.0 Message with JWT
POST /painter/color/paleie HTTP/1.1 
Host: api.superbiz.io 
Authoriza0on: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbi10eXBlIjoiYWNjZXNzLXR
va2VuIiwidXNlcm5hbWUiOiJzbm9vcHkiLCJhbmltYWwiOiJiZWFnbGUiLCJpc3MiOiJodHRwczovL2RlbW8uc3VwZXJ
iaXouY29tL29hdXRoMi90b2tlbiIsInNjb3BlcyI6WyJ0d2l0dGVyIiwibWFucy1iZXN0LWZyaWVuZCJdLCJleHAiOjE0NzQy
ODA5NjMsImlhdCI6MTQ3NDI3OTE2MywianRpIjoiNjY4ODFiMDY4YjI0OWFkOSJ9.DTfSdMzIIsC0j8z3icRdYO1GaMGl
6j1I_2DBjiiHW9vmDz8OAw8Jh8DpO32fv0vICc0hb4F0QCD3KQnv8GVM73kSYaOEUwlW0k1TaElxc43_Ocxm1F5IUNZ
vzlLJ_ksFXGDL_cuadhVDaiqmhct098ocefuv08TdzRxqYoEqYNo
User-Agent: curl/7.43.0 
Accept: */* 
Content-Type: applica1on/json 
Content-Length: 46 
 
{"color":{"b":0,"g":255,"r":0,"name":"green"}}

SOUJava
OAuth 2 + JWT
Tokens Sent
3000 TPS
(HTTP+SSL)
0.27 TPS
(refresh token checks)
Password Sent
1000/daily
(HTTP+SSL)
OAuth 2
(LDAP)
4 hops
12000 TPS
backend
3000 TPS
(signature veriﬁca1on)
12000 TPS
(signature veriﬁca1on)(private key)
(public key)

SOUJava
OAuth 2 + JWT
Valid
Tokens Sent
3000 TPS
(HTTP+SSL)
0.27 TPS
(refresh token checks)
Password Sent
1000/daily
(HTTP+SSL)
(LDAP)
4 hops
12000 TPS
backend
9000 TPS
12000 TPS
Invalid
Tokens Sent
6000 TPS
(HTTP+SSL)
(private key)
(public key)

SOUJava
HTTP Signatures
(Amazon EC2 style API Security)

SOUJava
HTTP Signatures
• No “secret” ever hits the wire
• Signs the message itself
• Proves iden1ty
• Prevents message tampering
• Symmetric or Asymmetric signatures
• IETF Dras
• hips://tools.iet.org/html/dras-cavage-hip-signatures
• Extremely simple
• Does NOT eliminate beneﬁts of JWT

SOUJava
Signature Message
POST /painter/color/paleie HTTP/1.1 
Host: api.superbiz.io 
Authoriza1on: Signature keyId=“my-key-name",
algorithm="hmac-sha256",
headers="content-length host date (request-target)”,
signature="j050ZC4iWDW40nVx2oVwBEymXzwvsgm+hKBkuw04b+w=" 
Date: Mon, 19 Sep 2016 16:51:35 PDT
Accept: */* 
Content-Type: applica1on/json 
Content-Length: 46 
 
{"color":{"b":0,"g":255,"r":0,"name":"green"}}

SOUJava
Signature closeup
Signature
keyId=“my-key-name",
algorithm="hmac-sha256",
headers="content-length host date (request-target)”,
signature="j050ZC4iWDW40nVx2oVwBEymXzwvsgm+hKBkuw04b+w="

SOUJava
Signature Auth
Password Sent
0 TPS
(HTTP)
Signature (no auth)
3000 TPS
(LDAP or Keystore)
12000 TPS
(HTTP)

SOUJava
Signature Auth
Password Sent
0 TPS
(HTTP)
Signature Signature
3000 TPS
(LDAP or Keystore)
12000 TPS
(HTTP)

SOUJava
#RESTSecurity @dblevins @tomitribe#RESTSecurity @JLouisMonteiro @tomitribe
Demo

SOUJava
Thank You!
http://tribestream.io
http://tomitribe.io
http://microproﬁle.io

SOUJava 2018 Deconstructing REST Security

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Empfohlen

Empfohlen (20)

SOUJava 2018 Deconstructing REST Security