Post on 16-Apr-2017
Securing your Web API with OAuth
Mohanaraj Gopala Krishnan
MYOSS Meetup 4 Dec 2008
mohangk.org/blog
Questions for you
Experience with OAuth?
Developed, read spec, heard of ?
Application that exposes a Web API ?
Authentication ?
Experience using BBAuth, Authsub, Flickr Auth etc. ?
What is OAuth?
A simple open standard for Web API authorization
End Users
Share information between online services without disclosing passwords
Web service (Service providers)
Allow for secure access to your API in a user controlled, secure manner
3rd Party application (Consumers)
A standard authorization scheme for the web
Valet key for your web
http://toyotaownersclub.com/forums/index.php?showtopic=77384
VS
http://www.flickr.com/photos/leelefever/133949029/
OpenID vs OAuth
Goals are different
OpenID is about sharing a single identity with different consumers
OAuth is about sharing your data with different consumers without sharing your identity
Not mutually exclusive
OpenID vs OAuth
Commonality
Open protocols - community driven
Involves 3 parties
Involves moving the users between consumer and service provider
Involves laying a claim that is verified by the service/identity provider
OpenID - I own this URL
OAuth - I own this resource
Love triangle
End userService provider
Consumer
WTF ?!
Passwords are not confetti. Please stop throwing them around. Especially if theyre not yours
Chris Messina http://www.slideshare.net/carsonified/how-oauth-and-portable-data-can-revolutionize-your-web-app-chris-messina-presentation/
OAuth interaction demo
Simple demo
http://oauth.kg23.com/
http://oauth.kg23.com/
OAuth dance steps
http://flickr.com/photos/wigwam/2255831538/
OAuth dance steps
consumer keyAn identifier for the consumer to the service provider consumer secretSecret used to establish ownership of the consumer keyrequest tokenA value that is used to obtain authorization from the user. Finally traded in for an access token. access tokenValue used to gain access to a protected resource on behalf of the user without requiring the users credentialstoken secretSecret used to establish ownership of a given token
OAuth dance steps
http://www.googlecodesamples.com/oauth_playground/
mohangk.orgbCBllBPjPeO/G6xb0dAKwDnG
OAuth roles
Service provider
Implement three service endpoints
Get request token
Authenticate request token
Exchange request token for access token
Provides a form of authentication
Validates following requests (post OAuth dance)
Provides a mechanism to maintain authorization
Additional API services
e.g. Access token lifecycle management - revocation, extension
Service providers need to allow for end users to manage their authorizations
OAuth roles
Consumer
Acquire consumer key / consumer secret
Communication with service provider
Over HTTP - header, POST, GET query
Signing requests
HMAC-SHA1,RSA-SHA1,PLAINTEXT
Keep track of access tokens
Store association of users to access token
Service providers have different policy as to token lifetime-e.g. Goog vs Y!
Must be treated as securely as passwords
OAuth security
http://icanhascheezburger.com/2007/11/27/meh-security-system-let-me-showz-u-him/
OAuth security
Signing - allows for security beyond HTTP basic auth
No secret over the wire beyond the dance
Request is verifiable - untampered
Nonce & timestamps - mitigate replay attacks
Delegation of credentials instead of direct credentials
HTTPS still required for mitigating MITM - but if not too critical, request signing should suffice
Signature
HMAC-SHA1
HTTP methodBase URLNormalized parameters
oauth parametersoauth_consumer_key,oauth_token, oauth_nonce, oauth_timestamp, oauth_signature_mothod,oauth_versionrequest parametersparam1,param2oauth_signature = HMAC-SHA1(text,secret)
consumer_secret & oauth_token_secret*also base64 encoded + urlencoded
Signature
RSA-SHA1
HTTP methodBase URLNormalized parameters
oauth parametersoauth_consumer_key,oauth_token, oauth_nonce, oauth_timestamp, oauth_signature_mothod,oauth_versionrequest parametersparam1,param2oauth_signature* = RSA-SHA1(text,secret)
consumer_secret (consumer private key )*also base64 encoded + urlencoded
OAuth usage environments
Web application
Standard case
Gadgets
contained within a larger consumer - OAuth Gadget extension
2-legged OAuth
No user involved - the consumer has been put in a position of trust - e.g. Google domain administrator or accessing public data
Extension implemented by Goog - Only HMAC-SHA1, no oauth_token, additional - xoauth_requestor_id - user to imitate, must be explicitly enabled
Desktop apps / JS apps
Consumer secret can be easily compromised - trust levels
Doesnt compromise authorization
Why bother?
Large adoption - Goog, Y!, MySpace
Interop - Leverage the services
Can be used as a replacement for HTTP basic auth
SSL might not be always necessary
Part of the Open web stack
Atompub + OpenID + OAuth + XRDS +OpenSocial
Why bother ?
OpenID + OAuth is the Final Nail in the Coffin of the WS-* vs. REST Discussion
Dare Obsanjo http://www.25hoursaday.com/weblog/2007/11/12/OpenIDOAuthIsTheFinalNailInTheCoffinOfTheWSVsRESTDiscussion.aspx
State of OAuth
OAuth Core 1.0, IETF Draft
Different use environments being worked out via extensions
Library support - extensive, but varying quality
OpenID + OAuth hybrid models
Usability funkiness
Implementations
Libraries
oauth.net/code
http://github.com/search?q=oauth&x=0&y=0
Server implementations
PHP - http://code.google.com/p/oauth-php/
Ruby - http://github.com/pelle/oauth/tree/master
Thanks