Les Hazlewood, Stormpath CTO, already showed you how to build a Beautiful REST+JSON API, but how do you secure your API? At Stormpath, we spent 18 months researching best practices. Join Les as he explains how to secure your REST API, the right way. We'll also host a live Q&A session at the end.
1. REST API Security
Les Hazlewood @lhazlewood
PMC Chair, Apache Shiro
Expert Group Member, JEE Application Security (JSR-375)
Founder & CTO, Stormpath
2. About Stormpath
• User Management API for Developers
• Password security
• Authentication and Authorization
• Multi Tenancy
• MFA, SAML, OAuth2
• LDAP & Active Directory Cloud Sync
• Instant-on, scalable, and highly available
• Free for developers
...
4. REST API Focus
• Eliminate server state
• Secure user credentials
• Secure server endpoints
• Expose access control rules
• SPAs and Mobile: ‘Untrusted Clients’
21. HTTP Basic
Pros:
• Very easy to use
• Supported by everything
Cons:
• Raw password always transmitted
• Easy to leak raw password if not careful (logging)
• Susceptible to Man-In-The-Middle attacks
• HTTPS *always* required
• Client must constantly retain/reference the raw password (server clients usually
ok, browser clients not ok)
26. Digest Schemes
Pros:
• Probably most secure
• Password never sent over the wire
• HTTPS not required (but your data may still require HTTPS)
• Can guarantee end-to-end HTTP message authenticity
(HTTPS cannot do this)
• Not susceptible to Man-In-The-Middle attacks
Cons:
• Very difficult to design safely
• Difficult to understand and use
• Difficult to implement libraries
• Client needs to retain a constant reference to the password
(server clients usually ok, browser clients maybe not?)
32. Bearer Token Schemes
Pros:
• Easier to use than digest
• De-facto standard token format (JWT)
• Can contain state – no server sessions needed
• Does not require constant access to the user password
Cons:
• HTTPS always required, during and always after login (not a big deal nowadays)
• Cannot guarantee end-to-end HTTP message authenticity (like digest schemes can)
• Susceptible to Man-In-The-Middle attacks
• Token creation and renewal workflows can be very complicated and confusing depending on use
case (OAuth2 confuses many people).
• When used for Browser or Mobile, additional security still required (Origin checks, CSRF-
protection, etc)
• Token content is not standard – applications can open themselves to attack
34. Custom Scheme
• Only if you really, Really, REALLY know what you’re doing.
Seriously.
No, rly. Srsly.
• Non-standard, so you essentially must provide your own client
libraries.
35. Custom Scheme
• Stormpath has a custom SAUTHC1 digest scheme
• Authenticates the entire HTTP Message, including the Body (OAuth 1.0a does
not)
• Uses nonces to prevent replay attacks
• Uses key derivation algorithms and HMAC-SHA-256
• We use it for our own SDKs*
• If you’re curious:
https://github.com/stormpath
(search for ‘sauthc1’ in any stormpath-sdk-* project)
*Basic still supported for non-SDK clients or ‘weird’ environments
39. API Keys
• Can be thought of as a really long username and password pair.
• Can be used with any HTTP Authentication Scheme that accepts
a username and password: Basic, Digest, OAuth2, etc.
• Almost exclusively used for server-to-server communication.
• Never embed API Key secrets in untrusted clients like
JavaScript or mobile applications.
40. HTTP Basic with API Key
String value = apiKeyId + ‘:’ + apiKeySecret
String schemeValue = base64_encode(value)
...
GET /admin HTTP/1.1
Authorization: Basic schemeValue
43. Session ID Problems
• They’re opaque and have no meaning themselves (they’re
just ‘pointers’).
• Service-oriented architectures might need a centralized ID de-
referencing service
44. Session ID Problems
• Opaque IDs mean clients can’t inspect them and find out
what it is allowed to do or not - it needs to make more
requests for this information.
• Susceptible to CSRF attacks
45. Session ID Problems
• Sessions = Server State!
• You need to store that state somewhere
• Session ID look up server state on *every request*.
• Really not good for distributed/clustered apps
• Really not good for scale
52. Example: Token Request using an API Key
POST /token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
grant_type=client_credentials&client_id=apiKeyId&client_secret=apiKeyS
ecret
*Assert allowed origin for browser-based apps
54. JSON Web Tokens (JWT)
• A URL-safe, compact, self-contained string with meaningful
information that is usually digitally signed or encrypted.
• The string is ‘opaque’ and can be used as a ‘token’.
• Many OAuth2 implementations use JWTs as OAuth2 Access
Tokens.
55. JSON Web Tokens (JWT)
• You can store them in cookies! But all those cookie security
rules still apply (CSRF protection, etc).
• You can entirely replace your session ID with a JWT.
56. JSON Web Tokens (JWT)
In the wild they look like just another ugly string:
eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.eyJ
pc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQo
gImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnV
lfQ.dBjftJeZ4CVPmB92K27uhbUJU1p1r_wW1gFWFOEj
Xk
57. JSON Web Tokens (JWT)
But they do have a three part structure. Each
part is a Base64Url-encoded string:
eyJ0eXAiOiJKV1QiLA0KICJhb
GciOiJIUzI1NiJ9
.
eyJpc3MiOiJqb2UiLA0KICJle
HAiOjEzMDA4MTkzODAsDQogIm
h0dHA6Ly9leGFtcGxlLmNvbS9
pc19yb290Ijp0cnVlfQ
.
dBjftJeZ4CVPmB92K27uhbUJU
1p1r_wW1gFWFOEjXk
Header
Body (‘Claims’)
Cryptographic Signature
58. JSON Web Tokens (JWT)
Base64Url-decode the parts to find the juicy bits:
{
"typ":"JWT",
"alg":"HS256"
}
{
"iss”:”http://trustyapp.com/”,
"exp": 1300819380,
“sub”: ”users/8983462”,
“scope”: “self api/buy”
}
tß´—™à%O˜v+nî…SZu¯µ€U…8H×
Header
Body (‘Claims’)
Cryptographic Signature
59. JSON Web Tokens (JWT)
The claims body is the best part! It can tell:
{
"iss”:”http://trustyapp.com/”,
"exp": 1300819380,
“sub”: ”users/8983462”,
“scope”: “self api/buy”
}
Who issued the token
60. JSON Web Tokens (JWT)
The claims body is the best part! It can tell:
{
"iss”:”http://trustyapp.com/”,
"exp": 1300819380,
“sub”: ”users/8983462”,
“scope”: “self api/buy”
}
Who issued the token
When it expires
61. JSON Web Tokens (JWT)
The claims body is the best part! It can tell:
{
"iss”:”http://trustyapp.com/”,
"exp": 1300819380,
“sub”: ”users/8983462”,
“scope”: “self api/buy”
}
Who issued the token
When it expires
Who it represents
62. JSON Web Tokens (JWT)
The claims body is the best part! It can tell:
{
"iss”:”http://trustyapp.com/”,
"exp": 1300819380,
“sub”: ”users/8983462”,
“scope”: “self api/buy”
}
Who issued the token
When it expires
Who it represents
What they can do
63. JSON Web Tokens (JWT)
Great! Why is this useful?
• Implicitly trusted because it is
cryptographically signed (verified not
tampered).
• It is structured, enabling inter-op between
services
• It can inform your client about basic access
control rules (permissions)*
• And the big one: statelessness!
*servers must always enforce access control policies
64. JSON Web Tokens (JWT)
So, what’s the catch?
• Implicit trust is a tradeoff – how long
should the token be good for? how will you
revoke it? (Another talk: refresh tokens)
• You still have to secure your cookies!
• You have to be mindful of what you store in
the JWT if they are not encrypted. No
sensitive info!
66. Authorization
• JWT Claims can have whatever you want
• Use a scope field that contains a list of permissions for that
user
• Client can inspect the claims and scope and turn on or off
features based on permissions*
• *Server must always assert permissions
68. In addition to user authentication and data security, Stormpath can handle authentication and
authorization for your API, SPA or mobile app.
• API Authentication
• API Key Management
• Authorization
• Token Based Authentication
• OAuth
• JWTs
• MFA, SAML, OAuth2
• Multi-Tenancy
http://docs.stormpath.com/guides/api-key-management/
Implementations in your Library of choice:
https://docs.stormpath.com/home/
Use Stormpath for API
Authentication & Security