Secure API Services in Node with Basic Auth and OAuth2
Download as pptx, pdf4 likes1,958 views
The document outlines a presentation focused on securing API services in Node.js, detailing features of Stormpath such as user management, flexible authentication, and single sign-on integration. It includes discussions on API key creation, basic authentication, and OAuth2 implementation steps. Resources for further learning on OAuth2 services and Stormpath libraries are also provided.
Secure API Services in Node with Basic Auth and OAuth2
- 1. Secure API Services in Node.js
- 2. Welcome! • Agenda • Stormpath 101 (5 mins) • How to secure an API (25 mins) • Q&A (30 mins) • Claire Hunsaker VP of Marketing & Customer Success • Randall Degges Node.js Evangelist
- 3. Customer Identity Poses Major Challenges
- 4. Speed to Market & Cost Reduction • Complete Identity solution out-of-the-box • Security best practices and updates by default • Clean & elegant API/SDKs • Little to code, no maintenance Focus on Your Core Competency
- 5. Stormpath User Management User Data User Workflows Google ID Your Applications Application SDK Application SDK Application SDK ID Integrations Facebook Active Directory SAML
- 6. Features • Secure, flexible Authentication (Password, Token, OAuth, API) • Deep Authorization Groups, Roles Customer Organizations Permissions • Customer Profile Data • Single Sign-On Across Your Apps • Hosted User Screens
- 7. What’s the Goal of This Talk?
- 8. D’oh! API Server(s)API Client API Client API Client API Client Internet
- 9. API Server(s)API Server(s) Browser / Mobile Web API Client Client-to-API Server-to-API
- 10. Basic Auth OAuth2 What’s the Goal of This Talk?
- 11. About API Keys…
- 13. 163e087c36c34fa4b4635995c29cf9b5:b6e7bd4c74cf430493fe03b2e30225f8 API Secret Long, random strings (uuids).
- 14. Let Users Have Multiple API Keys Key 1 Key 2 ID: 3c511ea2ef424dd88bc1575e7e5a2bd7 Secret: 1ae8120c1ec940638913f4e258b8f7fe ID: cc463f7aabfd4132a2211006886d05f1 Secret: 85172ea5aef144038f019b3111b5e11a
- 15. Creating API Keys with Stormpath req.user.createApiKey(function(err, apiKey) { if (err) throw err; console.log('New API key created!'); console.log('API Key ID:', apiKey.id); console.log('API Key Secret:', apiKey.secret); });
- 16. LET’S SET UP STORMPATH!
- 17. LET’S WRITE SOME CODE!
- 18. How Does Basic Auth Work? API Server(s) Authorization: Basic <base64(id:secret)> $ curl --user id:secret http://localhost:3000/api/test
- 19. How Does OAuth2 Work? (Step 1) API Server(s) Authorization: Basic <base64(id:secret)> Access Token $ curl --user id:secret -X POST --data grant_type=client_credentials http://localhost:3000/oauth/token
- 20. How Does OAuth2 Work? (Step 2) API Server(s) Authorization: Bearer <token> $ curl -H “Authorization: Bearer <token>” http://localhost:3000/api/test
- 21. Node & Express Resources • Talking to OAuth2 Services with Node.js https://stormpath.com/blog/talking-to-oauth2-services-with-nodejs • What the Heck is OAuth? https://stormpath.com/blog/what-the-heck-is-oauth/ • Stormpath Express Library http://docs.stormpath.com/nodejs/express/latest/ • All Our JavaScript Integrations http://docs.stormpath.com/nodejs/
- 22. QUESTIONS?
- 23. THANK YOU