ef2eecee7655f814bd7a9228ba0c6992?s=200 avatar

ef2eecee7655f814bd7a9228ba0c6992?s=200

Director of Culture

Clayton Moulynox

tyler-clark

Senior Developer Advocate Engineer

Tyler Clark

Chris Sevilleja

Chris Sev is the Director of DevRel at Okta. He has been writing code since he was 14. Building businesses, creating written/video content, and loves that we live in the age of the nerd.

He lives in Denver with his wife and 2 kids. When not coding, he does all things outdoors.

Director, Developer Relations

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Staff Developer Advocate

Juan Cruz Martinez

There is no stopping OpenClaw (formerly known as Moltbot and Clawdbot). But here is a five-step checklist to make it safe.

Securing OpenClaw: A Developer's Checklist for AI Agent Security

jess-author

Jessica Temporal is a Senior Developer Advocate at Auth0 and co-founder of the first Brazilian data science podcast called <a target='_blank' href='https://pizzadedados.com'><strong>Pizza de Dados</strong></a>. She’s the author of <a target='_blank' href='https://www.amazon.com/dp/B0CDNX6NS7/ref=sr_1_1?&_encoding=UTF8&tag=jesstempora0e-20&linkCode=ur2&linkId=efc4229f6b816609dfce4f185781d99a&camp=1789&creative=9325' ><strong>The Big Git Microbook</strong></a>, creator of <a target='_blank' href='https://gitfichas.com/en'><strong>GitFichas.com</strong></a>, and a part of <a target='_blank' href='https://www.linkedin.com/learning/instructors/jessica-temporal'><strong>LinkedIn Learning</strong></a> instructors team. Jessica helped develop the AI that identifies possible unlawful expenses from Brazilian politicians. She is part of the PyLadies initiative that works to improve diversity and inclusion in technology. In her free time, she likes to knit, play video games, use her 3D printer, and is learning to create 3D models.

Sr. Developer Advocate

Jessica Temporal

Learn about the new classification of MCP servers as OAuth Resource Servers, implementing Resource Indicators to prevent token misuse, and the clearer security best practices designed to help you build more robust and secure MCP applications

As developers, we're building the next generation of applications on a foundation of interconnected services. The Model Context Protocol (MCP) is rapidly becoming a key part of that foundation, enabling seamless context sharing between AI models and applications. But as adoption grows, how do we ensure the connections we build are secure?

The [latest changelog](https://modelcontextprotocol.io/specification/2025-06-18/changelog), released on June 18, 2025, introduces updates that clarify how authorization should be handled for MCP Servers and how MCP Clients should implement [Resource Indicators](https://www.rfc-editor.org/rfc/rfc8707.html) to prevent malicious servers from obtaining access tokens.

Let's break down what’s new for auth and what it means for you as you build with MCP.

## MCP Servers Now Classified as OAuth Resource Servers

MCP servers are now officially classified as [OAuth Resource Servers](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization#authorization-server-discovery). This might seem like a small semantic change, but it has significant implications for security and discovery.

By defining MCP servers this way, the protocol now includes a mechanism to add protected resource metadata. What does this mean in practice? It allows an MCP server to advertise where its corresponding Authorization Server is located. This discovery mechanism is vital for clients, as it removes ambiguity and ensures they request tokens from the legitimate, intended authority, streamlining the authorization process securely.

## Preventing Token Misuse by Implementing Resource Indicators (RFC 8707)

Have you ever worried about a token intended for one service being misused at another? This is a legitimate threat known as "token mis-redemption." To combat this, MCP clients are now required to implement Resource Indicators, as specified in [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707).

![A diagram illustrating MCP security, showing how Resource Indicators (RFC 8707) prevent token misuse by locking an access token to a specific audience (resource server)](https://images.ctfassets.net/23aumh6u8s0i/5H7veAQxKRIcnI6bOHWyEI/c2c6881322830a9283a5360af6906c68/Uploaded_from_Model_Context_Protocol__MCP__Spec_Updates_from_June_2025__One_Small_Step_for_a_Spec__One_Giant_Leap_for_Security)

By using a resource indicator in the token request, a client explicitly states the intended recipient (the "audience") of the access token. The Authorization Server can then issue a token that is _tightly scoped_ and only valid for that specific MCP server. This prevents a malicious or compromised server from taking a token it received and using it to access a different protected resource on the user's behalf. Put plainly, this practice ensures your tokens can't be used where they don't belong.

## Clearer MCP Security Guidance and Best Practices

Building secure systems is easier when the rules of the road are crystal clear. This update brings significant clarifications to the core [authorization spec's security considerations](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization#security-considerations) and introduces a brand new, dedicated page for [security best practices](https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices).

This new guidance provides actionable advice for developers like you and me so we can implement both clients and servers more securely. It centralizes security guidance, making it easier to build robust and secure MCP integrations from the ground up. We strongly recommend all developers working with MCP review these pages.

## Building a More Secure Future

These updates represent a significant step forward in hardening the Model Context Protocol. By formalizing the roles of servers, mandating token protection with resource indicators, and providing clearer documentation, the MCP is becoming an even more robust and trustworthy standard for the AI application ecosystem.

While these aren’t the only changes in the June 18th MCP specification changelog, they are the most impactful ones concerning authentication and authorization. If you are building and securing MCPs you should check out our documentation on Auth for MCP and the Getting Started with Auth0 Model Context Protocol (MCP) Server.

Now you’re ready to go forth and enhance the security of your MCP servers and clients.

Model Context Protocol (MCP) Spec Updates from June 2025: One Small Step for a Spec, One Giant Leap for Security

Calah Vargas

Calah is the Manager of Developer Marketing for Auth0. She joined Okta in 2022 and has focused on building content, digital experiences, and in-person events for the developer community, including startups and nonprofits. Before Okta, Calah crafted marketing and customer experience initiatives at startups, nonprofits, and political advertising agencies. She was born and raised in Orange County, CA, and made her way up to the Bay. In her free time, she loves to cook, read, try new restaurants, and travel with her family and friends.



Manager, Developer Marketing

profile small square

Shreya is the Developer Advocate for Auth0 for Startups. She previously founded a non-profit called Bit Project, worked at a YC-backed Startup as a Developer Advocate, and currently hosts The Developer Diaries podcast. Through each experience, she has found her love for building resources and tools that help move the needle for developers. Outside of work, she enjoys traveling, watching K-Dramas, and drinking boba.

Developer Advocate, Startups

Shreya Gupta

emma-gray

Sr. Manager, Product-Led Growth Marketing

Emma Gray

Get started fast with two best-in-class developer platforms: Auth0 and Vercel

**TL;DR:** [New Auth0 Integration](https://vercel.com/integrations/auth0) for Vercel: Available Now. We’ll share why we partnered with Vercel, help guide you through deploying an application, and explain how you can take full advantage of this integration.

<AmpContent>
<amp-youtube
    data-videoid="YqGClksfZKE"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/YqGClksfZKE' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

## Why Should I Choose Auth0?

Auth0 provides an extensible and scalable authentication experience, allowing you to focus on your core product. We’ll ensure your users have the best possible experience and help you maintain a strategic advantage for years to come.

We offer comprehensive out-of-the-box functionalities with cutting-edge technologies and architecture. Our rich features include customizable actions, connections to over 60+ social and Identity providers, broad support for open standards (OIDC, SAML, FIDO, OAuth, and more), multi-cloud encryption architecture, extensive compliance and regulatory requirements, and easily customizable sign-up and login interfaces and flows, to name a few. 
    
## What Is Vercel and Why Did We Choose to Partner with Them?

[Vercel](http://vercel.com/) is a cloud platform designed to simplify the deployment process for web applications, making it easy to deploy and manage your frontend. In the world of web development, efficiency and speed are crucial, as are the safety and security of production environments. Integrating with a third-party platform like Auth0 allows Vercel users hosting their new or existing projects to seamlessly extend Vercel’s capabilities.

Prioritizing who we partner with comes down to selecting organizations who align with our mission and values, including key pillars of cutting-edge developer experiences and a foundation of security. With this in mind, investing in a partnership with Vercel was an obvious choice for our team. This integration allows you to build scalable, secure, and compliant applications with an enhanced user experience by leveraging the strengths of these two best-in-class platforms. 

## Let’s Start Building with Auth0 and Vercel

**Challenge**: You’re looking for the most efficient way to integrate Auth0 into your Vercel-powered app.

**Solution**: Use the new integration to build and customize the Identity flow for your Vercel project. To get your app up and running quickly and securely, this integration will:

* Set up a production environment in Vercel that integrates with your Auth0 tenant in just a few clicks,
* Automatically create an [Application](https://auth0.com/docs/get-started/auth0-overview/create-applications) in your Auth0 tenant that is connected to your Vercel project, and 
* Pre-load your [Auth0 application credentials](https://auth0.com/docs/secure/application-credentials) into Vercel, allowing you to skip some of the manual steps in this credentials setup.

To get started, you will need a [project in Vercel](https://vercel.com/docs/projects/overview). You can either import your own project into Vercel or use a Vercel template so you don’t have to start from scratch. For this demo, we’re going to use a simple [B2B SaaS app template](https://vercel.com/templates/next.js/auth0-nextjs-saas-starter) (learn more [here](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/)). Before starting, you'll want to make sure to deploy the template in Vercel.

### Add the integration to your project

_The following steps are based on an example flow. Refer to [docs](https://a0.to/auth0-vercel-docs) for more information._

1.  Open the [Auth0 integration](https://vercel.com/integrations/auth0) in Vercel.
2.  Select a Vercel team and the Vercel project that this integration will have access to. _Note: At this time, the integration is limited to one project per Vercel team._
3.  Click Install.

![integration](https://images.ctfassets.net/23aumh6u8s0i/14eBngE6fGo3LLYmsazyej/fef2739f60c10d8e4621820cd1c6d53e/Uploaded_from_New_Auth0_Integration_for_Vercel__Available_Now)

4. Log into Auth0 and select the Auth0 tenant you would like to use.

![integration](https://images.ctfassets.net/23aumh6u8s0i/2NeRwaR38HOAJp0CMRSULh/05375ed30bcb3404effd26bfd07a3b16/Uploaded_from_New_Auth0_Integration_for_Vercel__Available_Now)

5.  Click Accept.
6.  Select and confirm the Vercel project that you would like to integrate with Auth0. This will create an Application in your Auth0 tenant with the same name, which you can find at [Auth0 Dashboard > Applications](https://manage.auth0.com/#/applications).

![Vercel](https://images.ctfassets.net/23aumh6u8s0i/6fBKpsGXChFuoVC03SDnmH/5727eea8b7d271548da59c1f35f834a1/Uploaded_from_New_Auth0_Integration_for_Vercel__Available_Now)

It’s that simple! You can confirm by navigating to your project’s “Environment Variables” within Vercel (Select project > Settings > Environment Variables), where you will find your [Auth0 application credentials](https://auth0.com/docs/secure/application-credentials).

> If you have any technical questions, refer to [our documentation](https://a0.to/auth0-vercel-docs).

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>NOTE:</strong><br><br>
  As of 7/18/2024, this integration only works with production environment Vercel projects and only supports <b>Next.js apps using the latest version of the Auth0 SDK</b>.</b><br> 
</div>

### It’s time to start leveraging all of Auth0’s capabilities

Any changes we make to our Application within Auth0 will be reflected in the identity flow of our Vercel project and vice versa. For example, let’s create an [Organization](https://auth0.com/docs/manage-users/organizations) in the B2B app we deployed earlier.

![Auth0](https://images.ctfassets.net/23aumh6u8s0i/5LENP3xOgPvQeLxcSNT4Qv/0584f5239dfb2247764a60f27a35bfff/Uploaded_from_New_Auth0_Integration_for_Vercel__Available_Now)

This Organization automatically appears in our Auth0 tenant, and we can customize its settings and branding within Auth0. Let’s add a logo!

![Auth0](https://images.ctfassets.net/23aumh6u8s0i/1gdO1eHhlfdkYEK51Kzmzn/08dc06a7e809f9501939ee22252f7b24/Uploaded_from_New_Auth0_Integration_for_Vercel__Available_Now)

## Have Questions? 

**We want to hear from you! Join our AMA on Aug 8, 2024**

Deploying your app quickly and securely with Auth0 and Vercel just became easier and faster. This is the first version of this integration, and we’re always looking for ways to improve. Join us for an online Ask Me Anything event in the Auth0 Community on August 8. This is your chance to share your questions, feedback, and ideas of what you’d like to see in the future. Engage with our product experts [here](https://community.auth0.com/t/auth0-community-ask-me-anything-integrating-auth0-within-the-vercel-marketplace/136388).

Happy authenticating!


New Auth0 Integration for Vercel: Available Now

ryan cobb

As a patent attorney, I thoroughly enjoy providing counsel relating to the intersection between technology and law. In my current role as the IP counsel for Okta, I advise the company on a all IP matters (including supporting various roles including product, employment, M&A, Okta Ventures, and commercial legal) and help create and manage policies and workflows to enable the business and engineering teams to succeed in the marketplace.

Director, IP Counsel

Ryan Cobb

Developers contributing to Auth0 and Okta projects are provided with a simple way to complete our industry-standard agreement in just a few clicks

We’re going to soon be implementing a Contributor License Agreement (CLA for short) on our open source projects to allow us to continue providing as many open source offerings as we can. 

What’s a CLA, you may be asking? Well, in short, it provides licenses to us and the rest of the community to use the Intellectual Property (IP) you create when you contribute to one or more of our open source projects. But more on the nuts and bolts of that later… 

Why are we doing a CLA now? As we grow, we increasingly see a need to protect our open-source projects at Auth0 and Okta so that we can freely accept contributions and our projects can grow. Additionally, the CLA process at Okta was cumbersome, and we wanted to relax that, so we decided to use CLA Assistant to streamline the signing process for our fantastic community of contributors. 

To create our CLA, we looked around the industry and based our CLA on similar language found in those from the [Apache Foundation](https://www.apache.org/licenses/icla.pdf), [.NET Foundation](https://github.com/dotnet-foundation/foundation/blob/master/guidance/net-foundation-contribution-license-agreement.pdf), [CNCF](https://github.com/cncf/cla/blob/master/individual-cla.pdf), [Google](https://cla.developers.google.com/about/google-individual?csw=1), the [Eclipse Foundation](https://eclipse.org/legal/ECA.php), and [Salesforce](https://cla.salesforce.com/sign-cla), to name a few. You can check out the text of our CLA [here](https://cdn.auth0.com/blog/okta_cla.pdf). If you’ve signed a CLA with Okta in the past, we’re going to ask you to sign a new one via the CLA Assistant (don’t worry… you don’t need to print anything out… you just sign right in Github!). This way, we have all the agreements in the same place and organized by your Github handle. It’s just a few clicks! 

If you want to contribute to one or more of our Open Source projects, what it means to you is: 

* License grant - you grant a copyright and patent license to your contribution so that others using the open-source project can use it without fear of infringement issues. 
* We ask that you represent that the contributions are yours to be made, and you can grant the associated rights to those contributions. 
* We don’t expect you to provide any support for your work unless you want to. 
* The agreement is retroactive to cover your past contributions to ensure we have the most up-to-date protections. 
* Suppose you’ve made contributions in the past but don’t want to sign our CLA, no problem. You don’t need to sign it for any of your past work. But, if you want to make contributions from now on, we will ask you to sign the CLA so that we can make sure we continue offering our best to the community. 

We hope these changes will make the experience of contributing to our Open Source projects better, more straightforward, and safer for everyone. If you have any questions or concerns on this, please reach out to our developer forum, where we will do our best to get you the answers and address your needs. Thank you for your past and future contributions! We appreciate them and look forward to continuing building together!

<include src="asides/AboutAuth0" />

Scaling Our Open Source Projects: Implementing a Contributor License Agreement

philippederyck

Philippe De Ryck helps developers protect companies through better web security. His Ph.D. in web security from KU Leuven lies at the basis of his exceptional knowledge of the security landscape. As the founder of Pragmatic Web Security, Philippe delivers security training and security consulting to companies worldwide. His online course platform allows anyone to learn complex security topics at their own pace. Philippe is a Google Developer Expert and an Auth0 Ambassador/Expert for his community contributions on the security of web applications and APIs.

Web Security Expert, Founder of Pragmatic Web Security

Philippe De Ryck

Single Page Applications clash with modern CSP features. In this article, we discuss concrete strategies for securing SPAs with CSP.

The recommended best practice for modern CSP policies relies on hashes, nonces, and `'strict-dynamic'`. Unfortunately, these features conflict with modern SPAs. This article proposes three concrete strategies to deploy secure CSP policies for SPAs. The first relies on a simple policy allowing `'self'`, which is acceptable under certain circumstances. The second strategy enables CSP hashes by rewriting the main page to use a script loader. The third strategy inserts nonces into a dynamically served main page.

## Recapping CSP

The [first article in this series](https://auth0.com/blog/defending-against-xss-with-csp/) offered an in-depth look at using CSP as a second line of defense against XSS attacks. 

We covered the configuration of CSP using URL-based entries but also [highlighted why such policies are often insecure](https://auth0.com/blog/defending-against-xss-with-csp/#CSP-is-Dead--Long-Live-CSP). In response, we discussed [Google's "universal CSP policy"](https://auth0.com/blog/defending-against-xss-with-csp/#Google-s-Universal-CSP-Policy), shown below, which offers an excellent trade-off between security and complexity: 

```
Content-Security-Policy: 
  script-src 'report-sample' 'nonce-3YCIqzKGd5cxaIoTibrW/A' 'unsafe-inline'
             'strict-dynamic' https: http: 'unsafe-eval';
  object-src 'none';
  base-uri 'self';
  report-uri /webchat/_/cspreport
```

This policy relies on nonces to identify an initial set of legitimate script blocks and script files in the page. Once these scripts execute, they can rely on the automatic trust propagation mechanism of `'strict-dynamic'` to load additional scripts.

Unfortunately, this type of policy does not work well with Single Page Applications, as we pointed out in the [conclusion of the first article](https://auth0.com/blog/defending-against-xss-with-csp/#Using-CSP-with-SPAs).

So, what is up with that? Let's take a look at the challenges of configuring CSP in SPAs and discuss a couple of solutions.

## The Challenges with SPAs

Single Page Applications load a single `index.html`, which then bootstraps the necessary JavaScript code to launch the application. The code snippet below shows the `index.html` page of an Angular application:

```html
<!doctype html>
<html lang="en">
<head>
  ...
</head>
<body>
  <app-root></app-root>
  <script src="runtime.7b63b9fd40098a2e8207.js" defer></script>
  <script src="polyfills.00096ed7d93ed26ee6df.js" defer></script>
  <script src="main.8e56a2a77fee2657fb91.js" defer></script>
</body>
</html>
```

To deploy CSP in a SPA, we first have to tell the browser that the application's JavaScript bundle is a legitimate resource that can be loaded. In the snippet above, the bundle consists of three separate JavaScript files.

One way to do that is by approving scripts coming from the application's origin (`https://example.com`). A policy with a `script-src https://example.com` directive would allow the loading of these files.

Unfortunately, as we discussed in the [previous article](https://auth0.com/blog/defending-against-xss-with-csp/), such URL-based policies are often insecure and are deprecated. Additionally, URL-based expressions cannot be used together with `'strict-dynamic'`, which prevents the use of automatic trust propagation.

One alternative is the use of hashes, a CSP Level 2 feature. However, the application's JavaScript bundle is hosted as a remote file, and hashes only work on inline code blocks. So CSP hashes are not compatible with SPAs.

CSP Level 2 also supports nonces, which are compatible with the loading of remote resources. However, [one requirement for nonces](https://auth0.com/blog/defending-against-xss-with-csp/#CSP-Level-2) is that they are unique on every page load. In essence, this means that the server has to inject a fresh nonce every time it serves a page. Doing so is easy for dynamic server-side applications but not very compatible with serving a static `index.html` file for a SPA. So nonces are also not compatible with SPAs.

With both hashes and nonces out, there is no straightforward way for SPAs to use modern CSP policies. Additionally, they are incapable of using `'strict-dynamic'` for loading additional scripts. The lack of support for `'strict-dynamic'` makes it impossible to reliably incorporate third-party components such as a Twitter timeline.

Right about now, I'm sure you're somewhat disappointed with CSP, and righteously so. But don't worry, we're only getting started. Let's take a look at three concrete strategies to implement CSP in a SPA.

## Keep It Simple

The first strategy for enabling CSP in SPAs is straightforward. If the SPA only needs to load its application bundle and no third-party resources, the following CSP policy could be a very simple solution:

```
script-src 'self'
```

This policy allows the application to load JavaScript files from its own origin. Such a policy suffices to load all of the additional resources of an isolated, self-contained application. You will often encounter such applications in enterprise settings, where the dynamic integration of remote components is less common.

But weren't URL-based policies ineffective and open to bypasses?

Yes, they are, under the right circumstances. [The paper](https://research.google/pubs/pub45542/) that described numerous bypass attacks against CSP outlines a few scenarios where approving `'self'` is problematic. For example, CSP can be bypassed if ...

* The application's origin also hosts vulnerable libraries
* The application's origin also hosts JSONP endpoints
* The application's origin hosts untrusted files uploaded by users

However, these threats are not an issue if the application's origin contains nothing else but the statically deployed application bundle. And if there are no bypasses, this policy is still considered secure. 

> To summarize, if you're building an isolated SPA with nothing else running in the same origin, this policy is a straightforward way to deploy CSP.

However, if you rely on third-party components, you will likely need to support `'strict-dynamic'`. In that case, you can rely on one of the following two strategies.

## Using `'strict-dynamic'` with Hashes

When a policy is configured with `'strict-dynamic'`, all script code approved by a hash or a nonce is allowed to load additional dependencies. This mechanism is extremely useful to allow a third-party component to load additional code or to enable lazy-loading of application components.

Unfortunately, `'strict-dynamic'` causes browsers to ignore URL-based entries, so it cannot be used in conjunction with `'self'`. This means that when we enable `'strict-dynamic'`, we have to find a different way to allow the loading of the application's bundle. 

Loading the bundle with hashes is not an option because hashes cannot be used with remote code files. Instead, we can modify the `index.html` file to include an inline code block, which we can approve with a hash. This inline code block contains a script loader, which uses proper DOM APIs to load additional script code. This behavior is automatically approved by having `'strict-dynamic'` in the policy. 

The code snippets below show the modified `index.html` of an Angular application and the corresponding CSP policy. The HTML page contains two code blocks: The script loader and the code for loading a Twitter timeline. The corresponding CSP policy approves both blocks with a hash:

```html
<!doctype html>
<html lang="en">
<head>
  ...
</head>
<body>
  <app-root></app-root>
  <script>
    let scripts = ["runtime.7b63b9fd40098a2e8207.js", "polyfills.00096ed7d93ed26ee6df.js", "main.8e56a2a77fee2657fb91.js"];
    scripts.forEach(function(scriptUrl) {
      var s = document.createElement('script');
      s.src = scriptUrl;
      s.async = false; // preserve execution order.
      document.body.appendChild(s);
    });
  </script>
  <script>
    window.twttr = (function(d, s, id) {
      ...
    }(document, "script", "twitter-wjs"));
  </script>
</body>
</html> 
```

```
Content-Security-Policy: script-src 
  'sha256-qaOxCJong9pt6ICami7oNScwNCv2sn3HUTzbEaQ3vrU=' 
  'sha256-BYW1ZgvEbfyQi82B604a0EdxK+Od5iqb/I2hgknBhiw='
  'strict-dynamic'
```

This workaround is not pretty but quite effective: It enables a modern CSP policy on a statically deployed SPA. At the time of writing, the [strict-csp](https://www.npmjs.com/package/strict-csp) package offers experimental support for transforming any HTML file to use a script loader as described here. This package is also available as a [webpack plugin](https://www.npmjs.com/package/strict-csp-html-webpack-plugin). Of course, you can also perform this task in a more manual fashion.

> To summarize, adding an inline script loader enables the use of hashes and `'strict-dynamic'`.

Finally, note that CSP Level 3 may support the use of hashes for remote code files. However, at the time of writing, (widespread) support for that feature is still far off.

## Using `'strict-dynamic'` with Nonces

Nonces are a more flexible alternative to hashes, as they can also be used on remote script files. Nonces are also quite compatible with `'strict-dynamic'` but must be unique on every page load. Unfortunately, that requirement clashes with a statically deployed `index.html`.

To enable the use of nonces in a SPA, we have to serve our `index.html` dynamically to insert a fresh nonce in each response. This process sounds complicated but is not that difficult in practice.

The code example below shows a minimal NodeJS Express server that dynamically serves our main Angular application file. The Express server uses the [express-csp-header](https://www.npmjs.com/package/express-csp-header) middleware to configure a policy and handle nonce generation. The nonce is passed along to the view rendering engine, which inserts it into the page. The modified `index.html`, now stored as `index.ejs`, is included below:

```javascript
const express = require("express");
const { expressCspHeader, NONCE } = require('express-csp-header');

const app = express();
const port = 3000;

app.set('view engine', 'ejs');

 app.use(expressCspHeader({
   directives: {
       "script-src": [NONCE, "'strict-dynamic'"]
   }
}));

// Rewrite index.html
app.get("/", (req, res) => {
  res.render(`views/index`, { nonce: req.nonce });
})

app.listen(port, () => {});
```

```html
<!doctype html>
<html lang="en">
<head>
  ...
</head>
<body>
  <app-root></app-root>
  <script nonce="<%= nonce %>" src="runtime.7b63b9fd40098a2e8207.js" defer></script>
  <script nonce="<%= nonce %>" src="polyfills.00096ed7d93ed26ee6df.js" defer></script>
  <script nonce="<%= nonce %>" src="main.8e56a2a77fee2657fb91.js" defer></script>

  
  <script nonce="<%= nonce %>">
    window.twttr = (function(d, s, id) {
      ...
    }(document, "script", "twitter-wjs"));
  </script>
</body>
</html>
```

At first glance, running a dynamic server for serving a SPA seems quite complicated. However, if you take a closer look, the Express server is quite simple. Additionally, it is completely stateless, making it easy to deploy as a stateless function on various cloud platforms. 

Note that only the main HTML file needs to be served dynamically. All other resources, such as JS or CSS files, can still be served statically.

>  To summarize, serving `index.html` dynamically enables the use of nonces and `'strict-dynamic`'.

<include src="ebook-ads/WebSecurity" />

## Overview of CSP for SPAs

In a nutshell, deploying modern CSP policies with SPAs is perfectly feasible, albeit with a bit more effort than you would expect. 

In this article, we covered two scenarios: isolated applications and more complex applications with dynamic code loading. We recap our recommendations for both scenarios below.

### Isolated applications without third-party components

Use a simple `'self'` policy that approves the application's origin. Note that this policy is only secure if nothing else is hosted in the application's origin.

### Applications relying on third-party components

To enable the use of `'strict-dynamic'`, initial scripts must be approved with a hash or a nonce. To use hashes, the SPA's main page has to be rewritten at build time, but can be served statically. To use nonces, the SPA's main page requires slight modifications at build time and has to be dynamically served by a web server.

<include src="SignupCTA" text="Try out the most powerful authentication platform for free." linkText="Get started →" />

## Coming Up Next

I know you're excited to get started. But before you dive into CSP yourself, take a look at the next article in this series, where we offer practical tips and tricks for deploying CSP.

Deploying CSP in Single Page Applications

Tyler works as a developer advocate engineer at Auth0. He's worked as an engineer at small to enterprise level companies and loves everything about tech. You'll frequently find him ether out with his family, playing sports, or coding something. He's also an instructor on <a target='_blank' rel='noopener noreferrer' href='https://egghead.io'><strong><b>egghead.io</b></strong></a>, and his profile is online at <a target='_blank' rel='noopener noreferrer' href='https://tylerclark.dev'><strong><b>tylerclark.dev</b></strong></a>.

william_johnson

  Will Johnson is a Developer Advocate at Auth0. He loves teaching topics in a digestible way to empower more developers. He writes blog posts, records screencasts, and writes eBooks to help developers. He's also an instructor on <a target='_blank' rel='noopener noreferrer' href='https://egghead.io'><strong><b>egghead.io</b></strong></a>.


Developer Advocate

Will Johnson

Easily add custom identity functionality to your application with Auth0 Actions

At Auth0, we believe that extensibility is one of our most important product features.

Identity for one customer is not always the same thing for the next. Every customer has specific needs, and a vast majority want to customize our core product to solve their requirements. We are committed to continually looking for ways to enhance our product capability to answer this call.

## Answering the Call

Because every project has a unique use case, we’ve learned over the years that sometimes, just simply building features into our core product is not the right approach. Instead, we are continuously brainstorming new tools that will allow you to customize your identity solution as needed.

[Auth0 Rules](https://auth0.com/docs/rules) was our first publicly available tool that looked to answer extensibility needs. Rules are serverless code blocks that can be customized to extend Auth0's core capabilities.

They execute after authentication but before identity tokens are issued. Our documentation offers a great list of [Rule templates](https://auth0.com/docs/rules/examples) that make it easy to tackle common scenarios out of the box. They can be chained together for modular coding and turned off individually.

Rules are powerful and solve many authentication use cases. We learned through iteration that customers want customization capabilities beyond the login flow.

In response to this learning, we introduced [Auth0 Hooks](https://auth0.com/docs/hooks).

Hooks allow custom behavior using a similar custom code setup as Rules. However, they can be executed against several extensibility points. This includes the client credentials exchange as well as pre and post-registration.

Through several learning iterations, we discovered that even though Hooks can run on more extensibility points than Rules, customers want even more capability from our extensibility platform.

That is why we are excited to announce our next-gen extensibility platform &mdash; [**Auth0 Actions**](https://auth0.com/actions)!

## What Are Auth0 Actions?

Actions are just another tool in your identity solution toolbelt to meet your application needs.

**Actions are functional services that fire during specific events across multiple identity flows.**

This behavior works as a trigger system. The triggers that kick off an Action are extensibility points such as post-login or client credential exchange. The Actions platform is designed for Auth0 to continuously add additional triggers as our core product develops.

![Actions Flow Editor View](https://images.ctfassets.net/23aumh6u8s0i/40Ke9dC8zYj95UqqeT5gsl/f1c699b8fd452749df02f7e0eabc6c86/flow-editor)


## Action Features

The Actions platform comes with:

✋ **Drag N Drop Functionality** &mdash; The flow editor lets you visually build custom workflows with drag and drop Action blocks for complete control.

💻 **Monaco Code Editor with Quick-hints** &mdash; Designed with developers in mind, you can easily write JavaScript functions with validation, intelligent code completion, and type hints.

You can also securely store and use secrets within your custom functions. Once they are saved, they cannot be read in plain text in the code again.

We have also improved the functionality of your code by allowing access to the entire library of NPM packages and modules.

🏢 **Serverless (Function as a Service, FaaS) Environment** &mdash; We host your custom Action functions and process them when desired. The functions are stored and run on our own infrastructure. This improves overall performance and security for our customers.

💾 **Version Control** &mdash; Everything you love about Git and version control is now available for your custom Actions. You can store a history of individual Action changes and the power to revert back to previous versions as needed.

📁 **Pre-Production Testing** &mdash; Outside of Actions, custom extensible code cannot be tested unless rolled to your production environment. We are happy to announce that with Actions, your personal Actions can be drafted, reviewed, and tested before deploying into production

🐛 **Debugging** &mdash; Nothing is worse than getting an error and not having the ability to track down the problem. Actions provide the ability to determine causality by tracking state changes.

> Note: If you are a pro user wondering how this affects Rules and Hooks, don’t worry, as Actions will function separately.

We want to win you over with Actions!

## Create Your First Auth0 Action

Let’s walk through creating your first Action! We'll create an action that will limit access to your application to only Monday through Friday.

Login to your [Auth0 account](https://auth0.com/auth/login). If you don't have one, <a href="https://auth0.com/signup"  data-amp-replace="CLIENT_ID"  data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)"> you can get it for free</a>. In the left sidebar, there's a section titled “Actions.” Click on that. You’ll see two subcategories, “Flows” and “Library.” Click **Flows**.


<img class="img-responsive" src="https://images.ctfassets.net/23aumh6u8s0i/WwtSYEr7NC3sG0hEaHCIC/5100e0b44cb56f6c27fc488a0f60c047/actions-side-menu.png" alt="Dashboard Side Navbar" style="width:50%;margin:auto;"/>

Flows represent a high-level operation within Auth0. The current flows you can add Actions to are “Login,” “Machine to Machine," "Pre User Registration," "Post User Registration," Post Change Password," and "Send Phone Message." For this example, click **Login**.

![Auth0 Actions Choose Flow page](https://images.ctfassets.net/23aumh6u8s0i/p9AvhsMphPqG3GNZlrhhV/e372f5fa71e5450c5aa1dcb98d1402f9/choose_flow.png)

Once you click on **Login**, you should see the following page:

![Flow Editor View](https://images.ctfassets.net/23aumh6u8s0i/6o7moxnQ43hcRSITcMBnYL/88cb46f824ff5fa38ff133abbcd4072c/flow_editor.png)

This is the flow editor. It shows the entire authentication flow for your logging in. You get drag and drop functionality to customize the flow. If your solution has any Rules already set up, you will see them in this view. Any Rules that are defined will be triggered first, and then they will flow into your Actions.

In the top right corner of this view there is a small question mark icon. Clicking this will show a pop-over walkthrough of this view.

Click on the **+** option on the right side, then click **Build Custom** on the pop-in menu.

On the "Create Action" menu, name this Action “Weekdays Only” and click **Create**.

Now, we're in the new and improved Actions code editor, where we can customize our new "Weekdays Only" action.

![Actions Code Editor](https://images.ctfassets.net/23aumh6u8s0i/7ebjO9pO2KJGC0v4efvcT0/12c28949281e6462bc13cd0b76313cc6/code_editor.png)

On the upper right side, we have buttons for "Version history," "Save Draft," and "Deploy."

Unlike with Rules and Hooks, the code editor holistically supports:

- Testing
- Secret management
- Virtually any NPM module
- Linting
- Quick hints

Also, `async` / `await` is set up by default, so you do not need to use callbacks.

In order to see the custom hint functionality, press `CMD` + `space` (`CTRL` + `space` on Windows). Also, by simply hovering over objects such as `event` and `api,` you will see their documentation in a pop-up.

Notice on the left side of the editor is a couple of icons. The play icon is how we can test our Action before deploying it; more on that in a little bit. 

The key icon is how we can add and use secrets in our Actions. For example, when working with APIs, [such as the Slack API](https://auth0.com/blog/send-slack-message-after-sign-up-with-auth0-actions/), we want to make sure we do not expose any API keys accidentally. This is where we can store it once, keep it secure, and reference it in our Actions editor.

Finally, the last box icon is where you add NPM modules in our Actions.

### Write custom code for Actions

Let’s write the code for our Action. We will write an Action that restricts access to the application only during weekdays after logging in.

The code editor has the async JavaScript method `onExecutePostLogin` pre-populated. Any code we write in this function will run after a user logs in.

By default, Actions apply to all applications in your Auth0 tenant.

First, we'll create a variable called `dayOfWeek` and set it to the return value of `new Day.getDay()`. 

The `getDay()` method returns the day of the week according to local time represented by a number (0 = Sunday, 1 = Monday, etc.)

```js
exports.onExecutePostLogin = async (event, api) => {
    const dayOfWeek = new Date().getDay();
};
```

Let's create an `if` statement to check which day of the week our user is logging in on. We'll check if our `dayOfWeek` variable is 0 (Sunday) or 6 (Saturday)

If `dayOfWeek` is equal to 0 or 6, we'll deny the user access with the `api` object with `api.access.deny` and pass in the string "This app is only available during the week."

> Learn more about the API object by [reading the Auh0 Actions API object docs](https://auth0.com/docs/customize/actions/triggers/post-login/api-object)

```js
 exports.onExecutePostLogin = async (event, api) => {
     const dayOfWeek = new Date().getDay();
     
     if (dayOfWeek === 0 || dayOfWeek === 6) {
       api.access.deny("This app is only available during the week.");
     }
};
```

> If you're logging in during the week and want to see this message, change the number in the `if` statement to match what day of the week it is.

### Test Auth0 Actions

We can test it before pushing it to production to ensure this Actions code works. We do this by pressing the play icon on the left sidebar and clicking "Run" at the bottom. This will run our code and display the output on the bottom of the editor. We also can test different scenarios by updating the test data.

Click **Save draft**. We can also revert this action to a previously saved or deployed version by pressing the "Version Control" button on the top of this page. We would see all saved versions with a push-button revert process.

Now that we’ve successfully tested our Action, we can deploy it by clicking on **Deploy**. If an action is not deployed, it does not appear in our flow Action list.

### Add Action to login flow

Now, let’s actually add the Action just created to our flow. Click on the “Flows” tab on the left side navigation and click "Login."

This will take us back to our flow builder, and our "Weekdays Only" Action is now available. Drag the Action and drop it between "Start" and "Complete" in the login flow.

Once we’ve added our Action to the Flow, click **Save**, then **Apply**.

![Flow Editor View with Action](https://images.ctfassets.net/23aumh6u8s0i/7hPHunduk20gvFZ0eeD6LO/7783f7dd4b7270ff2a64b90a87042d74/flow_added.png)

Now let’s try it out.

You can give this a quick test drive without running your full app, by going to the right side menu in the Auth0 dashboard and clicking **Getting Started**. On the _Getting Started_ page, click **Try it out** in the _Try your Login box_ section.

![Auth0 Dashboard Getting Started Page](https://images.ctfassets.net/23aumh6u8s0i/2hH0xeMqhhrXVWg7KzQB3E/827ff6cd4a4124c9fea9aaa1c1b7acca/try_it_out.png)

After you click **Try it out**, you'll be brought to a login screen where you can enter an email and password. Proceed to log in. Once the credentials are entered, you'll see a _Bummer! Something failed_ page with the error `"access_denied"` and an error description of `"This app is only available during the week." `

![Bummer! something failed page](https://images.ctfassets.net/23aumh6u8s0i/6NiXpqFMq2wscQhqUGgR9z/6e3ea82c5f291b0eb3baac5dff82fcd0/failed.png)

And that's all! 

With Auth0 Actions, we were able to:

- Quickly create a reusable custom Action with a built-in user-friendly code editor
- Test, save, and rollback to different versions of the flow
- Attach it to a trigger

Go ahead and add some on your own and let us know what you think in the comments below!

> There are some limits to using Auth0 Actions. To view the most up to date limitations, head over to the [Actions docs](https://auth0.com/docs/customize/actions/limitations).


## What's Coming?

Actions will be an iterative platform that we will continually improve upon. Our vision for Actions includes expanding the number of triggers (extensibility points) you can use to customize Auth0 and introducing new ways to reuse code, so you don’t have to keep writing and maintaining large amounts of custom code.

We'd love to hear what you think about Actions. Be sure to comment **let us know of any future integrations you'd like to see**.

This is just the beginning of Auth0 Actions, and we can't wait to see where we can take it with your feedback!

Introducing Auth0 Actions

Learn how to create a new custom action that will add a custom claim to your Auth0-issued ID Token

Did you know that you can use Actions to customize the user ID token? Well, if you need to add custom claims to your users' ID tokens, you came to the right place! With this tutorial, you'll learn how to use the power of Actions to include custom claims to users' ID tokens.

If you prefer, you can also watch the videos below with me explaining to add custom claims to your users' ID tokens using Actions 👇!

<AmpContent>
<amp-youtube
    data-videoid="DpGRU9mttDw"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/DpGRU9mttDw' frameborder='0' allowfullscreen></iframe></div>

</NonAmpContent>

## Auth0 Issued ID Tokens and Custom Claims

[ID Tokens](https://auth0.com/docs/secure/tokens/id-tokens) are commonly used in token-based authentication to pass user information to a client application. At Auth0, ID Tokens follow the [JSON Web Token (JWT)](https://auth0.com/docs/secure/tokens/json-web-tokens) standard; this means that all ID tokens Auth0 issues are JWTs.

Claims are pieces of information about a given subject. In the case of ID Tokens, claims will contain information about the user, such as the user's name. Using custom claims can give your ID token extra information that can improve your application, for example, storing a user ID from a third party or system.

In this example, you'll see how to use Actions to make a request to an external API and store back the obtained information as a custom claim to ID token payload to be used on the sample application.

## The Sample Application

Before you begin, you will need a sample code to customize.

>  For this blog post, you will use the React single-page application (SPA) sample. Keep in mind that <u>you can use what you'll learn here and apply it to your app no matter what language or framework it uses</u>.

You can clone the sample application from GitHub with the following command:

```bash
git clone https://github.com/auth0-blog/assign-random-dog.git
```

After the cloning finishes, follow the [README.md file](https://github.com/auth0-blog/assign-random-dog/blob/main/README.md) instructions to configure it to use Auth0. You'll need an Auth0 account, and if you don't have it, <a href="https://auth0.com/signup"  data-amp-replace="CLIENT_ID"  data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">you can get one for free here</a>.

After configuring the sample application, you can go into the app root folder and run it with the following command:

```bash
npm start
```

Open your browser and access [https://localhost:3000/](https://localhost:3000/). You should get the following page:

![Sample app home page](https://images.ctfassets.net/23aumh6u8s0i/1KGVVbq1ML8VZkXFhPgAWJ/205d7b2cac63ab7c718aa74d2c1d056a/starter-react-app)

## What Are Auth0 Actions?

If you are new to this neck of the woods, this might be your first time hearing about Actions, don't worry; I got you covered, but if you are familiar with Actions, feel free to jump to the next section.

As mentioned, you will use Actions to add a custom claim to your users' ID tokens, and Actions are the new way to extend Auth0 functionalities. They are JavaScript functions running in a Node.js environment executed when specific events happen in some internal Auth0 flows.

 For example, Actions can be triggered when a user authenticates or changes their password. Today, you'll build an Action that will run after a user logs into your application, and as a result, the ID token will have a new custom claim. You can imagine this process as shown in the image below:

![Post login registration Auth0 Action](https://images.ctfassets.net/23aumh6u8s0i/3bMftYmivpwjXYRrQCS1fo/575d293ccfe8dfdada67eea035f85084/login-flow-with-assign-random-dog-action.png)

The Action code itself is implemented inside the Auth0 Dashboard, with an in-browser editor that allows you to write the code and use a prepared test environment to test your code. Also, you can deploy the code and use the versioning tool, but you will see more of that later.

>  You can check out these blog posts for [a quick introduction to Auth0 Actions](https://auth0.com/blog/introducing-auth0-actions/) and how they [compare with the deprecated Rules and Hooks](https://auth0.com/blog/actions-now-generally-available/).

## Implementing The Assign Random Dog Action

Having fun while learning new things makes everybody's life easier! For your custom claim, you will call an external API to grab a random dog picture to be displayed every time the user navigates to their user profile. Right now, your profile page looks like this:

![image of the profile page for the react sample showing the id token](https://images.ctfassets.net/23aumh6u8s0i/6aJLZd3bQM1upkXkszdidq/bfe3e6c3b4d444c7e6caf93f81261668/profle-page-react-sample-spa-showing-id-token-of-the-user.png)

And you want to make it look like this:

![image of the profile page for the react sample showing the id token and a random dog picture](https://images.ctfassets.net/23aumh6u8s0i/75eMhiO9yzow8C9Z3b2hor/006aceb5662bb41d70f0e0f4e07a98a8/updated-profile-page-to-display-the-dog-picture.png)

The API you will use is the [Dog API](https://dog.ceo/dog-api), which claims to be _"the internet's biggest collection of open source dog pictures."_ This API has a "random" endpoint that gives back JSON containing the URL for a dog picture it chooses randomly from its database. That URL will be the value of your custom claim.

Let's go back to the [Auth0 Dashboard](https://manage.auth0.). Choose _Actions_ on the left-hand side menu, and you should see two options there:

1. **Flows:** the processes that can be extended with Actions. Each Flow is made up of one or more triggers and represents the logical pipeline through which information moves during a single point in the Auth0 journey, for example, the _Login_ Flow;
1. **Library:** contains all your Actions. They can be either ready-to-use [Actions built by third parties and published in the Auth0 Marketplace](https://marketplace.auth0.com/features/actions) or custom Actions, like the one we are building today.

So click on _Flows_ and choose the _Login_ flow. This will take you to the following page, where you can see your current login flow. There you will be able to edit the flow and add your custom action:

![image of the page for the login flow where you can adjust the flow and add Actions](https://images.ctfassets.net/23aumh6u8s0i/1fnnTVUuTmerNDjqA0fF9c/aa26492109ec1521e38c5ce0488454ce/login-flow-action-page.png)

On the right-hand side, you'll see the list of your Actions. The ones that come from the marketplace and the custom ones you implement yourself.

![image of the Actions menu on the flow page](https://images.ctfassets.net/23aumh6u8s0i/6wIs79eD5UC4GQwY49JeGQ/632a1db6c9949144157648f6f26af717/actions-menu-on-login-flow-page.png)

Click on the **+** sign button on the top right-hand corner, and you'll see a menu that will either take you to the marketplace if you select _Browse Actions_ or will allow you to create a new Action if you select _Build Custom_. The latter is the option you'll want. It will then display a _Create Action_ form. Now you can give your Action a name that represents what it does. For example, you could use _"Assign random dog"_ to the action you are creating:

![image of the create new action form filled with the assigned new dog name](https://images.ctfassets.net/23aumh6u8s0i/2s1L6MHln402rQRrd7zsIo/776766567106baaee161667655a26331/create-new-action-assign-random-dog.png)

You can keep the default values for the other two fields. These fields define the flow where the action can work, in this case, the _Login Flow_, and which Node.js runtime will be used to run the Action. Click the _Create button_ in the form, this will create your Action, and you will see the in-browser editor.

![image showing the in-browser editor for Actions](https://images.ctfassets.net/23aumh6u8s0i/1Navuh8xu0m94CKGT9Xgz0/a08f24e24f063e3127ba828c841c850c/assign-random-dog-actions-in-browser-editor.png)

Take a closer look and see the editor already has some code and comments to help you write code for your Action. Let's take a moment to understand what it says.

First of all, since you are editing an Action that will run during login, it can be an event that occurs _post login_ or an event that happens after the user _resumes the login after an external redirect_. For this case, you need a _post-login_ event so you can focus on that part of the code copied below:

```javascript
/**
* Handler that will be called during the execution of a PostLogin flow.
*
* @param {Event} event - Details about the user and the context in which they are logging in.
* @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.
*/
exports.onExecutePostLogin = async (event, api) => {
};
```

The function `onExecutePostLogin` receives the `event` and the `api` parameters.

The `event` object carries information about the login context, for example, which authorization was granted to the user while logging in. For more details on this, [refer to the post-login `event` object documentation](https://auth0.com/docs/customize/actions/triggers/post-login/event-object).

The `api` object, on the other hand, has methods for changing the behavior of the flow, like denying access to the app if you want more details on this object [refer to the post-login `api` object documentation](https://auth0.com/docs/customize/actions/triggers/post-login/api-object).

For the Action to work, you will also need to install `axios`, an NPM package that will make the request to the _Dog API_ `random` endpoint. A cool feature of Actions is that you can add almost any NPM package as long as it can be installed without relying on native add-ons. So let's do this first and then go back to the code.

Notice that there are three tabs on the left-hand side of the editor:

- The ▶️ icon: where you can run a test suite to see if your action is performing as expected;
- The 🔑 icon: where you can access the secret storage menu; 
- The 📦 icon: where you can install NPM modules.

Since you need to install `axios` on the environment for your Action to work properly, click on the 📦 icon, and you'll see a sidebar inside the editor with the _Add Module_ button. Click the _Add Module_ button, and you'll see a form where you can put the name of the module you want to add, like this:

![image showing the add module form](https://images.ctfassets.net/23aumh6u8s0i/6Y06KN0mPllDHs7fZ2vMAJ/b4e1bb4112650ed2866a4fdffb445fdd/adding-axios-package-on-actions-modules-page.png)

Now `axios` is available for you to use on your action. If you click the 📦 icon, the modules sidebar will be hidden, and you can go back to full editor space. Now substitute the code in the editor with the following code:

```javascript
exports.onExecutePostLogin = async (event, api) => {
  const axios = require("axios");

  const randomDog = await axios.get("https://dog.ceo/api/breeds/image/random");

  if (event.authorization) {
    api.idToken.setCustomClaim("https://dogfy.com/random_dog", randomDog.data.message);
  }
};
```

Inside the function, the logic is as follows:

1. First, you import the `axios` package into the variable `axios` so you can use it;
1. Second, you make a `GET` request to the `random` endpoint of the Dog API and restore the resulting response in the `randomDog` variable;
1. Finally, if the event is an _authorization_ flow, you use the `api.idToken.setCustomClaim` to create your custom claim.

The third and last step uses the `setCustomClaim` method to create the custom claim and give it the value returned from the Dog API. There are two important things to notice here:

1. The first one is that your custom claim name should always try to avoid clashes with standard claims, one way to achieve this is by using the URI format to name that claim. For example, here, we used `"https://dogfy.com/" + "random_dog"` to set the name of your claim, and the URL doesn't even need to be a real-life URL. [You can read more about naming custom claims here](https://auth0.com/docs/secure/tokens/json-web-tokens/create-namespaced-custom-claims).
2. The second thing to notice is that to access the URL for the dog picture, you use `randomDog.data.message` because the JSON containing the URL is located inside `data` on the response structure.

Now that you've got your code, you can go ahead and click the *Deploy* button on the top left corner, which will save the Action and make it available for use. After deploying your Action, you need to go back to the flow to add it. On the right-hand main menu, choose _Actions_, then _Flows_, and pick the _Login_ flow; now, if you look at your _Add action_ section, and if you click on the _Custom_ tab, you should see your Action in there:

![image of the Add action section showing the action under the Custom tab](https://images.ctfassets.net/23aumh6u8s0i/2niMVNWCOOGLBXX41aBHqf/888096695e7902859ddde3c27af044fe/custom-action-being-displayed-on-add-action-section.png)

With that said, it is time to drag your Action, drop it on the Flow, and don't forget to click _Apply_ to make your Action part of your _Login_ flow.

![gif showing the drag and drop of the action into the flow and its deployment](https://images.ctfassets.net/23aumh6u8s0i/3uf5YKYg6kbcnbNgeTPetO/553b988408dc4063a4484f787eaf44b5/drag-and-drop-new-action-into-the-login-flow.gif)

You can test to see if the change worked by logging out of your application then logging back in once more. You should see on the _Profile_ page that the ID token content was updated and the new custom claim is there:


![image of the profile page for the react sample showing the id token the new custom claim](https://images.ctfassets.net/23aumh6u8s0i/1lDrIOzfo8Mp2nWv9W0I19/34299cfc6cfafe925e2953c94cb789ce/updated-profile-page-react-spa-with-custom-claim.png)

## Updating Your Application to Use the Custom Claim

Now that we have the URL for the dog picture is time to update the profile page to display it. Let's see how to do that.

> Since the sample application is built with React, the steps described in this subsection are strictly related to this library. <u>This step aims to update the profile page to display a cute dog picture</u>, so feel free to adapt this step to your needs.

On the project source code, navigate to the file `Profile.js` inside `src/views` directory. Then add the code highlighted below:

```javascript
import React from "react";
import { Container, Row, Col } from "reactstrap";

import Highlight from "../components/Highlight";
import Loading from "../components/Loading";
import { useAuth0, withAuthenticationRequired } from "@auth0/auth0-react";

export const ProfileComponent = () => {
  // ...existing code...

      <Row>
        <Highlight>{JSON.stringify(user, null, 2)}</Highlight>
      </Row>

    // 👇 new code
    {user["https://dogfy.com/random_dog"] &&  <div style={{textAlign: 'center'}}>
    <h2>Our Doggy!</h2 >
    <img
        src={user["https://dogfy.com/random_dog"]}
        alt="Random dog"
        className="img-fluid profile-picture mb-3 mb-md-0"
      />
    </div>}
    // 👆 new code

    </Container>
  );
};

// ...existing code...
```

This code will add a picture from the ID token to the profile page whenever there is a `"https://dogfy.com/random_dog"` claim. Your page should automatically reload itself and display the current dog picture:

![image showing the new profile page displaying the dog picture](https://images.ctfassets.net/23aumh6u8s0i/75eMhiO9yzow8C9Z3b2hor/006aceb5662bb41d70f0e0f4e07a98a8/updated-profile-page-to-display-the-dog-picture.png)

With that done, your application is ready. 🎉 Congratulations! 

You can check out [the complete code changes, access this link](https://github.com/auth0-blog/assign-random-dog/tree/profile-page-updated) or switch to the branch `profile-page-updated` on your sample app.


## Recap

You just implemented a brand new Action to be used during the Login flow 🎉. Let's recap what you've learned:

1. You set up a SPA using Auth0;
1. You learned what Actions are and how you can use them to expand Auth0's functionalities;
1. You implemented an Action that makes a call to an external API, and that creates a custom claim with data from the response;
1. Finally, you deployed that custom action and updated your app to use the custom claim.

Keep in mind that this was a colorful way to show how you can use Actions to make a call to an external resource and add a custom claim on the user's ID token. Now you can let your imagination fly and use the knowledge you acquired today to add useful information to your user's ID tokens.

Are you ready to add more custom claims to your user's ID tokens? Let me know in the comments 😉.

Adding Custom Claims to ID Tokens with Auth0 Actions

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

How to use HTTP status code in the authorization context? When to use "401 Unauthorized" status code? When to use "403 Forbidden"? Let's try to clarify.

Assume your Web API is protected and a client attempts to access it without the appropriate credentials. How do you deal with this scenario? Most likely, you know you have to return an HTTP status code. But what is the more appropriate one? Should it be `401 Unauthorized` or `403 Forbidden`? Or maybe something else?

As usual, it depends 🙂. It depends on the specific scenario and also on the security level you want to provide. Let's go a little deeper.

If you prefer, you can watch a video on the same topic:

<AmpContent>
<amp-youtube
    data-videoid="WV0cZ65EVig"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>

<NonAmpContent>
<div
  class='embed-container'
  style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;">
    <iframe
      style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"
      src='https://www.youtube.com/embed/WV0cZ65EVig'
      frameborder='0' allowfullscreen>
    </iframe>
</div>
</NonAmpContent>

## Web APIs and HTTP Status Codes

Before going into the specific topic, let's take a quick look at the rationale of HTTP status codes in general. Most Web APIs are inspired by the [REST paradigm](https://en.wikipedia.org/wiki/Representational_state_transfer). Although the vast majority of them [don't actually implement REST](https://dzone.com/articles/please-dont-call-them-restful), they usually follow a few RESTful conventions when it comes to HTTP status codes.

The basic principle behind these conventions is that **a status code returned in a response must make the client aware of what is going on and what the server expects the client to do next**. You can fulfill this principle by giving answers to the following questions:

- Is there a problem or not?
- If there is a problem, on which side is it? On the client or on the server side?
- If there is a problem, what should the client do?

This is a general principle that applies to all the HTTP status codes. For example, if the client receives a `200 OK` status code, it knows there was no problem with its request and expects the requested resource representation in the response's body. If the client receives a `201 Created` status code, it knows there was no problem with its request, but the resource representation is not in the response's body. Similarly, when the client receives a `500 Internal Server Error` status code, it knows that this is a problem on the server side, and the client can't do anything to mitigate it.

In summary, your Web API's response should provide the client with enough information to realize how it can move forward opportunely.

Let's consider the case when a client attempts to call a protected API. If the client provides the appropriate credentials (e.g., a valid [access token](https://auth0.com/docs/security/tokens/access-tokens)), its request is accepted and processed. What happens when the client has no appropriate credentials? What status code should your API return when a request is not legitimate? What information should it return, and how to guarantee the best security experience?

Fortunately, in the [OAuth security context, you have some guidelines](https://datatracker.ietf.org/doc/html/rfc6750). Of course, you can use them even if you don't use [OAuth](https://auth0.com/docs/authorization/protocols/protocol-oauth2) to secure your API.

<include src="TweetQuote" quoteText="The basic principle behind REST status code conventions is that a status code must make the client aware of what is going on and what the server expects the client to do next"/>

## When to Use 400 Bad Request?

Let's start with a simple case: a client calls your protected API, omitting a required parameter. In this case, your API should respond with a `400 Bad Request` status code. In fact, if that parameter is required, your API can't even process the client request. The client's request is malformed.

Your API should return the same status code even when the client provides an unsupported parameter or repeats the same parameter multiple times in its request. In both cases, **the client's request is not as expected and should be refused**.

Following the general principle discussed above, the client should be empowered to understand what to do to fix the problem. So, you should add in your response's body what was wrong with the client's request. You can provide those details in the format you prefer, such as simple text, XML, JSON, etc. However, using a standard format like the one proposed by the [Problem Details for HTTP APIs](https://datatracker.ietf.org/doc/html/rfc7807) specifications would be more appropriate to enable uniform problem management across clients.

For example, if your client calls your API with an empty value for the required `data` parameter, the API could reply with the following response:

```http
HTTP/1.1 400 Bad Request
Content-Type: application/problem+json
Content-Language: en

{
  "type": "https://myapi.com/validation-error",
  "title": "Validation error",
  "detail": "Your request parameters are not valid.",
  "invalid-params": [
    {
      "name": "data",
      "reason": "cannot be blank."
    }
  ]
}
```

## When to Use 401 Unauthorized?

Now, let's assume that the client calls your protected API with a well-formed request but no valid credentials. For example, in the OAuth context, this may fall in one of the following cases:

- An access token is missing.
- An access token is expired, revoked, malformed, or invalid for other reasons.

In both cases, the appropriate status code to reply with is `401 Unauthorized`. In the spirit of mutual collaboration between the client and the API, the response must include a hint on how to obtain such authorization. That comes in the form of the `WWW-Authenticate` header with the specific [authentication scheme](https://www.iana.org/assignments/http-authschemes/http-authschemes.xhtml) to use. For example, in the case of OAuth2, the response should look like the following:

```http
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="example"
```

You have to use the `Bearer` scheme and provide the [`realm` parameter](https://datatracker.ietf.org/doc/html/rfc7235#section-2.2) to indicate the set of resources the API is protecting.

If the client request does not include any access token, demonstrating that it wasn't aware that the API is protected, the API's response should not include any other information.

On the other hand, if the client's request includes an expired access token, the API response could include the reason for the denied access, as shown in the following example:

```http
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="example",
                  error="invalid_token",
                  error_description="The access token expired"
```

## When to Use 403 Forbidden?

Let's explore a different case now. Assume, for example, that your client sends a request to modify a document and provides a valid access token to the API. However, that token doesn't include or imply any permission or scope that allows the client to perform the desired action.

In this case, your API should respond with a `403 Forbidden` status code. With this status code, your API tells the client that the credentials it provided (e.g., the access token) are valid, but it needs appropriate privileges to perform the requested action.

To help the client understand what to do next, your API may include what privileges are needed in its response. For example, according to the [OAuth2 guidelines](https://datatracker.ietf.org/doc/html/rfc6750#section-3.1), your API may include information about the missing scope to access the protected resource.

<include src="SignupCTA" text="Try out the most powerful authentication platform for free." linkText="Get started →" />

## Security Considerations

When you plan how to respond to your client's requests, always keep security in mind.

### How to deal with response details

A primary security concern is to **avoid providing useful information to potential attackers**. In other words, returning detailed information in the API responses to attempts to access protected resources may be a security risk.

For example, suppose your API returns a `401 Unauthorized` status code with an error description like `The access token is expired`. In this case, it gives information about the token itself to a potential attacker. The same happens when your API responds with a `403 Forbidden` status code and reports the missing scope or privilege.

In other words, sharing this information can improve the collaboration between the client and the server, according to the basic principle of the REST paradigm. However, **the same information may be used by malicious attackers to elaborate their attack strategy**.

Since this additional information is optional for both the HTTP specifications and the OAuth2 bearer token guidelines, maybe you should think carefully about sharing it. The basic principle on sharing that additional information should be based on the answer to this question: **how would the client behave any differently if provided with more information?**

For example, in the case of a response with a `401 Unauthorized` status code, does the client's behavior change when it knows that its token is expired or revoked? In any case, it must request a new token. So, adding that information doesn't change the client's behavior.

Different is the case with `403 Forbidden`. By informing your client that it needs a specific permission, your API makes it learn what to do next, i.e., requesting that additional permission. If your API doesn't provide this additional information, it will *behave differently* because it doesn't know what to do to access that resource.

### Don't let the client know...

Now, assume your client attempts to access a resource that it MUST NOT access at all, for example, because it belongs to another user. What status code should your API return? Should it return a `403` or a `401` status code?

You may be tempted to return a `403` status code anyway. But, actually, you can't suggest any missing permission because that client has no way to access that resource. So, the `403` status code gives no actual helpful information. You may think that returning a `401` status code makes sense in this case. After all, the resource belongs to another user, so the request should come from a different user.

However, since that resource shouldn't be reached by the current client, the best option is to hide it. Letting the client (and especially the user behind it) know that resource exists could possibly lead to [Insecure Direct Object References (IDOR)](https://portswigger.net/web-security/access-control/idor), an access control vulnerability based on the knowledge of resources you shouldn't access. Therefore, in these cases, your API should respond with a `404 Not Found` status code. This is an option provided by the [HTTP specification](https://www.rfc-editor.org/rfc/rfc7231#section-6.5.3):

> An origin server that wishes to "hide" the current existence of a  forbidden target resource MAY instead respond with a status code of  404 (Not Found).

For example, this is the strategy adopted by GitHub when you don't have any permission to access a repository. This approach avoids that an attacker attempts to access the resource again with a slightly different strategy.

### How to deal with bad requests

When a client sends a malformed request, you know you should reply with a `400 Bad Request` status code. You may be tempted to analyze the request's correctness before evaluating the client credentials. You shouldn't do this for a few reasons:

- By evaluating the client credentials before the request's validity, you avoid your API processing requests that aren't allowed to be there.
- A potential attacker could figure out how a request should look without being authenticated, even before obtaining or stealing a legitimate access token.

Also, consider that in infrastructures with an API gateway, the client credentials will be evaluated beforehand by the gateway itself, which doesn't know at all what parameters the API is expecting.

> The security measures discussed here must be applied in the production environment. Of course, in the development environment, your API can provide all the information you need to be able to diagnose the causes of an authorization failure.

## Recap

Throughout this article, you learned that:

- `400 Bad Request` is the status code to return when the form of the client request is not as the API expects.
- `401 Unauthorized` is the status code to return when the client provides no credentials or invalid credentials.
- `403 Forbidden` is the status code to return when a client has valid credentials but not enough privileges to perform an action on a resource.

You also learned that some security concerns might arise when your API exposes details that malicious attackers may exploit. In these cases, you may adopt a more restricted strategy by including just the needed details in the response body or even using the `404 Not Found` status code instead of `403 Forbidden` or `401 Unauthorized`.

The following cheat sheet summarizes what you learned:

![4xx HTTP status codes cheat sheet](https://images.ctfassets.net/23aumh6u8s0i/2CSdQcMBYLQv02lalUIIT3/9d4d5695b6b43868c2f01cb1ad043f17/4xx-http-status-code-cheat-sheet.jpg)


Forbidden, Unauthorized, or What Else?

Easily manage the business customers that access your applications



We're very excited to announce a new way to enable businesses and teams to access your applications: **Auth0 Organizations!**

Auth0 is a software-as-a-service product. Like many SaaS platforms, Auth0 can be used by individuals, but more often than not, it is used by teams. When building SaaS, or any B2B application, developers need a way to represent and manage those teams.

Often, SaaS products will have dashboards that allow each of their customers’ administrators to manage their organizations:

- Manage membership and access levels of their team members
- Invite new members with predefined roles
- Connect their identity provider for single sign-on
- Define authentication factors and security policies

We’re forced to build this all from scratch each time we create an application, which cuts into the time we have to build the app itself. We’ve struggled with this at Auth0 when building our applications, like [our Dashboard](https://manage.auth0.com/), and when we speak with engineers and architects that work at our customers’ companies, we’ve heard similar stories.

These problems are common enough to deserve a purpose-built solution, and that is why we built Organizations.

## How Does it Work?

We’re introducing a new “organization” entity that will live in your Auth0 tenant. You can create organizations representing teams, business customers, partner companies, or any logical grouping of users who should have different access to your applications.

![Screenshot of a list of organizations within the Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/62tk5hrj3iPvHwgckwvkDJ/3b549543665a5ec999533d4da0ad52a5/approved-asset-three.jpeg.png)

Using Organizations and New Universal Login, you can configure and customize the log-in experience that end users in these organizations have when accessing your product. You can mix and match your branding with your customers in the login experience and email communications and easily configure federation for your larger customers and partners that need it.

![Side by side view of universal logins](https://images.ctfassets.net/23aumh6u8s0i/2UBgf6RIt2WX6kbToKKzg6/28717eead2542bdd0f7c463f030a72ab/asset-blog-2-APPROVED.png)

You can choose from various methods for membership and access management of the different organizations that access your product:

- Define roles for your applications, then invite users to organizations with those roles predefined. Also, the same user can have different roles in different organizations, so you can model user isolation or cross-organizational access as needed for your app.
- Turn on just-in-time membership so that anyone logging in from a specific federated connection becomes a member of the organization.
- Add members via the Manage Dashboard or API, or expose all of this functionality in your application so that your customers can manage their membership!

![Invite members to organizations and edit authentication of organizations](https://images.ctfassets.net/23aumh6u8s0i/12YZpXmHDIoEGhgHuESANn/3c834b9cee90b16711809f80f45b971b/asset-blog-3-APPROVED.png)

## Let’s Build a SaaS App with Organizations!

<AmpContent>
<amp-youtube
    data-videoid="BcUxeThMq74"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<iframe width="560" height="315" src="https://www.youtube.com/embed/BcUxeThMq74" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
</NonAmpContent>

Before we walk through a demo application utilizing organizations, let’s chat briefly about who the target audience is again. As the title suggests, SaaS (Software as a service) companies provide cloud-based applications that typically charge on a subscription model. Their platforms help other businesses focus on their core product by relieving stress on other business needs. Think about products like Slack or DataDog. When you log in to these platforms, they need to know what company or workspace you belong to before getting you to the correct login flow and, ultimately, the appropriate tenant in their platform.

With businesses as the target customer for SaaS and B2B companies, handling authentication of users within these businesses can be complicated. How are users organized within a specific target business? What about separate branding, access control, and SSO for each business?

Let’s answer these questions with a demo application and Auth0 Organizations!

### Chat0

Introducing our demo app: Chat0, the demo SaaS company that provides state-of-the-art communication services 😀!

![Screenshot of Chat0 dummy app](https://images.ctfassets.net/23aumh6u8s0i/NlvSED8ZuEQz9KtKjMQ1D/134de05a845d028a5696c84b9e0e9332/orgs-overview-2.jpeg.png)

You can try Chat0 yourself by cloning and installing the repo found [here](https://github.com/twclark0/orgs-sample-app).

Once you have this repo cloned to your local machine, navigate into its directory and then run the following commands:

`npm install`

And then

`npm start`

After running this last command, open Chat0 on your browser of choice at `http://localhost:3000/`.

Chat0 is a React single-page web application for this demo, which means that it doesn’t have a back end. With our artificial SaaS company, we invite businesses to sign up for our communication services.

Once businesses have created an account with Chat0, they can send messages (not included in the demo app code) and view stats of their company’s communications.

![Screenshot of the Chat0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/2Ck8zg899VCR0VrTcJBDiR/e15c935d7db75b7d0ff9260b32efb811/chat0-dashboard.jpeg.png)

As you can see above, we want users of a business to see the data after authenticating. However, we want this page to be branded and have data specific to the user’s business/organization. Again, this is similar to the flow you see when you try logging into Slack and DataDog. The result is your company’s or workspace’s brand and data.

So let’s work with a SaaS company (Chat0), add authentication with organization capabilities, brand those two Universal Login experiences, set up individual connections, and invite new users to an organization.

### Set up Auth0 and Configure the React SDK

![Screenshot of Auth0 applications dashboard](https://images.ctfassets.net/23aumh6u8s0i/ECqJSSY7cAaG82huQqHGc/5b064214fb171f3bbf1a3112cd335d92/applictions.png)

You will first need to [sign up for an Auth0](https://a0.to/blog_signup) account if you do not already have one.

Once you’ve signed up for or logged into your account, you’ll land on the dashboard.

Within the left navbar, click on _Applications_ and then _Applications_ again. Press the _Create Application_ button in the top right corner. Choose the Single Page Web Applications option and give it a good name.

After the application is created, the only configuration you need to do is to update three text boxes:

- _Allowed Callback URLs_
- _Allowed Logout URLs_
- _Allowed Web Origins_

We will update these text boxes with `localhost` for local development.

![Screenshot of Auth0 magic mirror application](https://images.ctfassets.net/23aumh6u8s0i/4HphywO1Dwx0bLISHm8kYc/72cc3194241080779688cf8932013621/applicationsettings.jpeg.png)

I filled out those text boxes as follows:

_Allowed Callback URLs_

`http://localhost:3000/`

The above value is the URL that Auth0 can use to redirect your users after they successfully log in.

_Allowed Logout URLs_

`http://localhost:3000/`

The above value is the URL that Auth0 can use to redirect your users after they log out.

_Allowed Web Origins_

`http://localhost:3000/`

Now inside Chat0’s code, we need to update the React SDK provider values with the ones created when we created the new application within Auth0.

On the `AuthWrapper.js` page, we need to update the props provided to the `Auth0Provider` component. We need to update the `domain` and the `clientId` with the _domain_ and _clientId_ shown within the Auth0 Application page we just created.

```javascript
export const AuthWrapper = ({ children }) => {
const currentOrganization = localStorage.getItem("organization_id");
const options = {
domain: "dev-rm3u1yq4.auth0.com",
clientId: "OgdvG5snvJGpeIrW9FKXbB5D9UmSQufP",
redirectUri: window.location.origin,
...(currentOrganization ? { organization: currentOrganization } : null)
};
return <Auth0Provider {...options}>{children}</Auth0Provider>;
};
```

The `redirectUri` value is where you want your application to redirect to when logging out.

The `organization` prop is being conditionally passed depending on if we've stored an organization id within the browser yet. We'll talk more about this after we configure Organizations within this application. So hang tight!

If you want to learn more about the Auth0 React SDK, check out this [video](https://www.youtube.com/watch?v=1rgeO_EbSGg)!

### Brand Your Auth0 Application

Auth0 provides easy customization of your Universal Login. Back within your Auth0 account dashboard, click on _Branding_ and then _Universal Login_. This is the login page that Chat0’s business customers will see when they want to authenticate.

If you scroll down to the bottom of the page, you can provide a link to your SaaS company’s logo and colors. As you can see, these are the values I provided for Chat0.

![Screenshot of Auth0 Universal Login customization](https://images.ctfassets.net/23aumh6u8s0i/5TM8XsJKpyfPoSHrmAJjW4/452f8f2acd81876fb20e9502979448b9/universal-login-custom.jpeg.png)

### Configure and Set Up Organizations

At this point, we have a functioning application, complete with simple Auth0 powered authentication. Now, let’s enable organization support and add an organization to our Auth0 application.

Back within our Auth0 dashboard and Chat0 application, notice there is a tab called _Organizations_. Go ahead and click on that tab.

![Screenshot of Auth0 organization settings page](https://images.ctfassets.net/23aumh6u8s0i/2sEk40iRY0ADpuIxlm3WbO/f9c7befb5c3435147a65bfb2261c1210/enable.jpeg)

Go ahead and toggle the green _Display Organization Prompt_ button. As it states below, this will prompt users to enter their organization name before logging in.

![Authentication prompt for organizations](https://images.ctfassets.net/23aumh6u8s0i/2fDmJPNHNWzbE2RAZBtN3d/69e8dcbc8fce760e5727e8f60822251c/universal-login-2.jpeg)

With the Universal Login ready to accept a user’s input for their organization, let’s now create an organization within our tenant.

On the left-hand sidebar, click on _Organizations_. Then on this page, click on the button that says _CREATE ORGANIZATION_.

![Screenshot of organizations tab within Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/6Z3aYFlcAnFRQMXeG5VXQk/dc050e0f0d41dd03f2e5b044bc42ccaf/dashboardorganization.jpeg)

After clicking on the _CREATE ORGANIZATION_ button, we are directed to this page to add basic information about our new organization.

![Screenshot of how to add an organization](https://images.ctfassets.net/23aumh6u8s0i/2848XRMQCXWk7HWSw2S229/3e49ae7ede2ed1ab7d2481aac6159c73/addorganization.jpeg)

As the text on this page states, the name is a human-readable identifier for the organization. Also, the display name is a friendly name for the organization. For example, I choose `acme` for the name and then `Acme` for the display name.

Once you are satisfied with the new organization, click on _ADD ORGANIZATION_.

You will then see your newly created organization.

Within this screen, you have the power to do a lot of customization. As you can see in the picture below, I have branded my new organization with some colors and a logo.

![Screenshot of an individual organization view](https://images.ctfassets.net/23aumh6u8s0i/39FS8nQYPsJoCSuumYfLfH/fda0ecc4622cbe9952fb33bd8a94026f/individualorg.jpeg)

At the bottom of this page, you can add custom metadata about your organization for extensibility purposes.

The _Members_ tab shows all of the current members within the organization. The _ADD MEMBERS_ button allows you to add a member to this specific organization.

Let’s create a new user and add them to this organization. So on the left-hand side of the page, click on _User Management_ and then _Users_. Here we can click on the _CREATE USER_ button and enter information about a new user. Once this is saved, back in our organization, we can click on the _ADD MEMBERS_ and add this new user to the organization.

The _Invitations_ tab provides the functionality to invite users to this specific organization.

![Screenshot of the members’ tab within Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/3YCjKOoeqzlgNV0Uwy6xnL/0b5d9be884e2813d6f1f182e954df635/invite.jpeg)

After clicking on the _INVITE MEMBERS_ button, you can choose your application from the initial dropdown (only ones with organizations enabled will show in the list).

Then you can add email addresses, determine which connections can be used and what role to assign them as a member of that organization (if there are any roles defined within your tenant).

Finally, on the _Connections_ tab, you can choose which connections you want to enable for this specific organization. Instead of enforcing the same connections to all applications within your tenant, you can control how each organization’s members can log in.

![Screenshot of the connections tab within organizations](https://images.ctfassets.net/23aumh6u8s0i/1kUkcgHRQYH7MrdIAviGLq/7cc069d1394cedade92f597ad6e9053d/connections.jpeg)

And that’s it!

When you go back to Chat0, which is running locally, click on the _login_ button in the header. It will show you the Chat0 Universal Login prompt asking for an organization.

![Authentication prompt for organizations](https://images.ctfassets.net/23aumh6u8s0i/34QV5KntgVMfvl5m54Gh7l/1df56e270aa9144b368ef0e7f6c8166f/universal-login-2.jpeg)

After entering _acme_ (the name of the newly created organization), it’ll open up the Acme-specific login.

![Authentication prompt for the acme organization](https://images.ctfassets.net/23aumh6u8s0i/3R0aMeqwdCOzTq5I8MKMtH/8eba028a984741815073a7aeaabe06f2/acme.jpeg)

Login with the user you created earlier, and then you will be redirected to the Chat0 dashboard for Acme users.

![Screenshot of a dashboard branded with the acme logo](https://images.ctfassets.net/23aumh6u8s0i/3SLUeDBuqPkcMceXiPZZEi/198df05368106dbf4482cf1a41e7d2c9/acmedashboard.jpeg)

Remember when we discussed conditionally setting the `organization` prop on the `Auth0Provider` component above? Within the `Sidebar.js` component, we set this `id` within `localStorage` when we get it.

```javascript
const { user } = useAuth0();
useEffect(() => {
if (user.org_id) {
localStorage.setItem("organization_id", String(user.org_id));
}
}, [user.org_id]);
```

The Auth0 React SDK provides the `user` object. This includes basic information about the user after successful authentication.

Setting and retrieving the authenticated organization id is what keeps the user authenticated when refreshing the page.

## Taking It Further

This article barely scratches the surface of the full functionality of Organizations. Using these new features, you can:

- Represent the teams, business customers, and partners that use your applications as organizations in Auth0.
- Set up branded, federated login flows for each organization.
- Manage organization members in a variety of ways, including just-in-time membership and email invitations.
- Define roles to represent what end users can do in your applications and assign those roles to organization members to have different roles in different organizations.
- Build administration capabilities into your products so that administrators in those organizations can manage their membership and access levels.

## What’s Next

As of today, Organizations is available for Auth0 subscribers on our Enterprise and Startup plans. You can find [technical documentation here](https://www.auth0.com/docs/organizations). We’ll be introducing new capabilities to improve organizations. We’d love to hear your thoughts about what we should focus on next; just comment below or send us questions [in the community forum](https://community.auth0.com/).

Introducing Auth0 Organizations

vincenzo-chianese

Vincenzo Chianese is an Italian Software Developer focused on Web APIs and User Interfaces. He has been working for the last years in API companies such as Apiary, Oracle, LunchBadger, Stoplight. Currently, he is working for Microsoft to help move Microsoft Graph forward and authored some open-source tools in the market (Prism, Express Gateway).

API Architect

Vincenzo Chianese

A quick introduction to the new Protocol class in Python 3.8 and how it enables structural typing

## Introduction

In the [previous installment](https://auth0.com/blog/typing-in-python/), we have seen how to type annotations enable gradual typing in Python and some of the common typing patterns that Python developers use when writing code.

In this article, we're going to take a look at the new Protocol classes introduced in Python 3.8 and how it enables, even in typed contexts, structural typing, and other idiomatic patterns in Python.

## What Is A Protocol

Protocol is a very generic word, both in regular language as well as in Computer Science. Most of us are probably familiar with it from hearing **TCP Protocol**, **UDP Protocol** or also **HTTP Protocol**. Dictionaries have also dedicated definitions for it:

> A set of rules governing the exchange or the transmission of data between devices

Which indeed makes sense. All the examples listed above are communication _protocols_ between two remote devices with a set of rules that are governing the transmission. In the case of TCP, for instance, the protocol mandates the shape of the message, the possible operations, the error policies as well as the rules for possible retransmission of a message.

On the other hand, it might be kind of weird for people to talk about protocols in a programming language. After all, there is no communication involved in a program, so what is the meaning of it?

We can answer the question by taking a look at another more generic definition that is not coupled with computer science:

> The accepted or established code of procedure or behavior in any group, organization, or situation. (New Oxford Dictionary)

Let's notice the difference with the previous definition we found above:

* No **devices** involved.
* No data **transmission** involved.
* No **data** involved, per se.

In fact, the nature of the protocol we're going to be talking about today. By removing some of the constraints of the previous definition, it is possible to reason about protocols in the context of a programming language.

Protocols are indeed not a new idea and have been around for a long time. For instance, Clojure supports protocols explicitly.

```clojure
(defprotocol Shape
  (area [_])
  (perimeter [_]))
  
(defrecord Square [l])

(defrecord Circle [r]
  Shape
  (area [_] (* Math/PI (Math/pow r 2)))
  (perimeter [_] (* r Math/PI)))

(defrecord Rectangle [w h]
  Shape
  (area [_] (* w h))
  (perimeter [_] (* 2 (+ w h))))
```

This code is basically creating a set of functions grouped in a Protocol called `Shape`; every type that wants to adhere to such Protocol has to implement such methods.

Successively, we create two new types — `Circle` and `Rectangle` where we implement the `area` and `perimeter` methods that are defined in the protocol. Because of this, we can call any of the protocol methods on any of the type instance implementing it:

```clojure
(def c (->Circle 10))
(area c)
; 314.1592653589793

(def r (->Rectangle 10 12))
(area r)
; 120

(def s (->Square 10))
(area s)
; Execution error (IllegalArgumentException) at user/eval147$fn$G (REPL:1).
; No implementation of method: :area of protocol: #'user/Shape found for class: user.Square
```

We can see that the methods are called correctly in the first two instances, but it fails on the `Square` object because it does not implement the `Shape` Protocol. Also, note that no **class** or **inheritance** is involved in this.

It is also possible to implement a protocol on a type that is already existing, even on types we do not own:

```clojure
(extend-protocol Shape
  Square
  (area [s] (Math/pow (:l s) 2))
  (perimeter [s] (* 4 (:l s))))
  
(extend-protocol Shape
  java.lang.String
  (area [_] 1)
  (perimeter [_] 10))
  
(def s ->Square 10)
  
(area s)
; 100.0

(area "hello world")
; 1
  
```

In this example, we have indeed implemented the same protocol on a type that has been precedently created (`Square`) and then even implemented the protocol on the built-in `String` type. This allows us to obtain what is called "polymorphism a la carte", where classes and inheritance are not involved/required. The original type is not even aware that a protocol implementation is being attached to it.

The rationale behind the Protocols is well explained in [Simple made easy](https://www.youtube.com/watch?v=kGlVcSMgtV4) or in the [documentation page](https://clojure.org/reference/protocols)

## Protocols In Python

Protocols in Python work a little bit differently. While the concept is the same as Clojure, Python does not need explicit protocol declaration. If a type has the methods specified in the protocol, then it implements the protocol.

For instance, the [len function](https://docs.python.org/3/library/functions.html#len) requires a `Sized` type as its argument, which is every type that implements the `__len__` function:

```python
class Team:
    def __init__(self, members):
        self.__members = members

justice_league_fav = Team(["batman", "wonder woman", "flash"])

print(len(justice_league_fav)) # TypeError: object of type 'Team' has no len()
```

The `Team` class does not implement the `__len__` method, and the runtime is throwing an error. We can change the class to implement such method:

```python
class SizedTeam:
    def __init__(self, members):
        self.__members = members

    def __len__(self):
        return len(self.__members)

justice_league_fav = SizedTeam(["batman", "wonder woman", "flash"])

print(len(justice_league_fav)) # 3
```

In the same way, we have seen in Clojure, no inheritance was involved, and the runtime has been able to execute the code.

Python 3 defines a number of protocols that can be implemented by our own types to be used around. The most common ones are:

* `Sized`: any type implementing the `__len__` method
* `Iterable`: any type implementing the `__iter__` method
* `Iterator`: any type implementing the `__iter__` and `__next__` methods

The complete list, though, is available on the [documentation page](https://mypy.readthedocs.io/en/stable/protocols.html)

## Protocol Types In Python

The problem comes when we try to apply the same Protocol concept in a typed context. Suppose, for instance; we have a custom class defining a protocol describing an open/close method for IO operations:

```python
import io

class IOResource:
    def __init__(self, uri: str):
        pass

    def open(self) -> int:
        pass

    def close(self) -> None:
        pass


class FileResource:
    def __init__(self, uri: str):
        self.uri = uri

    def open(self):
        self.file = io.FileIO(self.uri)
        return self.file.fileno()

    def close(self):
        self.file.close()


def write_resource_to_disk(r: IOResource):
    pass


write_resource_to_disk(FileResource("file.txt"))
```

Try to paste this code in a new file called `IOResource.py` and then try to run [`mypy`](http://mypy.readthedocs.io) on it:

```bash
mypy IOResource.py

IOResource.py:11: error: Argument 1 to "write_resource_to_disk" has incompatible type "FileResource"; expected "IOResource"
```

You can see we received a type error claiming (rightfully) that `FileResource` is not an `IOResource` subclass, even though our class is implemented all the required methods.

The same also happens to the builtin collection types, in case we're using Python 3.7 and running an older version of mypy (0.521, to be specific) on the following code:

```python
from typing import Sized

def multiply_len(val: Sized) -> int:
    return 2 * len(val)

class SizedTeam:
    def __init__(self, members):
        self.__members = members

    def __len__(self):
        return len(self.__members)

multiply_len(SizedTeam(["batman", "wonder woman", "flash"]))

# team.py:13: error: Argument 1 to "multiply_len" has incompatible type "SizedTeam"; expected "Sized"
```

Basically, the type system is **not** smart enough to recognize the implicit protocol through structural typing, leaving a bunch of idiomatic Python constructs out of the game when working in typed contexts.

Fortunately speaking, the issue has been fixed in Python 3.8 (or with any mypy >= 0.521) with the introduction of [Protocol classes](https://www.python.org/dev/peps/pep-0544/). If we take the collection example from above and try it on Python 3.8 — it will indeed work.

We can also fix now the `IOResource` example to make it work in Python 3.8:

```python
import io
from typing import Protocol

class IOResource(Protocol):
    def __init__(self, uri: str):
        pass

    def open(self) -> int:
        pass

    def close(self) -> None:
        pass


class FileResource:
    def __init__(self, uri: str):
        self.uri = uri

    def open(self):
        self.file = io.FileIO(self.uri)
        return self.file.fileno()

    def close(self):
        self.file.close()


def write_resource_to_disk(r: IOResource):
    pass


write_resource_to_disk(FileResource("file.txt"))
```

If we try to run mypy on this file again, we should receive no error.

The only change that was required was to make the base class inherit from a new special class called `Protocol`. This is a special class that enables the type system to go structural and not nominal.

## Rundown of Protocols Features

Let's now consider this protocol class:

```python
from typing import Protocol
import io

class IOResource(Protocol):
    uri: str

    def __init__(self, uri: str):
        pass

    def open(self) -> int:
        pass

    def close(self) -> None:
        pass
```

And let's use it to check what we can do when using Protocols.

Protocols are defined by including the special `typing.Protocol` class in the base class list. The annotated class does not lose any semantics of a regular abstract base class; they are just handled specially by the type checker.

All the functions and variables of a Protocol class are also protocol members, no matter the decorator on the top. This means they have to present in the target classes in order to consider them compliant with the protocol:


```python
import io


class FileResource:
    data: str
    file: io.FileIO

    def __init__(self, uri: str):
        self.data = uri

    def open(self):
        self.file = io.FileIO(self.uri)
        return self.file.fileno()

    def close(self):
        self.file.close()



write_resource_to_disk(FileResource("file.txt")) # Argument 1 to "write_resource_to_disk" has incompatible type "FileResource"; expected "IOResource"

```

When running this code through mypy, the type checker will detect the class is missing the `uri` string property that's defined in the protocol class.

A class can also inherit directly from a Protocol class — making the relationship explicit. This does not change anything, and it is indeed not required (and discouraged):

```python
- class FileResource:
+ class FileResource(IOResource):
```

A Protocol class can also aggregate other protocols if necessary:

```python
- class IOResource(Protocol):
+ class IOResource(Sized, Protocol):
```

In this case, the IOResource is a protocol with the methods we have defined above **and** it's also a `Sized`, meaning the `__len__` method must be implemented:

```python
class FileResource():
    uri: str
    file: io.FileIO

+    def __len__(self):
+        return len(self.file.readall())
```

It is also possible to create "aggregate" protocol classes, if necessary:

```python
from typing import Protocol
import io

class IOResource(Protocol):
    uri: str

    def __init__(self, uri: str):
        pass

    def open(self) -> int:
        pass

    def close(self) -> None:
        pass

class SizedIOResource(IOResource, Sized, Protocol):
  pass
```

Any class willing to adhere to the `SizedIOResource` protocol has to implement all the methods in `IOResource` and the `__len__` method as well.

Protocol classes cannot be instantiated, and both a typing error and a runtime error will be thrown since they're internally abstract classes:

```python
q = IOResource("/dev/file.txt") # Cannot instantiate abstract class 'IOResource' with abstract attributes '__len__' and 'uri'
```

## Conclusions

Protocol classes are very useful to keep some idiomatic patterns in Python, even in typed contexts. While the type system is yet not complete, this is an important milestone to close the loop of the story.

Protocol Types in Python 3.8

Lucy McGrath

Lucy is VP, Privacy at Auth0. She's a lawyer and global data privacy expert with diverse experience working with some of the world's leading media and technology companies. As Auth0’s VP, Privacy, she leads global data privacy strategy and is driven by a passion for further embedding privacy-by-design and continuing to shape our culture of privacy that starts with finding the humans that we impact every day.

VP, Privacy

Auth0 is preparing new documentation for its customers with European users.

At Auth0, our continuing mission is to secure the world’s identities so innovators can innovate. The core to delivering this mission is trust, including Auth0’s commitment to security and privacy.  

Auth0 welcomes the new Standard Contractual Clauses (“new SCCs”) issued by the European Commission, and is happy to see that they reflect a broader set of transfer scenarios and the European Court of Justice’s (ECJ) decision in the Schrems II case last year. 

As required by the European Commission’s decision, Auth0 will begin using the new SCCs for new customers on or before September 27, 2021 (with a goal of late July / early August). Once we have a generally available version of a new Data Processing Addendum (DPA) that incorporates the new SCCs, we will also be able to make this available to existing customers.

Once we have had an opportunity to consider final guidance on the new SCCs to be provided by the European Data Protection Board, we will update this post to summarize the transition program, including issues such as:

* Whether we anticipate making changes to our form of Subscription Agreement
* What changes we will be making to our DPA (“new DPA”)
* How existing customers will be able to transition to the new DPA and new SCCs 

During this transition period, we will continue to adhere to existing contractual obligations set out in the existing Standard Contractual Clauses (“old SCCs”) that are available [here](https://auth0.com/legal).

Lucy McGrath
VP, Privacy, and Data Protection Officer
Auth0, Inc 

Auth0 Statement on New Standard Contractual Clauses issued by European Commission

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Enhanced identity management for builders and providers of B2B SaaS applications enables faster implementation and best-in-class security, branding, and administration

**BELLEVUE, Wash. – April 26, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced the launch of [Organizations](https://auth0.com/organizations), a purpose-built feature enabling providers of B2B SaaS applications to seamlessly manage their business customers—a use case Auth0 defines as Business Customer Identity. Organizations is Auth0’s enhanced way for enterprise app teams to manage customers and partners in any multi-tenant, B2B, or SaaS application. With Organizations, B2B implementations are less complex, enabling faster speed-to-market and a better overall experience for business customers and partners. 

Business Customer Identity remains largely unaddressed by today’s Workforce Identity and Customer Identity Access Management (CIAM) solutions, forcing those who build and deliver B2B SaaS applications to cobble together features to address their unique use case. This requires significant customized configuration leading to high ongoing maintenance and configuration costs, slower time to market, and more difficult use case expansion and new app development.

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/5AGLt3QorElIYSuC43J2TE/c3db1cfffa3649353fab74e01dcdd511/approved-asset-three.jpg)

Business apps are not just used by individuals but by teams and entire companies, all of which need easy and secure onboarding, flexible membership provisioning, access control, and SSO setup. Convenience for B2B users is also increasingly in demand, prompting enterprises to provide similar seamless experiences to business partners as they do for consumers. Auth0 Organizations solves all of these issues and more, offering customizable identity management of any business customer or partner.   

Key benefits of Auth0 Organizations include: 

* **Simple Business Customer Onboarding:** Auth0’s APIs and SDKs can easily model entire business organizations, and rapidly-implemented admin dashboards manage SSO, Role-Based Access Control, and flexible user management workflows.
* **Custom-Branded Federations:** The ability to customize the login experience with branded login and registration flows ensures that business customers feel at home. 
* **Faster, Easier Deployment:** Less complex implementations shorten time to market, and integrations are accelerated as new products are built or acquired. 
* **Identity Engineering & Maintenance Costs Reduction:** Engineering resources can shift to work on core product innovation instead of focusing on complex identity issues.

“We were initially looking for a platform solely to handle SSO for our enterprise customers. Organizations is a great fit and offers enough flexibility to replace authentication for our 300+ non-enterprise customers, too,” said Steven Easton, Lead Engineer at Amiqus. “We’ve been really impressed with how powerful Auth0 is and yet have barely scratched the surface. We are excited to roll out Organizations as an improvement to our business customers’ experience and value how easy Auth0 makes it to do so.”

“We see Business Customer Identity as a standalone use case, one that our customers have increasingly been confronted with and had trouble fully addressing—until now,” said Shiv Ramji, Chief Product Officer at Auth0. “B2B identity management represents a sizable portion of our business and is consistently growing, demonstrating the need that Business Customer Identity addresses. We are thrilled to launch Auth0 Organizations as our next-generation offering for easy onboarding, authentication, and administration of business customers.”

More information can be found at [Auth0 Organizations](https://auth0.com/organizations).

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications<br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />

Auth0 Launches Organizations, Transforming the Way Enterprises Manage Business Customer Identity

Easily add custom messages to a two-way mirror, powered by a Raspberry Pi

Dad's in a Meeting... Creating a Raspberry Pi Smart Mirror

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

The new updates offer some reversals and clarifications worth paying attention to.


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>What are the NIST Password Guidelines?</strong><br> 
  The NIST Password Guidelines are also known as <a href="https://pages.nist.gov/800-63-3/sp800-63-3.html">NIST Special Publication 800-63B</a> and are part of the NIST’s digital identity guidelines. They were originally published in 2017 and most recently updated in March of 2020 under” Revision 3 “or” SP800-63B-3. They are considered the most influential standard for password creation and use policies by many <a href="http://www.cs.umd.edu/~jkatz/security/downloads/passwords_revealed-weir.pdf"> password cracking experts</a>.<br> 
</div>

According to the Verizon Data Breach Investigations Report, compromised passwords are responsible for [81% of hacking-related breaches](https://enterprise.verizon.com/resources/reports/dbir/). Needless to say, a key part of overall information security is securing your users’ passwords.

However, while there are a lot of conventional password security practices that seem intuitive, a lot of them are misleading, outdated, and even counterproductive.

That’s where the National Institute of Standards and Technology (NIST) password guidelines (also known as [NIST Special Publication 800-63B](https://pages.nist.gov/800-63-3/sp800-63-3.html)) come in. Although they’re required only for federal agencies, they’re considered the gold standard for password security by [many experts](http://www.cs.umd.edu/~jkatz/security/downloads/passwords_revealed-weir.pdf) because of how well researched, vetted, and widely applicable they are for the private sector.

In fact, many [corporate security teams are already using the NIST password guidelines](https://venturebeat.com/2017/04/18/new-password-guidelines-say-everything-we-thought-about-passwords-is-wrong/) as a baseline to provide something even more powerful than policies: credibility. So if you’re looking for what actually works for password security in 2020, here’s what the NIST says you should be doing (in plain English).

## New Password Creation Guidelines

Password security starts with the physical creation of that password. However, it’s not just your users’ responsibility to ensure their passwords are up to par &mdash; it’s also up to you to ensure that the passwords are strong enough (especially in light of how [the FTC handled the TaxSlayer case](https://biglawbusiness.com/cybersecurity-enforcers-wake-up-to-unauthorized-computer-access-via-credential-stuffing/)).

Here’s what the NIST guidelines say you should include in your new password policy.

### 1. Length > Complexity

Conventional wisdom says that a complex password is more secure. But in reality, password length is a much more important factor because a longer password is harder to decrypt if stolen.

Here’s a great example of how password length benefits you more than complexity on a technical level:

![Complexity of Passwords](https://images.ctfassets.net/23aumh6u8s0i/7zLMdDrj4rEC2IBL5BR2sN/cfc2a70bfbf520f7b439685894975a6c/passwords)
<p align="center">This is why <b>the NIST guidelines call for a strict eight-character minimum length.</b></p>

However, additional research shows that requiring new passwords to include a certain amount of complexity can actually make them less secure. And that’s why NIST has also removed all password-complexity requirements from their guidelines.

For example, many companies require that users include special characters, like a number, symbol, or uppercase letter, in their passwords to make them harder to decrypt. 

Unfortunately, many users will add complexity to their password by simply capitalizing the first letter of their password or adding a “1” or “!” to the end. And while it technically does make a password more difficult to crack, most password-crackers worth their salt know users tend to follow these patterns and can use them to reduce the time needed to decrypt a stolen password. 

Additionally, as password complexity increases, users tend to reuse passwords from account to account, increasing the risk that they could be the victim of a [credential stuffing attack](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks/) if one account is breached. 

So instead of forcing users to create more complex passwords, ask them to create longer ones if you want to improve password security.

### 2. Eliminate Periodic Resets

Many companies ask their users to reset their passwords every few months, thinking that any unauthorized person who obtained a user’s password will soon be locked out. However, frequent password changes can actually make security worse.

It’s difficult enough to remember one good password a year. And since users often have numerous passwords to remember already, they often resort to [changing their passwords in predictable patterns](https://www.sans.org/security-awareness-training/blog/time-password-expiration-die), such as adding a single character to the end of their last password or replacing a letter with a symbol that looks like it (such as $ instead of S).

So if an attacker already knows a user’s previous password, it won’t be difficult to crack the new one. The NIST guidelines state that periodic password-change requirements should be removed for this reason.

## Password Authentication Guidelines

The way you authenticate a password when a user logs in can have a massive impact on everything related to password security (including password creation). Here is what NIST recommends regarding the actual input and verification of passwords.

### 1. Enable “Show Password While Typing”

Typos are common when entering passwords, and when characters turn into dots as soon as they’re typed, it’s difficult to tell where you went wrong. This motivates users to pick shorter passwords that they’re less likely to mess up, especially on sites that allow only a few login attempts.

So if a user can choose, when alone, to have the password displayed during typing, they have a much better shot at entering lengthy passwords correctly on the first try.

### 2. Allow Password “Paste-In”

If passwords are easier to enter, your users are more likely to use a longer, more complex password in the first place (which is more secure). That’s where “paste-in” password functionality is now advantageous &mdash; if entering passwords is as simple as copying and pasting them into a password field; it encourages safer behavior.

This is especially important considering how many passwords the average person has to remember these days and the tools people are using to manage them all.

For example, a [survey by NordPass](https://nordpass.com/blog/password-habits-statistics/) found that 70% of people in the United States and the United Kingdom have more than ten passwords (20% have over 50). And many people have started using password managers to generate and store their passwords. So by allowing paste-in functionality this also allows people to use the auto-fill function of password managers to streamline the authentication process and stay safe at the same time.

### 3. Use Breached Password Protection

The new NIST password guidelines require that every new password be checked against a “blacklist” that includes dictionary words, repetitive or sequential strings, passwords taken in prior security breaches, variations on the site name, commonly used passphrases, or other words and patterns that cybercriminals are likely to guess.

Some [platforms, like Auth0](https://auth0.com/breached-passwords/), take this to another level and check real-time login attempts against a blacklist, ensuring that users are protected even if their passwords are leaked publicly:

<include src="Vidyard" id="fCqj5aaDQT6DgL55yYqczd" />

### 4. Don’t Use “Password Hints”

Some companies try to help users remember complex passwords by offering a hint or requiring them to answer a personal question.

However, with the constant dissemination of personal information on social media or through social engineering, the answers to these prompts are easy to find, making it easy for attackers to breach your user’s accounts. So this practice is now forbidden by the NIST guidelines.

### 5. Limit Password Attempts

Many attackers will attempt to breach an account by logging in over and over again until they figure out the right password (brute-force attack). And a great way to stop these kinds of attacks is to limit the number of login attempts that are allowed before locking the account.

The average attacker will need a lot more attempts than the average typo-prone user. So by including a cutoff or delay, you’ll drastically increase the amount of time an attacker will need to break in (to the point where it’s almost pointless to try).

### 6. Use Multi-Factor Authentication

[Multi-factor authentication](https://auth0.com/multifactor-authentication/) (MFA), also known as two-factor authentication (2FA), requires that users demonstrate at least two of the following in order to log in:

1. “something you know” (like a password)
2. “something you have” (like a phone)
3. “something you are” (like a fingerprint)

**The NIST guidelines now require the use of multi-factor authentication for securing any personal information available online**. However, their guidelines are very specific on what qualifies as a valid form of authentication and what does not.

For example, in the new guidelines, email joins voice-over-internet protocol (VoIP) on NIST’s list of channels that are not acceptable for MFA because they’re not considered out-of-band (OOB) authenticators (they’re not truly a “separate channel” because they do not necessarily prove possession of a second device).

So even if you’re using two-factor authentication, you’ll want to review the NIST guidelines to ensure that the channels you’re using meet NIST standards.

### The SMS Controversy

A previous version of the NIST password guidelines stated that using SMS as a second channel for authentication may not meet OOB requirements and could be disallowed in the future.

This led to a deluge of articles released by the security world declaring the death of SMS-based 2FA. However, the next revision of the NIST guidelines contained no explicit mention of SMS deprecation, leading to confusion.

![Nist guidelines](https://images.ctfassets.net/23aumh6u8s0i/2STV4YKmHKKMmB4xtRBt5u/c478850d37b6aa648fa5bdf87faed42e/sms-controversy)

After [lobbying from the CTIA](https://blogs.sap.com/2017/07/06/rollback-the-united-states-nist-no-longer-recommends-deprecating-sms-for-2fa/), NIST backtracked on its concerns, explicitly including SMS as a valid channel for OOB authentication.

Nevertheless, some concerns about SMS authentication remain valid. [SMS channels can be attacked](https://auth0.com/blog/what-the-new-nist-guidelines-mean-for-authentication/) by smartphone malware and SS7 hacks. In addition, message forwarding and number changes mean that access to messages does not always prove possession of a device.

NIST has not ignored this uncertainty. Their guidelines do insist that authenticators make sure the user’s telephone number is associated with a specific physical device when SMS (or voice) 2FA is used. They further recommend that authenticators watch for behavior such as device swapping, SIM changes, and number porting, which could indicate a compromised channel.

However, the removal of recommendations against SMS indicates that this [widely used 2FA channel is far from dead](https://blogs.sap.com/2017/07/06/rollback-the-united-states-nist-no-longer-recommends-deprecating-sms-for-2fa/). It remains much more secure than email and is an effective way to reduce your reliance on passwords.

## Password Storage Guidelines

Many security attacks have nothing to do with weak passwords and everything to do with the authenticator’s storage of passwords. Here’s what NIST recommends for ensuring passwords are stored securely.

### 1. Secure Your Databases

Your users’ passwords will be stored in a database (or several). So, to protect them, it’s important that access to these databases is limited to essential personnel only.

However, most companies’ databases aren’t as secure as you’d expect.

“The big thing that bothers me is when I go to a customer’s site. Usually, their [database] configuration is so weak that it’s easy to exploit. You usually don’t need buffer overflow or SQL injection [attacks] because the initial setup of the database is totally insecure,” Slavik Markovich, CTO of Sentrigo, told [Dark Reading](https://www.darkreading.com/risk/hackers-choice-top-six-database-attacks/d/d-id/1129481).

So to ensure that your users’ passwords are stored safely, you’ll want to ensure that your databases are secured from the [most common attacks](https://www.darkreading.com/risk/hackers-choice-top-six-database-attacks/d/d-id/1129481) at all times.

Additionally, keep in mind that any authentication credentials your administrators use should follow the NIST guidelines as well since that’s how attackers often gain access.

### 2. Hash Users’ Passwords

Password database breaches are going to happen. However, you can still protect your users in the event they do by hashing their passwords before you store them. For example, [Patreon’s](https://www.wired.com/2016/06/hacker-lexicon-password-hashing/) databases were breached in 2015. But thanks to a strong hashing scheme (bcrypt), the attackers were unable to use the credentials they acquired because they couldn’t revert the password hashes to the original passwords.

The NIST guidelines require that passwords be salted with at least 32 bits of data and hashed with a one-way key derivation function such as Password-Based Key Derivation Function 2 (PBKDF2) or Balloon. The function should be iterated as much as possible (at least 10,000 times) without harming server performance.

In addition, they recommend an additional hash with a salt stored separately from the hashed password. That way, even if the hashed passwords are stolen, brute-force attacks would prove impractical.

## Focus on User Experience to Improve Password Security

Cybersecurity and user experience are often at odds with each other. But the NIST password guidelines are pretty clear: strong password security is rooted in a streamlined user experience.

Your users will always do what makes their lives easiest (and [research shows](https://www.darkreading.com/informationweek-home/password-reuse-abounds-new-survey-shows/d/d-id/1331689) they’ll do so even if they know that behavior compromises their password security). So if you create the kind of user experience that uses this tendency to encourage safe behavior, it helps you both keep their data secure.

_Want to learn more about finding the magical balance between UX and security? [Check out this blog post that lays out our philosophy](https://auth0.com/blog/balancing-ux-and-security-at-auth0/)._


NIST Password Guidelines and Best Practices for 2020

We are very excited to announce our first ever hackathon!



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Important Information</strong><br> 
  <b>Where:</b> <a href="https://auth0.devpost.com">auth0.devpost.com</a> <br> 
  <b>When:</b> Aug 7-9th <br> 
  <b>Who:</b> You and a friend (teams of 2-4) <br> </strong>
</div>>

What is up developer humans! We at Auth0 are extremely excited to let you know that we are going to be hosting our first Hackathon, and it’s gonna be a doozie! We’ve got 6 superb partners, $10,000 worth of prizes, and the best developers in the world (you) hacking with us to solve some very real issues. Head over to devpost today to guarantee your spot in the hackathon, and watch this space for more announcements in the future. For now here are the basics.<br> 

## Partners

![auth0-hackathon-partners](https://images.ctfassets.net/23aumh6u8s0i/2g2TBuy8a2j7VkzobeWKTM/1e95dff47962fa343d8882ad5e3692da/auth0-hackathon-partners)<br>

## Judges

<include src="PartnerCard" picture="https://cdn.auth0.com/blog/hackathon/1-evil-rabit.png" name="Evil Rabbit" title="Head of Design" team="Vercel"/>
<include src="PartnerCard" picture="https://cdn.auth0.com/blog/hackathon/2-chris-sevilleja.png" name="Chris Sevilleja" title="Community Manager" team="DigitalOcean"/>
<include src="PartnerCard" picture="https://cdn.auth0.com/blog/hackathon/3-rob-melka.png" name="Rob Melka" title="Solution Architect" team="AWS"/>
<include src="PartnerCard" picture="https://cdn.auth0.com/blog/hackathon/4-obinna-ekwuno.png" name="Obinna Ekwuno" title="Software Engineer" team="Gatsby"/>
<include src="PartnerCard" picture="https://cdn.auth0.com/blog/hackathon/5-sherry-list.png" name="Sherry List" title="Azure Developer Technical Lead" team="Microsoft"/>
<include src="PartnerCard" picture="https://cdn.auth0.com/blog/hackathon/6-matias-woloski.png" name="Matias Woloski" title="CTO / Founder" team="Auth0"/>
<include src="PartnerCard" picture="https://cdn.auth0.com/blog/hackathon/7-mike-hartington.png" name="Mike Hartington" title="Developer Advocate" team="Ionic"/>

## Categories

The hackathon will be broken down into three categories. Each category will have a grand prize, runner up, third, fourth, and fifth place team winners. The categories are:

* **Addressing after effects:** solutions that address the after effects of COVID-19
* **Security:** solutions that create secure connections
* **Connectivity:** help to keep remote friends/co-workers/family connected
<br><br>

## Prizes

We are excited to offer the following categories of prizes for the Auth0 Hackathon:

* Grand prize winners (one in each category)
    * $2000 USD<br><br>
* Runner up winners (one in each category) 
    * $1000 USD<br><br>
* Third place winners (one in each category) 
    * $50 USD gift card per individual<br><br>
* Fourth place winners (one in each category) 
    * $25 USD gift card per individual<br><br>
* Fifth place winners (one in each category) 
    * $25 USD gift card per individual<br><br>


## Join Our Event Slack!

You can join the Hackathon Slack workspace in [**here**](https://auth0-hackathon.slack.com/join/shared_invite/zt-ft41f2nm-WytCWudC6AP24rT~5F9Z8g#/). Create or join a team of at least two members and you can use this slack to communicate. If you don’t have a team or are a team looking for more individuals, go to the **#available** slack channel page and drop a line.

**Good luck!**


Auth0 Hackathon

duncan-godfrey

Duncan is a security, engineering, and business leader. His background is in security engineering and, in particular, cloud security.

Sr. Director of Security and Compliance

Duncan Godfrey

Building a world-class security program to protect the world’s identities



If you are using our platform then you’re already benefiting from an advanced Product Security program, cloud security specialists, and a dedicated Detection and Response team monitoring 24/7.

Auth0 is a platform that helps application builders innovate faster. This means reducing the complexity of building identity into your applications, helping you move as quickly and securely as possible. But, identity is not simple; implementing the security protocols themselves is complex and there is inherent messiness in web security. This is why Auth0 has put in place a world-class security program to also make that easy for our customers.

I wanted to share more about how we run our program and what’s going on behind the scenes to protect all our customers. It’s something I started to talk about last year in an [interview](https://www.heavybit.com/library/podcasts/the-secure-developer/ep-32-security-and-compliance-with-duncan-godfrey-of-auth0/) with [Guy Podjarny](https://twitter.com/guypod) on the Secure Developer podcast and it’s something I will be talking about more this year.

<include src="TweetQuote" quoteText="There is no blueprint for success when it comes to building a security team, but in this post, @Auth0’s Sr. Director of Security + Compliance Duncan Godfrey shares the steps we’ve taken at Auth0 to create a world-class security program to protect the world’s identities."/>

There is no blueprint for success when building a Security Team. You will find different corporate structures and different structures to the engineering and operational teams. The teams grow organically, as you iterate on the makeup of their skills and their responsibilities all tied to the risks specific to your business. Within the Security community, we collaborate and compare notes with your peers in the industry, and that’s what I see. Leaders have optimized in different areas depending on their risks.

## What Is the Mission of Our Security Team?

Why does the Security Team exist? Trust is foundational to our success, and it's the Security team’s mission to build and maintain trust with our customers — and our customers’ customers and partners. As an IDaaS platform, we recognize that our solution is a building block for trust. We should never be a threat vector for our customers. This complicates the execution of a Security Program but in a way that attracts talented engineers who want to be part of a company that is at the center of the identity ecosystem.

## With a Million Different Priorities, How Do You Know Where to Focus?

Security is no different from any other successful business unit, you ruthlessly prioritize your resources to push towards your goals. Governance, risk, and compliance have been a peer to Security Engineering and helps us drive our focus and requirements. Both teams report to the CISO meaning they are not auditing our controls after the fact, they are part of the conversation.

The underpinning of any good security program is risk management. During our first ISO 27001 audit, we solidified this as a process and it’s something I have enjoyed reworking and improving. Whatever methodology you choose (e.g. [NIST](https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final), [FAIR](https://www.fairinstitute.org/)) having a realistic order of risk linked backed to all your information assets helps you prioritize and communicate with the rest of the business. And, using this we can prioritize investment in our controls.

Auth0 sells a security product, engineers here are building security at a security company. Something that has been different at Auth0 is that our most critical assets are actually our business process, our logic, our API the mechanisms that we provide to our customers more so than directly our data (not that isn’t also a critical asset).

We’ve always done things a little differently which adds some more interesting variables to our Enterprise, Auth0 is cloud-native in both our production infrastructure and our office apps; we are remote and we have and are growing very quickly.

<include src="TweetQuote" quoteText="Security is no different from any other successful business unit, you ruthlessly prioritize your resources to push towards your goals,” says @Auth0’s Sr. Director of Security + Compliance Duncan Godfrey. In this post, he shares how he makes his choices."/>

As well as our individual company risks our customers themselves have demanding high-security requirements. This all drives our investment in security, the development of our teams, and the rigorous [compliance](https://auth0.com/security/) regime we put ourselves through.

There are different models for defining the varied focus of Security Engineering teams. I have always liked ["Builders, breakers, and defenders"](http://michael-coates.blogspot.com/2011/02/vision-for-owasp.html). There has also been some standardization on using colors to communicate focus or capability (with the strongest associations being with defensive (blue) and offensive (red)). What you will see as I discuss the different teams we have tended to focus on defense but that is already starting to change.

The structure we have currently for the security engineering teams are:

* Product Security
* Cloud Security
* Detection and Response
* Security Awareness


## Product Security Team

Our Product Security team is a cross-functional Application and Product security team containing engineers who like building and breaking software. Product Security can mean different things to different security professionals for us it is supporting the product development lifecycle. 

Primarily the charter of these team has been:

* Developing a mature frictionless secure development lifecycle (SDL or SDLC). 
* Building tools to automate security in our CI/CD pipeline and developing libraries to wrap core security functions safely for developers and the building side (owning and developing libraries for specific security-focused operations of the product).
* Vulnerability Management
* Security Awareness and Training

It’s multidisciplinary as these functions can require different but overlapping skill sets. Supporting an SDL requires people who can run threat modeling exercises and work with developers to architect good security controls in response to the risk. Building tools and libraries require a Software Development Engineer (SDE) who can release and manage production code. We build a specialist product whose mission is to simplify that complexity for our customers. So within this team are experts in Identity protocols and how to abuse them.

Successfully handling vulnerabilities is a core capability for a security team, to protect the company from the impact of their exploitation. Making sure that once something is identified clearly communicated to the engineering teams and tracked to remediation. Day-to-day this means working with internal engineering teams and external researchers and third party penetration companies.

One of the things you may notice is that we have invested a lot in our supportive functions (e.g. SDL and VM). One of the changes that are already upon us is that we are now growing our breaking side, the team is becoming more involved in specific offensive security testing and red teaming.

## Cloud Security Team

Auth0 is cloud-native and we have built our product predominately on Amazon Web Services. AWS is a complicated product with a wide surface area, it offers developers a lot of freedom to build but it also offers a lot of opportunities to create an unnecessary attack surface. You need specialists in your Security team who understand building secure infrastructure in the Cloud and who can keep up with the high rate of change. This is where the Cloud Security team comes in, they secure our cloud infrastructure. 

This team grew out of a need to harden and secure access to an ever-growing number of AWS accounts. And, along with this, the founding charter was to ensure that we’re collecting data from every possible nook and cranny of AWS, pulling it in for analysis. Security monitoring has always been a foundation security building block for me and I have put a lot of emphasis on monitoring, security monitoring, gathering logs, and making sure we have a good audit trail for everything that we do. 

One of the advantages but also potential pitfalls of the cloud is how your workloads are now spread widely and dynamically. Making sure you are tracking assets is now similar to a big data problem and this team provides services to monitor these without slowing anyone down. Creating graphs from our non-standard networks and providing enriched data for analysis.

When people typically think of security engineers, they think of people who run firewalls or they do the configuration on routers and things like that.  But really, that’s not how you can operate in a Cloud environment anymore, and that’s not how you can operate. In theory, everyone’s writing software, so it’s security software engineers building security services with some more infrastructure ops people now mixed into the team to help them scale those services too.

As the team has grown they have also been able to build tools for developers to be able to access and deploy safely to the Cloud too. Building tooling to provide ephemeral access was a huge win here, with scoped short-lived access credentials becoming the norm in our environment.

## Detection and Response

The Detection and Response (DR) team’s charter is a threat detection and incident response (IR). This team is our insurance policy, they are the cool heads in a crisis. They’re trained incident responders who can deal with tough issues, collaboratively troubleshoot and problem solve. It’s also at the core of what the Security team does for the business which has come more into focus during our [pandemic planning](https://auth0.com/blog/how-to-create-an-actionable-pandemic-plan/).

As a company grows an IR team is something you can afford to invest in. it’s not that you won’t have to deal with incidents before you have a dedicated team, but until you reach that point it’s likely a shared responsibility within the security team. This means that getting to the point of having specialists is also a major release of pressure for the security org - especially for folks who are not naturally drawn to the adrenaline rush of IR.

We have taken a hybrid approach while building our [Security Operation Center](https://en.wikipedia.org/wiki/Security_operations_center)(SOC). We use an MSSP to enable us to guarantee 24/7 eyes on glass coverage and first-line triage. With our partner, supporting us with some of the easier operation work enabled us to take a modern approach to build a DR team. This means hiring Engineers who have both the technical skills to build detections and automation, while also having the people skills to run an incident. Which, is a skill set that is very in demand in the security market.

## Security Culture

Everyday human mistakes are still the most [common path to compromise](https://enterprise.verizon.com/resources/reports/dbir/2019/summary-of-findings/). This why an effective Security Culture program is such a critical component of a successful security program. We invested in this early on and have a dedicated resource crafting training to fit our companies culture.

It’s something that is often unestimated and underinvested in; with the classic tick box mandated annual Security Awareness Training is an example of something that is often very generic but is actually a great opportunity to grab the attention of everyone at your company, in one go. If you affect even only a percentage of those people it’s a huge security win. The feedback we got last year justified the investment and hopefully won us some fans. Beyond this, we have expanded to improve onboarding training, building-specific developer-focused secure code training, and anti-phishing training.

## Modern Cybersecurity is a Complex Operation

Good security is a process and it’s something that you build towards. You mature your operations and process driving towards continually raising your bar and reducing risk. When you are using our Product you now have the Auth0 Security team protecting your identity 24/7.

<include src="asides/AboutAuth0" />


Securing a Platform

Vittorio

Vittorio Bertocci is a Principal Architect for Auth0. Before Auth0, he had a lengthy career with Microsoft, where Vittorio worked with Fortune 100 and Global 100 companies, including working on Microsoft’s Azure Active Directory team as principal program manager focusing on the developer experience. He contributed to the inception and launch of Microsoft's claims-based platform components (Windows Identity Foundation and ADFS, ADAL and MSAL SDKs, ASP.NET middleware). Vittorio is a well known speaker, educator and published author.

Principal Architect

Vittorio Bertocci

4 hours of video classes on identity, architecture, and standards.


**TL;DR**: Every new technical hire at Auth0 goes through two days of technical onboarding. Today we are making the lecture portion of that training available to everyone, for free.

<include src="TweetQuote" quoteText="Take a guided deep dive into the complexity of identity with Auth0 Principal Architect @vibronet. 4 hours of our technical onboarding lectures — for free!"/>

## Understanding Identity: The Journey of New Auziros

Identity is complex. When you identify the job to be done, the particular task you want to accomplish, providers such as Auth0 can make it possible for you to add authentication and other identity-related functionality at the flip of a switch: you no longer experience the complexity, but the complexity never disappears. It has now transferred to the provider, who must thoroughly analyze the task you want to accomplish and make sound decisions about what's the most appropriate protocol flow to use, what reasonable defaults should be selected, what values should be hidden from view and what controls should be surfaced as configurable, what security measures are warranted... and many, many other design, planning and implementation aspects. Our customers don't need to sweat the details, but we do... and as a general rule, [the easier the experience you enjoy](https://auth0.com/blog/the-developer-first-identity-platform-auth0-story-and-future/), the more work has been poured into it behind the scenes.

One inescapable implication of the aforementioned situation is that the Auth0 personnel must have identity competence (what I often call the "identity IQ") that goes wide and deep: on fundamentals, traditional aspects (to know how to integrate with existing systems) and modern approaches. That's a kind of competence that isn't common on the market, especially if you compound it with the robust orientation toward developers of our offering and culture.

And yet, grow we must... Auth0 has been growing at a significant pace, [continuing to double in growth and revenue year-over-year](https://auth0.com/blog/auth0-closes-103m-in-funding-passes-1b-valuation/), and to sustain that growth we need to acquire talent that, while meeting our high bar (did I mention we are hiring? Take a look [here](https://auth0.com/careers)), doesn't always bring as dowry the deep identity IQ we need to develop and operate our service. Faced with this conundrum, we didn't have much choice but to devise ways to teach identity to our new hires.

## Why We Are Making Our Technical Onboarding Available

If you've been working in this space for a while, you know that this can be real tricky. Identity IQ isn't just learning by rote the name of the protocol artifacts and what knobs to turn in dashboards and SDKs to achieve a certain effect. True competence is mostly demonstrated when making decisions. Every day, Auth0 employees must make sound decisions on how to model specific scenarios, how to represent real world entities in the protocol artifacts with the most fitting characteristics, what attack surface will come with a particular architecture, and so on. Those decisions must withstand the test of time, must gel with prior art, must gracefully scale when necessary, and all the other good properties one expects from solid engineering practices. 

With all of that in mind, we examined the available literature on identity and development. **Although there is a lot of good content out there, most of it was either too protocol centric** (describing the protocol as a thing in itself, rather than a tool for solving real life problems), too scenario specific (not explicitly connecting the dots between development practices and protocol choices) or quite outdated. Given the strategic importance of keeping our identity IQ high, we decided to bite the bullet and... develop the content ourselves.

Every new Auziro (our nickname for Auth0 employees) begins his or her journey with few days of in-person training in our Bellevue headquarters. We started running classes once a month, experimenting with different formats and content &mdash; and eventually converged in the current course: a two days full-immersion class of heavily interactive lectures, punctuated by hands on labs designed to give attendees first hand experience of the theory learned up to that point.

![A photo of the Auth0 Technical Employee Onboarding ran by Vittorio Berttoci](https://images.ctfassets.net/23aumh6u8s0i/7AX2WwJamW3XgdceZ6rXAB/cd8830b5d3475a209c9f6c9d1040f966/technical-onboarding-auth0-vittorio-bertocci-2)

The feedback has been consistently positive, and the course proved to be very effective in equipping people not just with essential knowledge, but with the right command of the terminology and fundamentals necessary to understand the literature out there and contextualize new knowledge. This is now established practice and a staple of starting one's journey with Auth0. And for the cases where logistic doesn't work and a trip to Bellevue isn't feasible, we pre-recorded all lectures in professional videos for a self paced experience. Hold this thought, as I will come back to it shortly.

After few months of successes, someone had the idea to experimenting with delivering the class to customers and partners. I have to admit that at first I was skeptical &mdash; isn't Auth0 job to take on the burden of complexity, why should I bother the customer with the reasons behind the use of Nonce or why PKCE is necessary when using the system browser? Would they even care?

As it turns out, I was dead wrong &mdash; they cared A LOT. We delivered classes in London and Bellevue, Copenhagen and Oslo. In all cases, we filled the room with CTOs, architects, star developers and in general people whose responsibilities include making medium and long term strategy decisions for their company. They all gave glowing feedback, with some of them admitting that the class finally helped them to fully understand some aspects of the protocols and practices that they never managed to crack before. Some other shared that they've been looking for similar content for a long time, but they weren't able to get quite what they needed- until now.

"Some of the information I received today contradicts with our assumptions within the team about OAuth standards. Most of the information received will help me and the team make better decisions about auth flows." &ndash; Architecture Lead, Global Travel Aggregator

"Very useful. I work with a lot of businesses where identity is always a key part and not only has it given me more confidence and knowledge of Auth0 but in identity as a topic as well." &ndash; Partner, Cloud Architecture consultancy

"We had a great discussion. It's not every day that I get to talk so geekily in-depth with an acknowledged thought-leader in identity." &ndash; Distinguished Architect, B2B software multinational

Which brings us to today. Given the positive feedback we received, we decided to open up access to our classes to anyone. If you navigate to [https://auth0.com/docs/videos/learn-identity/](https://auth0.com/docs/videos/learn-identity/), you'll find the complete collection of identity lectures we recorded for our technical onboarding &mdash; available to you **for free**.

## The Identity Course

The lectures you find at <https://auth0.com/docs/videos/learn-identity/> are meant to help the viewer gain deep understanding of OAuth2 and OpenID Connect, down to the use specific parameters in particular messages of a given grant. Unlike a lot of the protocol content you might have consumed in the past, however, the course refers to scenarios and problems to be solved as highest order bit. Instead of hitting you with the laundry list of all the artifacts described in the specifications, the course introduces the concepts required to solve a specific problem only when the scenario requires it. This helps with understanding the whys behind each choice, and positions each artifact in the right context &mdash; providing obvious explanations for otherwise baffling things that neophytes are usually forced to swallow as articles of faith, such as why one goes to authenticate to the authorization endpoint, or why a web site is called a client even when it's clearly the resource we are gating access to.

The other side of the coin is that every explanation builds on the concepts already covered, hence to get the most from the class the content should be consumed sequentially and without skipping any part.

![An image of Auth0 Docs Learn Identity homepage](https://images.ctfassets.net/23aumh6u8s0i/PdtPHtKHxiudV6PLeXyic/e40723969ec9b0bd62d1ab0a8cfb4a61/learn-identity-homepage)

The content is really designed to be interactive, for classes under 20 people &mdash; where it's not uncommon to have 15 mins detours to dig in some specific scenario that happens to be of interest for a particular cohort; that is also the reason for which the slides supporting the narration are all designed to be rearranged on the fly, by dragging clipart around and scribbling on screen whatever impromptu explanation the discussion requires.

We clearly cannot offer the same dynamic in pre-recorded videos; however we compensate for that by providing very granular bookmarks. Each concept and subtopic has been indexed and surfaced in form of link below the video, allowing you to form an idea at a glance of the specific points being discussed, and to jump directly to the right time in the narration. We observed this to be particularly useful when reviewing the material and looking for a quick refresher. In fact, we made sure to make every bookmark available as an absolute URL &mdash; we envision using those as references during discussions, posts on forums, tweets and any context requiring a bite size explanation of specific identity concepts.

![An image of a Learn identity video's table of contents](https://images.ctfassets.net/23aumh6u8s0i/WyeKuRsWLvONjIXkk0YCm/c884377cb1ad30d17c7c179a91ee33b6/auth0-learn-identity-video-and-bookmarks)

As of today, we cover the following topics:

-   [An intro to the history of protocols &mdash; how the modern protocols came to be, what problems they were meant to originally solve, and how they emerged in response of the main challenges of each era](https://auth0.com/docs/videos/learn-identity/01-introduction-to-identity)

-   [A 20,000 ft meta-view of OAuth2 and OpenID Connect](https://auth0.com/docs/videos/learn-identity/02-oidc-and-oauth)

-   [Using OpenID Connect for implementing web sign on in a traditional web app](https://auth0.com/docs/videos/learn-identity/03-web-sign-in)

-   [Using OAuth2 for gaining delegated access to an API from a traditional web app](https://auth0.com/docs/videos/learn-identity/04-calling-an-api)

-   [Using OAuth2 and OpenID Connect to invoke API from native clients (mobile, desktop, etc)](https://auth0.com/docs/videos/learn-identity/05-desktop-and-mobile-apps)

-   [Using OAuth2 and OpenID Connect to invoke API from SPAs (including a discussion of the implicit vs code+PKCE)](https://auth0.com/docs/videos/learn-identity/06-single-page-apps)

The discussion starts extremely high level, but quickly dives deep - grants are picked for their ability to solve an abstract scenario, but are examined down to the network traces level. No concept is ever presented in isolation, but always annotated with the whys behind it and the implications of choosing one approach vs another. The highest order bit remains equipping the viewer to make good decisions.

<include src="TweetQuote" quoteText="Free access to Auth0 technical onboarding lectures with Principal Architect @vibronet!"/>


## What's Next

Where to go from here? 

The next step is to upload the hands on labs, so that you can taste the complete onboarding experience. We don't have an ETA to offer at this point, but it's something we'd like to do very soon.

Another likely evolution is that we might publish the course on its own web site. Today it's embedded in our documentation, a solution that allowed us to make the videos available to you quickly, however depending on your feedback we might repackage them (or updated versions) in their own space. Leave your feedback in the comments!

Finally. The fact that we published the video doesn't mean that we will not do more in-person workshops. There is a lot of value in discussing those topics in person and dig in specific areas as needed by each specific group of participants, so we'll still occasionally do pop up in-person classes around the world. If you are interested in one of those events, let us know by reaching out to an [Auth0 Resource](mailto: sales@auth0.com).

In the meanwhile, please enjoy the videos. We hope they'll help you to catch the identity bug and get passionate about identity as much as we all are here at Auth0!

[Learn Identity](https://auth0.com/docs/videos/learn-identity/)


Introducing Learn Identity!

I'm passionate about startup culture, leadership and employee engagement, coming from the experience of having left big corporate, packed up with my wife and kids and moved from Australia to the US to pursue startup life.

Auziros share what remote benefits make them thankful to be part of our flourishing relationship culture.



This might sound odd &mdash; but we're not deliberately trying to build a **remote culture** at Auth0. To me, that term conjures images of Tom Hanks in the movie "Cast Away": His character in ragged underwear stranded on a deserted island with nobody to talk with except Wilson... his inanimate volleyball friend. I mean, who wants to encourage remoteness as a culture?

Instead, our focus is on building a great **relationship culture**. By building strong bonds of trust and respect, passion and transparency, we've cultivated a culture that _empowers_ remote working. When you have those things in place, then where you physically work from is less important. This has always afforded us the luxury of really focusing on hiring the best talent for the roles we need. Literally, the entire world is our talent pool.

Certainly, there's plenty of great benefits for the remote employees &mdash; many listed by our very own staff [later in this post](#remote-benefits) &mdash; but there's also a huge benefit to Auth0: it exponentially increases the diversity of talent we can hire. On our team today, we have an ex-professional women's tennis player from the USA, a Certified Practicing Accountant turned developer from Canada, a one-time junior figure skating champion from Australia, and hundreds of other people with equally interesting backgrounds and experience from over 30 other countries. In fact, over 50% of our staff work outside of our main office locations. 

I don't want to presume a list of all the typical remote working benefits you might often read. So instead, here's what our employees actually told us they find amazing about their experience of working remotely at Auth0.

<h2 id="remote-benefits">Benefits of Remote Work As Told By Auth0 Employees</h2>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/abigail-sanchez.png" name="Abigail Sanchez" title="Program Manager" team="Field Ops" location="Washington, United States" body="Leaving your desk at 9:45 AM to take your kid their forgotten lunch and making it back in time for your 10:00 AM meeting"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/andreas-christofakis.png" name="Andreas Christofakis" title="Customer Advocate Specialist" team="Marketing" location="Colorado, United States" body="You don’t have to compete with your roommate to do laundry on Sundays. Any day can be a laundry day."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/Annybell-Villarroel.png" name="Annybell Villarroel" title="Security Operations Manager" team="Security Team" location="Spain" body="Not having to spend hours commuting."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/ashley-nicholson.png" name="Ashley Nicholson" title="Customer Success Manager" team="CS Management" location="Pennsylvania, United States" body="I am thankful for less wasted time. Prior to working remotely, I was stressed about everything from daily traffic to making it home in time to put my daughters to bed.  Auth0 recognizes the value of time."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/barbu-cruzado.png" name="Bárbara Muñoz Cruzado" title="Visual Designer" team="Design" location="Argentina" body="Working remotely gives me the chance to wear my pajamas all day long 😜 and I don’t have to wear any makeup.<br /> <br />I can also spend time with my cats and be able to do passive chores that I’m used to doing during the weekend."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/caroline-nealey.jpg" name="Caroline Nealey" title="Learning Lead" team="Content & Guidance" location="Washington, United States" body="The flexibility of working remotely allowed my family to adopt a second puppy. I can work remotely when I need to or come home earlier or later when required."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/chris-schultz.png" name="Chris Schultz" title="Engineer" team="DevOps" location="Minneapolis, United States" body="Having your baby daughter smile at you when getting her up from a nap."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/dan-arias.png" name="Dan Arias" title="R&D Content Engineer" team="Marketing" location="Florida, United States" body="Being able to eat a freshly made meal from the stove."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/davide-barbato.png" name="Davide Barbato" title="Security Engineer" team="Security & Operations" location="Spain" body="Be able to explore and enjoy the city without missing a meeting."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziro/Dirceu-Tiegs.jpg" name="Dirceu Tiegs" title="Engineer" team="Site Reliability Engineering Team" location="Brazil" body="Being able to stay close to my loved ones when they are going through difficult times, for example, if my wife is sick in bed.<br /><br />Also, taking a nap in the middle of the day without judgment and then coming back to do more awesome work."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/dj-joyce.png" name="DJ Joyce" title="Corporate Account Executive" team="Field Sales" location="England" body="Being able to manage my animal friends..."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/eva-sarafianou.png" name="Eva Sarafianou" title="Application Security Engineer" team="Security & Operations" location="Washington, United States" body="Missing my flight from London to Seattle and deciding to stay and enjoy London for the whole week."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/guillermo-alduncin.png" name="Guillermo Alduncin" title="IT Support Engineer" team="Security & Operations" location="Argentina" body="Being able to focus on a particular task for a long period of time even when the music is super loud because you like it that way.<br /><br />Also, I think it's great to just wake up, get a cup of coffee, sit at your desk, and be working already! Saving the stress of commuting is the best!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/janie-greenwood.png" name="Janie Greenwood" title="Scrum Master" team="Engineering" location="Montana, United States" body="My boyfriend and I love living in Montana because it keeps us close to remote areas so we can get out in the middle of nowhere doing the things we love: like a 6-day river trip we did two weeks ago on the Smith River.<br /><br />Working 100% remote for Auth0 also means we can take our RV on a month-long road trip to visit family and friends. I feel very lucky to work here!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/jeana-tahnk.png" name="Jeana Tahnk" title="Director, Corporate Communications" team="Marketing" location="Massachusetts, United States" body="Being home when my two older kids get out of school, and getting my littlest one off the bus!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/jenny-obrien.png" name="Jenny O'Brien" title="Creative Writer" team="Marketing" location="Washington, United States" body="The ability to introduce my formerly feral rescue dogs to a wide range of voices sans stress thanks to video meetings!<br /><br />Dance breaks witnessed only by my sarcastic dogs."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/jeremy-meiss.png" name="Jeremy Meiss" title="Dev Community Lead" team="Marketing" location="Kansas, United States" body="No showers needed."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/joan-pepin.png" name="Joan Pepin" title="CISO/VP Operations" team="Security & Operations" location="Oregon, United States" body="Cultural diversity! Every day I talk to and work with people from all around the world!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/karen-port.png" name="Karen Port" title="Developer Support Engineer" team="Technical Support" location="Pennsylvania, United States" body="No more traffic jams or commuting for over one hour one way, allowing me to spend more time with family and friends."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/katie-horne.png" name="Katie Horne" title="Technical Writer" team="Content & Guidance" location="California, United States" body="I love the flexibility to balance work and family. I am at all of my kids’ events."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/luke-oliff.png" name="Luke Oliff" title="R&D Content Engineer" team="Marketing" location="England" body="Getting to concentrate when your little boy is asleep because now your S/O also needs to tiptoe around.😂<br /><br />Taking Zoom meetings on my mobile while walking/feeding/watering the dog/baby/plants.<br /><br />Getting through cold and flu season without being sneezed on by a co-worker — just your child."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/matt-machuga.png" name="Matt Machuga" title="Engineering Lead" team="Engineering R&D" location="Pennsylvania, United States" body="I enjoy being able to utilize my outdoor office... err, patio furniture."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/maria-paktiti.png" name="Maria Paktiti" title="Instructional Designer" team="Content & Guidance" location="Greece" body="Being able to make a 3-month trip through Latin America while working."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/marius-mogyorosi.png" name="Marius Mogyorosi" title="Application Security Engineer" team="Security & Operations" location="Ohio, United States" body="As a new dad, it's priceless for me to be able to spend much more time with my son!<br /><br />Also, blasting music when no one's home. 🤘"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/megan-gleason.png" name="Megan Gleason" title="Director, Product Management" team="Product Management" location="Washington, United States" body="Being able to volunteer at my son’s school during my lunch break.<br /><br />Hopping on the rowing machine for 20 minutes between meetings.<br /><br />And... not being judged for covering the walls of my office with crazy sticky notes."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/mike-kusold.png" name="Mike Kusold" title="Engineer" team="Engineering R&D" location="Colorado, United States" body="Being able to shower a brand new puppy with attention all day.<br /><br />I got a puppy back in February, a few months after I joined Auth0 because it was finally feasible since I wouldn’t be away from home for 10 hours a day. <br /><br />Now, I also love being able to walk my dog for a lunchtime break."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/peter-filias.png" name="Peter Filias" title="Customer Success Manager" team="CS Management" location="Michigan, United States" body="Being able to sleep in a little while longer while the kids are home for the summer! This tragically ends come Fall and 5:30 AM wake-ups - <strong>here we come!</strong>"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/prashant-trivedy.png" name="Prashant Trivedy" title="Sr. Developer Support Engineer" team=" Technical Support" location="New Zealand" body="Getting an extra hour sleep and waking up when the rest of the household has to leave for work."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/rachel-khoriander.png" name="Rachel Khoriander" title="Technical Writer" team="Content & Guidance" location="Texas, United States" body="When your car engine throws a rod and you instantly need a new car, you can take your time and find a good deal rather than panicking about how to get to work!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/ramiro-nunez-dosio.png" name="Ramiro Nunez Dosio" title="Social Media Manager" team="Marketing" location="Argentina" body="Working from a Panamanian beach while eating a lobster caught on the same beach."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/robin-bijlani.png" name="Robin Bijlani" title="Software Engineer" team="Engineering R&D" location="Florida, United States" body="Not feeling guilty about leaving your furry companions at home alone all day."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/sam-bellen.png" name="Sam Bellen" title="Developer Evangelist" team="Marketing" location="Belgium" body="Getting my cat’s “work harder while I take a nap” look, day in day out."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/scott-mathson.png" name="Scott Mathson" title="SEO and Web Developer" team="Marketing" location="Montana, United States" body="More time and breaks with loved ones, pets, kids (if you have them), etc.<br /><br />Monetary savings by eating lunch at home and not doing morning commute drive-thru coffee.<br /><br />The ability to create a personalized office setup that you are most productive working in."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/shili-li.png" name="Shili Li" title="UX Researcher" team="Design" location="New York, United States" body="No makeup. No more worrying about what to wear. Flip flops and active shorts every day in the summer."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/siddharth-kshethrapal.png" name="Siddharth Kshethrapal" title="Engineer" team="Design R&D" location="India" body="Surprising your wife/kids at their work to pick them up."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/stacy-taylor.png" name="Stacy Taylor" title="Web UX Designer" team="Content & Guidance" location="Oregon, United States" body="I just like being able to walk my dog at lunch and to do passive chores (laundry, running dishwasher, Roomba, etc.) during work so I don't have to do them on the weekend."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/steve-hobbs.png" name="Steve Hobbs" title="R&D Content Engineer" team="Marketing" location="England" body="Being able to take some time out to do noisy DIY while your kid is in daycare! I managed to lay a whole floor today!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/sumana-malkapuram.png" name="Sumana Malkapuram" title="Solutions Architect" team="Professional Services" location="North Carolina, United States" body="Being able to get peaceful ‘me’ time and pursue my passion of playing guitar again."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/tim-ferrell.png" name="Tim Ferrell" title="Engineer" team="Engineering R&D" location="Florida, United States" body="Watching your toddler nap on the couch while waiting on the kettle."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/yvonne-wilson.png" name="Yvonne Wilson" title="Director" team="Strategic Operations and Technical Field Enablement" location="California, United States" body="I worked remotely while my children were growing up, which enabled me to be home when they came home from school and invited friends over.  In addition, the increased reach of the internet and the ability to hire remote workers has enabled me to hire and work with very talented people from all over the world.  It has been a privilege to get to know so many interesting people from different cultures, all working toward the same goal &mdash; secure identity management."/>

## Work is a Thing You Do, Not a Place You Go

I often push the sentiment that, for modern employees and organizations, work is a thing you do and not a place you go. Over the next few years, with the advancement of technology and the adaptation of our modern lifestyles, this will continue to be a strong guiding principle in the way we craft how work happens at Auth0.

Although [we're investing in Offices around the world](https://auth0.com/blog/auth0-supports-global-growth/) (we have offices in London, Bellevue, Buenos Aires, and Sydney) our vision is less about traditional offices and more about hubs to build relationships &mdash; places for people to work from or to come and go, to learn and network... be they Auth0 employees, customers, or industry community friends. The offices are only additive to the great relationship culture we have that empowers us to work from anywhere.

Now, someone just needs to send that message to Tom Hanks... and Wilson.

Go check out more about [how we do things at Auth0 over at our Culture page.](https://auth0.com/careers/culture)

<include src="asides/AboutAuth0" />


We Are Thankful For These Benefits of Working Remote

…and other black tie insights from EY’s Entrepreneur of the Year® awards.



Two weeks ago, I suited-up in a tuxedo and Ubered my way to the **Ernst & Young Entrepreneur of the Year® Awards** at the Westin Seattle. On a day where my biggest achievement may well have been putting my own bow tie on, I was soon to be humbled by the achievements of the entrepreneurs being recognized at the gala.
"Humble" is a word I closely associate with entrepreneurs — at least those who "break the mold" (which was the very tagline the folks at EY were attaching to this event). Case in point: [_Eugenio Pace, Auth0 Co-founder and CEO_](https://auth0.com/blog/Eugenio-pace-auth0-CEO-wins-ey-entrepreneur-award/), and the reason I found myself in a monkey suit dabbling in libations and hors-d'oeuvres along with a number of colleagues as we posed for photos and obligatory (yet completely unnecessary) selfies outside the Grand Ballroom.
Eugenio, who I've worked closely with for over three years, was accompanied by his wife Maggie, and both seemed calm and relaxed — joining in our jovial conversations, saying hello to connections, smiling … always with the smiling these two … certainly not hung up on what others might perceive as the enormity of the situation. After all, some guy named Jeffrey P. Bezos won this award once.
Our group of ten was seated at lucky Table #30 in the ballroom enjoying our starters as the lights dimmed and formalities proceeded. We were reminded of the history of the event, some of the inspirational stories and the efforts and passions of many of the people behind it. It was clear we were expected to be rowdy and make some noise as on the tables were LED-lit half moon tambourines, whistles, and little hand drum things you spin across your palms. We utilized them effectively. Some videos introducing the finalists were played, including an amusing "what would you rather" video. Would you rather be in the *Hunger Games* or *Jurassic Park*? Eugenio chose *Jurassic Park*, "because I like running, and I think there would be a lot of running in that." (For the record, I'd choose the *Hunger Games* because, well, Jennifer Lawrence.)

<include src="TweetQuote" quoteText="What do @eugenio_pace, @JeffBezos, and Jennifer Lawrence have in common? Just this blog post, probably..."/>

As mains wrapped up the awards began. The format was to announce the finalists in a specific category (there were eight or nine categories in all) after which the golden envelope was opened on stage to reveal the winner. If you've ever watched the Academy Awards then you get the visual. There were a couple of categories and deserving winners before we arrived at the category that Table #30 was most invested in: B2B Software & Services. Eugenio and Auth0 were among some great Pacific Northwest nominees, including Manny Medina of Outreach.io and Todd Schwartz and Evan Richman, the co-founders of SkyKick.
"Ladies and Gentleman, the award goes to..." a pause for dramatic effect — I took the opportunity to arm myself with a flashing tambourine and hand drum twizzle stick thing — "the winner is Eugenio Pace." Table #30 goes wild! There are kisses, back slaps and handshakes at our table before Eugenio makes his way to stage.
Now, let me circle back to my earlier comment about being humble. In my interactions with entrepreneurs over the years, I've found them to be less in awe of what they've achieved but instead in greater awe of the people they've surrounded themselves with and what is still ahead to be achieved. From my relationship with him, this certainly rings true for Eugenio. And what he says on stage will probably have you convinced too.

<p style="text-align: center;">
  <iframe src="https://player.vimeo.com/video/275898844" width="640" height="360" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>
</p>

On stage, Eugenio accepts his award: "Standing here, it's very tempting to think I am here on my own merits," he starts, "but I believe that self-made men are a myth. We are the product of the contribution and love of so many people in our lives and I've been very fortunate to have so many great people across my life." He specifically called out his grandparents, parents, sister, brother-in-law, teachers, wife, colleagues, and his team. He ended with "I'd like to think this award is yours as much as it is mine." Cue applause and mad waving of the sparkly tambourines.

The theme of humbleness and humility was largely present throughout the evening. Universal Cells CEO Claudia Mitchell, winner of the Life Sciences category, told the story of how she was supported by many people over her 20-year business journey, not least by her mother who originally lent her the money to found the company, but who tragically passed away just months before Mitchell's company was acquired for $100 million. CEO of Alaffia, Olowo-n’djo Tchala, another category winner, committed to taking his award to his mother’s grave in his home country of Toga in recognition of the contribution she'd had in his life and that of his seven siblings. Other award winners expressed similar sentiments.

<include src="TweetQuote" quoteText="Eight Auziros, our CEO, and his wife went to the @EY_EOY Awards. This is what happened."/>

Later that evening, when most of our crew had left, I was standing with Eugenio, Maggie his wife, and Jenna Isherwood, an awesome Auth0 colleague. His large shiny trophy was nestled on a window ledge next to us because it was too heavy to hold. We were enjoying another drink and laughing at each others' stories...ones we've probably all told before. Eugenio was tapped on the shoulder by a man he didn't know who congratulated him, wanting to know more about his thoughts on the security space. Of course, even in his celebration, he happily gave the man his time and attention. Buoyed as ever about the future. Humble as always.



<include src="asides/AboutAuth0" />


Award-Winning Entrepreneurs are Delightfully Humble

joan-pepin

As CSO, Joan is responsible for the holistic security and compliance of Auth0's platform, products, and corporate environment. She brings 20 years of experience to the role, with a career that has spanned a wide variety of industries, including healthcare, manufacturing, defense, ISPs, and MSSPs. <br /><br />Previously, Joan served as Business Information Security Officer (BISO) at Nike, Inc, CISO, and VP of Security at Sumo Logic, and held different positions at Guardent/Verisign/Secureworks organization. Joan holds a patent for developing the methodology to assess whether a communication contains an attack. <br /><br />She is also is a well-recognized thought leader and has spoken at major events, such as RSA, WhiteHat Security Summit, and Forrester Security Summit, and is frequently called upon for her expertise and commentary in Cloud Security and Compliance in large-scale and DevOps/CI environments.

Chief Security Officer (CSO)

Joan Pepin

A security researcher claimed that an attacker could perpetrate a phishing scam that could target a company using the Auth0 platform based on domain. Learn about this attack, the prevalence of phishing in the industry, and how to mitigate these scams.



A security researcher working for another company recently published a blog post stating that they could potentially perpetrate a phishing attack targeting users of a website that uses Auth0 authentication. Note that phishing is not the same as hacking a code vulnerability, and therefore, no software patches can be applied because no flaw exists in Auth0's system. Let’s explore the mechanism behind this theoretical phishing attack, the prevalence of social engineering scams in today’s tech industry, and what companies and their users can do to better protect themselves.

## What is Phishing?

[Phishing](https://www.csoonline.com/article/2117843/phishing/what-is-phishing-how-this-cyber-attack-works-and-how-to-prevent-it.html) is a type of social engineering cyber attack that has been around since the 1990s and is still extremely prevalent today. Phishing typically begins with email. Emails are sent to target individuals, and these emails contain links or attachments that have malicious intent: either to install malware on the user’s device, or get them to enter sensitive data into a website that masquerades as legitimate.

Phishing attacks are [growing increasingly sophisticated](https://www.menlosecurity.com/blog/from-your-account-is-deactivated-to-oauth-the-evolution-of-phishing) in the modern landscape of the internet, and the intent is to deceive people into providing protected information, often credentials. Regardless of sophistication, however, the premise of phishing is still very straightforward.

Consider this sequence of events, for example:

1. A user of Service A (`service-a.com`) is sent an email that appears to be from Service A. The email tells the user they need to log in using a link in the email.
2. The user clicks on the link, which takes them to a login page at `malicious-service-a.com` (_not_ the real website at `service-a.com`).
3. The page has been styled to look like a legitimate page from Service A, so the user enters their credentials into the login form.
4. The credentials have then been given to the attacker, who can now access the real Service A with the victim’s stolen login information. In addition, due to the common practice of [password reuse](https://www.troyhunt.com/password-reuse-credential-stuffing-and-another-1-billion-records-in-have-i-been-pwned/), the attacker may even have access to other accounts that the victim holds on other sites.

This is just one possible example of a phishing scam flow. The attacker could just as easily ask for other kinds of personal information, or request that the user download a malicious email attachment.

## Phishing with Auth0 Subdomains

The specific idea behind the security researcher’s phishing scam was a way to target a website that uses Auth0 authentication. Auth0 supports regional subdomains: `auth0.com`, `eu.auth0.com`, and `au.auth0.com`. A bad actor could potentially attempt to scam users of a website or application that uses one of the subdomains by registering any of the other regional subdomains while using the same name. The attacker could then set up a custom page on their subdomain and, _assuming that they had access to the email addresses of users_, send them a link and attempt to solicit secure information from them. Similar scams could be attempted using _any_ domain that users could mistake for a legitimate one.

<a href="https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)">Cross-Site Scripting, or XSS</a>, was not used in the exploration of a phishing attack that could use Auth0 regional subdomains to trick users. [XSS describes the injection of malicious scripts into a vulnerable web application](https://www.incapsula.com/web-application-security/cross-site-scripting-xss-attacks.html). This exploration relied on using a custom Auth0 page in a subdomain in another region, but [no malicious cross-site code could be injected](https://auth0.com/docs/hosted-pages#why-use-hosted-pages). The ability to include JavaScript in custom pages is a feature available to Auth0 customers to enable necessary flexibility. However, _cross-site code_ cannot be executed from these pages.

## This Attack is Not New and Not Unique

As stated previously, phishing attacks have been around for decades: almost thirty years, in fact. They have become more sophisticated and insidious in their execution, but they rely on tricking people into divulging confidential information: these kinds of attacks are referred to as <a href="https://en.wikipedia.org/wiki/Social_engineering_(security)">social engineering</a>. In these scams, it is common for malicious actors to use domains that look very similar to the target domain to make their phishing attempt more convincing. This is still true now, as well as historically.

> "It's unclear why the researcher used Auth0 as a common example of phishing targeting Auth0. There are no vulnerabilities here and their research doesn't show anything new. It is simply another example of possible phishing. The same could be done with the `anycompany.com` website by using a look alike domain and then setting up a login page same as this one `https://www.anycompamy.com/Login`."
>
> –Cesar Cerrudo, globally recognized security expert and CTO at [IOActive Labs](https://ioactive.com/)

**No company that has users with email addresses is impervious to phishing scams.** There are thousands of ways to perpetrate the [same kind of phishing attempt](https://auth0.com/blog/all-you-need-to-know-about-the-google-docs-phishing-attack/) [on any company](https://www.justice.gov/usao-sdny/pr/lithuanian-man-arrested-theft-over-100-million-fraudulent-email-compromise-scheme), aside from Auth0, [making the attacks quite prevalent](https://www.tripwire.com/state-of-security/security-data-protection/three-quarters-organizations-experienced-phishing-attacks-2017-report-uncovers/) in the tech industry.

## Phishing Relies on Tricking Users

[Phishing is not the same as hacking a code vulnerability](https://blog.varonis.com/whats-difference-hacking-phishing/), and therefore, no software patches can be applied because no flaw exists in Auth0’s system. The particular phishing attack described by the security researcher is not being actively used. Auth0 provides security measures to help prevent credential harvesting via phishing, such as [Single Sign-On](https://auth0.com/docs/sso/current), [Multifactor Authentication](https://auth0.com/learn/get-started-with-mfa/), and [Passwordless](https://auth0.com/passwordless). In addition, [Breached Password Protection](https://auth0.com/breached-passwords), [Brute Force Protection](https://auth0.com/docs/anomaly-detection#brute-force-protection), and [Anomaly Detection](https://auth0.com/docs/anomaly-detection) can help mitigate the potential outcomes of phishing attacks. Auth0 also supports the use of [Custom Domains](https://auth0.com/docs/custom-domains), which removes `auth0.com` (or regional `auth0.com` subdomains) from your application and replaces with a domain of your choosing, which completely eliminates the ability of an attacker to perform this scam using Auth0 subdomains.

However, it is important to remember that **phishing scams are quite common and easy to execute if an attacker already has your users’ email addresses**. Although using an Auth0 Custom Domain or registering all regional Auth0 subdomains eliminates the attack avenue described in this specific case, an attacker could still register any other Top Level Domain name that is similar to yours and attempt to deceive your users. For example, if your company’s login domain is `login.real-company.com`, a phishing attack could be perpetrated from a similar domain, such as `login.rea1-company.com`. In addition, a bad actor could just as easily send a malicious email attachment to your users instead.

## Protecting Your Company and Users

The safety of companies and their users should be the paramount concern when discovering and sharing information regarding security. Not committing to thorough research can negatively impact customers, users, and the general technology community.

Any company implementing authentication of any kind — proprietary or using an Identity and Access Management platform such as Auth0 — should have security practices in place to mitigate phishing attacks. These practices should include regular internal anti-phishing campaigns and training, as well as Multifactor Authentication or Passwordless. Monitoring for lookalike domain names is also recommended. With the proliferation and increasing cleverness of phishing scams, the importance of awareness and training cannot be understated.

Phishing Attacks with Auth0? Facts First

sam-judson

Former Auth0 Employee

Samuel Judson

Duo Security announced the discovery of a new class of SAML response vulnerability affecting SSO. Auth0 is not vulnerable to this issue.



On February 27, 2018, [Duo Security](https://duo.com) announced the discovery of a new class of vulnerability affecting SAML-based single sign-on systems. This flaw can allow an authenticated attacker to fool SAML systems into logging in as a different user, even without knowledge of the victim’s password. Note that this type of attack can be prevented by Multi-Factor Authentication, even if software used is vulnerable.

Malicious impersonation of this type can have a broad range of risks, including (but not limited to) compromising the victim as well as the system. An attacker could potentially impersonate a user with greater permissions, as well as elevate their own privileges.

Researchers from [Duo Labs](https://duo.com/labs), Duo’s security research team, identified several vendors affected by this class of vulnerability. You can read more information on SAML, details of the exploit, and affected vendors in Duo’s announcement here: [Duo Finds SAML Vulnerabilities Affecting Multiple Implementations](https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations).

## Auth0 is Not Affected by the Vulnerability

As [cited in Duo’s disclosure](https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations), all three of the following items are needed in order to enable this vulnerability:

1. SAML Responses contain strings that identify the authenticating user.
2. XML canonicalization (in most cases) will remove comments as part of signature validation, so adding comments to a SAML Response will not invalidate the signature.
3. XML text extraction may only return a substring of the text within an XML element when comments are present.

The library that Auth0 uses internally to parse SAML responses prevents the third requirement for exploitation. This prevents the vulnerability being exploited when  Auth0 is used as a SAML Service Provider (SP).

## Am I Affected?

Auth0 is not vulnerable to this issue, therefore, Auth0 customers do not need to take any action if using Auth0 as a SAML SP. However, if you are using Auth0 as a SAML Identity Provider (IdP) and are _processing SAML responses in your own code_, you will need to verify whether the libraries you are using are vulnerable as per [the original disclosure from Duo](https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations). If you are using a vulnerable library, you must ensure that **any affected software is updated to patch the vulnerability**.

Auth0 provides the [passport-wsfed-saml2](https://github.com/auth0/passport-wsfed-saml2) Passport strategy as open-source software. This strategy is **not vulnerable** to this SAML security vulnerability reported by Duo. If you or your company are using this strategy, you do not need to take any additional action.

If you have any further questions or concerns, please [open a support ticket](https://support.auth0.com/) or [ask in our community forum](https://community.auth0.com/).


Auth0 Not Affected by SAML Vulnerabilities Identified by Duo Security

685342d5e7f42c3ab8d251d7d4a53308?s=100&d=mm&r=g avatar

685342d5e7f42c3ab8d251d7d4a53308?s=100&d=mm&r=g

Robin Percy

Crystal Language claims to be as fast as C and as easy to learn as Ruby.  Here, I put it to the test and give my 2 cents!



Crystal is a statically-typed, compiled, systems programming language with the aims of being as fast as c/c++, while having a syntax as readable as Ruby.  This article is an introduction to the Crystal Language, through the eyes of a polyglot programmer.  Being a former programmer of both C and Ruby, I have been able to explore the ins-and-outs of Crystal with an objective mindset and give an unbiased opinion on its features; from it's low-level primitives to its familiar syntax, and much in-between.

I first came across Crystal when I saw [@sferik](https://twitter.com/sferik)  giving a talk on it in Poland back in 2015.  [Video here.](https://www.youtube.com/watch?v=Ysm4IU4aWoQ)  It was a great talk, and sparked my interest to Crystal right there and then.  When I initially checked out Crystal, I thought it looked awesome but I was too busy with all the other languages I was using on a daily basis to be able to focus my time properly on it.

Alongside being too busy, I couldn't really see why I'd use Crystal instead of using C/Erlang/Go/Ruby - languages that I already knew.  What I can say with confidence now though; is that whilst those languages may all be able to achieve the same end-goal they're all *better* in their own, different ways entirely.

When I want to build distributed apps, like my *Fist/Bump Heartbeat Monitor* - I use Erlang/Elixir.  When I want to build an API backend I use Golang.  When I want to spend the day with my brains scattered, and most probably in tears - I use C.  For readibility and demonstrations, I use Ruby.  When it comes to writing low-level systems such as daemons and obtuse Kernels, while it would be most performant to turn to C - it'd also take me a **LONG** time to achieve relatively little and the aforementioned tears would be very-likely flowing.  *This is where Crystal comes in.*

Having a syntax *very* similar to Ruby means that the familiarity of Crystal is incredibly enticing.  Since the world is obsessed with web apps now, let's take a look at the code required to build a minimal web server in both Crystal and Ruby.

In **Ruby**, using *Sinatra*, the code is as follows:

~~~ ruby
require "sinatra"
 
set :logging, false
 
get "/" do
  content_type "text/plain"
  "Hello, Auth0!"
end
~~~

Now in **Crystal**, check out the equivalent code:

~~~ ruby
require "kemal"
 
logging false
 
get "/" do |ctx|
  ctx.response.content_type = "text/plain"
  "Hello, Auth0!"
end
 
Kemal.run
~~~

The fact that you can use Ruby syntax highlighting natively for Crystal says everything!  Coming from Ruby to Crystal is a remarkably easy adaptation.  The fact is; one copy and paste code from Ruby to Crystal and 90% of the time it will run with no errors.  The creators of Crystal understand that Ruby is undoubtedly the most visually appealing language, and therefore built Crystal to take as much influence as possible from a design perspective.  You can even run Crystal programs using the `Ruby` shell command and vice versa since the syntax is valid for both languages!


## Binding C

One of the big selling points for Crystal is the ease with which you can interface with C libraries.  "Crystal allows you to bind to existing C libraries without writing a single line in C.  Additionally, it provides some conveniences like `out` and `to_unsafe` so writing bindings is as painless as possible."

Let's build a simple script in C that says "hi!".  We'll then write a Crystal app to bind to our C library.  This is a great starting point for anyone who wants to know about binding C in Crystal.

First off, let's create a project with Crystal's scaffolding tool (I'll cover this feature later).  Run:

~~~ bash
$ crystal init app sayhi_c
~~~

Then head into the directory `sayhi_c/src/sayhi_c` and let's create a file `sayhi.c` with the following contents:

~~~ c
#include <stdio.h>

void hi(const char * name){
  printf("Hi %s!\n", name);
}
~~~

Now we need to compile our C file into an object.  On Ubuntu or Mac using `gcc` we can run:

~~~ bash
$ gcc -c sayhi.c -o sayhi.o
~~~

Using the `-o` flags allow us to create an Object filetype.  Once we've got our Object file, we can bind it from within our Crystal app.  Open up our `sayhi_c.cr` file, and have it reflect the following:

~~~ ruby
require "./sayhi_c/*"

@[Link(ldflags: "#{__DIR__}/sayhi_c/sayhi.o")]

lib Say
  fun hi(name : LibC::Char*) : Void
end


Say.hi("Auth0")
~~~ 

I'll mention now that there are no implicit type conversions except `to_unsafe` - [explained here](https://crystal-lang.org/docs/syntax_and_semantics/c_bindings/to_unsafe.html) when invoking a C function: you must pass the exact type that is expected.

Also worth noting at this point is that since we have built our C file into an object file, we can include it in the project directory and link from there.  When we want to link dynamic libraries or installed C packages, we can just link them without including a path.

So, if we build our project file and run it, we get the following:

~~~ bash
$ crystal build --release src/sayhi_c.cr

$ ./sayhi_c

 > Hi Auth0!
~~~

It's really easy to bind to C in Crystal, and is definitely one of the features that attracts me most to the language.  I'm really looking forward to writing a C binding for a useful library and being able to utilise this functionality in production!


## Concurrency Primitives

One of my favourite parts of *Golang* is the `goroutine` threading system.  Working in the Database industry, I got a real passion for concurrency &amp; parallelism and when looking to a new language, one of the first things I explore are the concurrency primitives.  In Crystal, we can use the `Spawn` functionality in a very similar way to `Goroutines` in Golang, `core.async` in Clojure, or the lightweight threading in Elixir/Erlang.

For a simple test, I wrote two quick scripts to test the Spawn functionality in Crystal alongside Ruby.  We all know that Ruby is **not** a great language for threading, so I'm interested to see how much better Crystal is in small experiments.  Let's take the following example in ***Ruby***:

~~~ ruby
1000.times.map do
  Thread.new do
    puts "Hello?"
  end
end.each(&:join)
~~~

Running this from terminal I got the following results:

~~~ bash
$ time ruby spawntest.rb

real	0m0.288s
user	0m0.132s
sys	0m0.116s
~~~

I ran this little script on one of my ancient laptops that runs only 2gb of RAM and a terrible, *terrible* processor.  Now, porting this script to ***Crystal***, we can write:

~~~ ruby
channel = Channel(String).new
1000.times do
  spawn {
    channel.send "Hello?"
  }
  puts channel.receive
end
~~~

Running this script with the `crystal` command, I got the following results:

~~~ bash
$ time crystal spawntest.cr

real	0m1.129s
user	0m0.952s
sys	0m0.276s
~~~

Hmmmm, very interesting indeed!  Well, seen as Crystal is a compiled language and meant to be used to build small binaries that are easily distributed, it'd be a good idea to compile this small script and use *that* data instead!  I compiled the script using the `--release` flag - this tells the Crystal compiler to optimise the bytecode.

~~~ bash
$ crystal build --release spawntest.cr

$ time ./spawntest

real	0m0.008s
user	0m0.004s
sys		0m0.000s
~~~

As you can see, this result is markedly different.  Using the `--release` flag when building the Crystal executable cuts out a lot of bloating and optimises the executable to be as efficient as possible.  Obviously, the above test is a very naive use of the Spawn functionality, and unfortunately, I haven't had the opportunity to test in a load-heavy production environment. But soon I fully intend to, and I'll write another article benchmarking this in detail when I have a good usecase and get the chance to!


## Built-in Tooling in Crystal

One of the things I like most about Crystal is the excellent built-in tooling available.  When I look at new languages, especially relatively immature languages; it's always very reassuring when the language has extensive built-in tooling available to help developers stay productive &amp; happy!  In Crystal, there are a bunch of tools that make hacking around in the language super fun, but also help us to stay on the right track with semantics etc.

#### Testing

If you're coming from a Ruby/Rails background, I think you'll be ***very*** happy with the built-in testing framework that ships with Crystal.  It's rather reminiscent of *RSpec*, and will be really easy to use for anyone coming from a similar background.  Even if you're not from a Ruby/Rails background, it's a great testing tool and is super effective.

Using the `Greeter` demo app from the Crystal docs, we could write our Specs as follows:

~~~ ruby
require "spec"
require "../lib/greeter" # demo greeter class

describe Greeter do
  describe "#shout" do
    it "returns upcased string" do
      Greeter.new.shout('hello auth0').should eq "HELLO AUTH0"
    end
  end

  describe ".hello" do
    it "returns a static Hello string" do
      Greeter.hello.should eq "Hello"
    end
  end
end
~~~

As you can see, this spec should look *very* familiar to any Rubyists, and is becoming the more preferred syntax for application testing across many languages - there being RSpec clone libraries across most languages now!

#### Project Scaffold

Much the same as Elixir having the `Mix` manager, and Erlang the `Rebar` manager, Crystal has it's own built-in project scaffolder &amp; package manager.  I'd recommend using this at all times to ensure sematics are followed.  We can use it with the following:

~~~ bash
$ crystal init lib my_cool_lib
      create  my_cool_lib/.gitignore
      create  my_cool_lib/LICENSE
      create  my_cool_lib/README.md
      create  my_cool_lib/.travis.yml
      create  my_cool_lib/shard.yml
      create  my_cool_lib/src/my_cool_lib.cr
      create  my_cool_lib/src/my_cool_lib/version.cr
      create  my_cool_lib/spec/spec_helper.cr
      create  my_cool_lib/spec/my_cool_lib_spec.cr
Initialized empty Git repository in ~/my_cool_lib/.git/
~~~

#### Sharding

No - not creating Database Shards (luckily)!  Shards are Crystal's packages distributed in the same way as Ruby Gems, Elixir Libs or Golang packages.  Each application we create contains a file in the root directory named `shard.yml`.  This file contains project details and external dependencies.  The `shard.yml` file in my `sayhi_c` app above looks like this:

~~~ yml
name: sayhi_c
version: 0.1.0

authors:
  - Robin Percy <robin@percy.pw>

targets:
  sayhi_c:
    main: src/sayhi_c.cr

crystal: 0.22.0

license: MIT
~~~

The app I built has no dependencies to use, but if we want to include external packages we can do so by adding them at the bottom of the file:

~~~ yml
dependencies:
  github:
    github: felipeelias/crystal-github
    version: ~> 0.1.0
~~~

#### Documentation & Formatting

Crystal has a great built-in tool for generating documentation and formatting files.  The documentation that is generated is excellent - built-in html/css and almost instantly ready to deploy.

To generate documentation, from the project root directory we can simply run:

~~~ bash
$ crystal doc
~~~

This will create a docs directory, with a doc/index.html entry point. All files inside the root src directory of the project from which we ran the command will be considered.

Alongside this, the built-in *Formatter* tool is a great feature of the language.  We can run the formatter over our project by running:

~~~ bash
$ crystal tool format
~~~

We can use this tool to unify code styles and to submit documentation improvements to Crystal itself.  The formatter is also very fast, so very little time is lost if you format the entire project's codebase instead of just a single file.

*Both of these features are very cool, and highly useful!*

## What I don't like

Like anything in this world, Crystal can't possibly be perfect!  There are two ***very*** small issues that I find with it...

As a Polyglot programmer, I've had to learn a bunch of different programming paradigms.  While this isn't a fault in Crystal, the fact that it's object orientated is pretty much the only thing I'm not too keen on in Crystal.  Other than that; being a relatively young &amp; immature language, there's often a lack of documentation available when you want to do something incredibly specific.

Seeing this as an opportunity instead of a foible - it's actually kind of cool, because this means we can write documentation ourselves and hack sample apps together to become early adopters and decent contributors in the Crystal community!


## Aside - Auth0 & JWTs in Crystal 

**Update:** - I have written about [securing a Crystal web app with Auth0 &amp; JWT's here.](https://auth0.com/blog/building-your-first-crystal-app-with-jwt-authentication/)

At the moment, there is no Crystal-Auth0 library to use for end-to-end application securing.  However, there *is* a JWT library available for Crystal already [here](https://github.com/greyblake/crystal-jwt).

One thing to note here is that the Crystal-JWT library does not yet support the `RS256` algorithm, which is the preffered algorithm and only supports the `HS256` algorithm.  When setting up your application in the Auth0 control panel, make sure to select the `HS256` algorithm to reflect this.

In my next series of articles, I will be writing specifically about using Auth0 in a ***NON-jwt*** context, and I'll make sure I demonstrate this in Crystal!

Of course, if you're looking to secure a Crystal-based web app, you can always simply use the [Auth0 Centralised Login](https://auth0.com/docs/hosted-pages/login).  The Centralised Login will allow you to have immediate drop-in user management functionality.

## Conclusion

**I really rather like it!**

Although relatively immature, Crystal is a promising language with a growing Dev community surrounding it.  In my previous article about Auth0 Lock / Iris Image Recognition, I mentioned the fact that it'd be better to use the pHash / Blockhash libraries for a production environment.  If I was to build that system, I would most definitely use Crystal to bind to those C libraries.  I know that I'd be getting fantastically close-to-C speeds, and with the ease and joy of writing Crystal!

I am very much looking forward to seeing where this language goes.  I think the adoption rate will rapidly increase and I'm excited to see startups using it in production systems.  I am currently experimenting in building a Crystal library for the Auth0 API.  I will write another article on building an API client in Crystal when I'm finished.

I do hope this article has inspired you to give Crystal a try, and look forward to hearing your feedback if/when you do!  If you need any help and want to ask questions, [reach out to me via email](mailto:robin@percy.pw) and [@rbin](http://twitter.com/rbin) on twitter, I'm happy to help!

## Handy Resources

 - [https://github.com/veelenga/awesome-crystal](https://github.com/veelenga/awesome-crystal) 
 - [https://play.crystal-lang.org/#/cr](https://play.crystal-lang.org/#/cr) 
 - [https://www.reddit.com/r/crystal_programming/](https://www.reddit.com/r/crystal_programming/) 
 - [http://kemalcr.com/](http://kemalcr.com/) 


The Highs & Lows of Crystal - an Introduction to Crystal Lang

56227bdd539c480cc054eaa72eb1885d?s=200 avatar

56227bdd539c480cc054eaa72eb1885d?s=200

Guest Author

Antonio Sanso

JSON Web Encryption is vulnerable to a classic Invalid Curve Attack. Learn how this may affect you and what to do about it.



---

**TL;DR** If you are using [go-jose](https://github.com/square/go-jose), [node-jose](https://github.com/cisco/node-jose), [jose2go](https://github.com/dvsekhvalnov/jose2go), [Nimbus JOSE+JWT](https://bitbucket.org/connect2id/nimbus-jose-jwt/wiki/Home) or [jose4](https://bitbucket.org/b_c/jose4j/wiki/Home) with [ECDH-ES](https://tools.ietf.org/html/rfc7518) please update to the latest version. [RFC 7516 aka JSON Web Encryption (JWE)](https://tools.ietf.org/html/rfc7516) and software libraries implementing this specification used to suffer from a classic [Invalid Curve Attack](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.107.3920&rep=rep1&type=pdf). This can allow an attacker to recover the secret key of a party using JWE with [Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES)](https://tools.ietf.org/html/rfc7518), where the sender could extract receiver’s private key.

---

## Premise

In this blog post I assume you are already knowledgeable about elliptic curves and their use in cryptography. If not [Nick Sullivan](https://twitter.com/grittygrease)'s  [A (Relatively Easy To Understand) Primer on Elliptic Curve Cryptography](https://blog.cloudflare.com/a-relatively-easy-to-understand-primer-on-elliptic-curve-cryptography/) or Andrea Corbellini's series [Elliptic Curve Cryptography: finite fields and discrete logarithms](https://andrea.corbellini.name/2015/05/23/elliptic-curve-cryptography-finite-fields-and-discrete-logarithms/) are great starting points. Then if you further want to [climb the elliptic learning curve](https://moderncrypto.org/mail-archive/curves/2016/000784.html) including the related attacks you might also want to visit [https://safecurves.cr.yp.to/](https://safecurves.cr.yp.to/). Also the [DJB and Tanja talk at 31c3](https://www.youtube.com/watch?v=y_YxRUTI-xU) comes with an explanation of this very attack (see minute 43) or  [Juraj Somorovsky et al's research](https://web-in-security.blogspot.com/2015/09/practical-invalid-curve-attacks.html) can become handy for learners.

Note that this research was started and inspired by [Quan Nguyen from Google](https://research.google.com/pubs/pub45790.html) and then refined by [Antonio Sanso from Adobe](https://twitter.com/asanso).

## Introduction

JSON Web Token (JWT) is a JSON-based open standard ([RFC 7519](https://tools.ietf.org/html/rfc7519)) defined in the [OAuth specification family](https://tools.ietf.org/wg/oauth/) used for creating access tokens. The [Javascript Object Signing and Encryption (JOSE) IETF expert group](https://tools.ietf.org/wg/jose/) was then formed to formalize a set of signing and encryption methods for JWT that led to the release of  [RFC 7515 aka JSON Web Signature (JWS)](https://tools.ietf.org/html/rfc7515) and [RFC 7516 aka JSON Web Encryption (JWE)](https://tools.ietf.org/html/rfc7516). In this post we are going to focus on JWE.

A typical JWE is dot separated string that contains five parts:

* The JWE Protected Header
* The JWE Encrypted Key
* The JWE Initialization Vector
* The JWE Ciphertext
* The JWE Authentication Tag

An example of a JWE taken from the [specification](https://tools.ietf.org/html/rfc7516) would look like:

```
eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00ifQ.OKOawDo13gRp2ojaHV7LFpZcgV7T6DVZKTyKOMTYUmKoTCVJRgckCL9kiMT03JGeipsEdY3mx_etLbbWSrFr05kLzcSr4qKAq7YN7e9jwQRb23nfa6c9d-StnImGyFDbSv04uVuxIp5Zms1gNxKKK2Da14B8S4rzVRltdYwam_lDp5XnZAYpQdb76FdIKLaVmqgfwX7XWRxv2322i-vDxRfqNzo_tETKzpVLzfiwQyeyPGLBIO56YJ7eObdv0je81860ppamavo35UgoRdbYaBcoh9QcfylQr66oc6vFWXRcZ_ZT2LawVCWTIy3brGPi6UklfCpIMfIjf7iGdXKHzg.
48V1_ALb6US04U3b.5eym8TW_c8SuK0ltJ3rpYIzOeDQz7TALvtu6UG9oMo4vpzs9tX_EFShS8iB7j6ji      SdiwkIr3ajwQzaBtQD_A.XFBoMYUZodetZdvTiFvSkQ
```

This JWE employs RSA-OAEP for key encryption and A256GCM for content encryption :

![JWE Token](https://images.ctfassets.net/23aumh6u8s0i/1dyW4IOQJ2ho2Awh683SGM/88808f9284793e4f0d2f553793149e88/header0)

This is only one of the many possibilities JWE provides. A separate specification called [RFC 7518 aka JSON Web Algorithms (JWA)](https://tools.ietf.org/html/rfc7518) lists all the possible available algorithms that can be used. The one we are discussing today is the [Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES)](https://tools.ietf.org/html/rfc7518).  This algorithm allows deriving an ephemeral shared secret ([this blog post from Neil Madden](https://neilmadden.wordpress.com/2016/05/20/ephemeral-elliptic-curve-diffie-hellman-key-agreement-in-java/) shows a concrete example on how to do ephemeral key agreement).

In this case the *JWE Protected Header* lists as well the used elliptic curve used for  the key agreement:

![JWE Decoded](https://images.ctfassets.net/23aumh6u8s0i/5noTU8YY54mWlpUKyi2Ozq/88c9228b62e82608553b669cde0197b2/header)

Once the shared secret is calculated the key agreement result can be used in one of two ways:

1. Directly as the Content Encryption Key (CEK) for the "enc" algorithm, in the Direct Key Agreement mode, or

2. As a symmetric key used to wrap the CEK with the A128KW, A192KW, or A256KW algorithms, in the Key Agreement with Key Wrapping mode.

This is out of scope for this post but as for the other algorithms the [JOSE Cookbook](https://tools.ietf.org/html/rfc7520) contains example of usage for ECDH-ES in combination with AES-GCM or AES-CBC plus HMAC.

## Observation

As highlighted by Quan during his talk at [RWC 2017](https://www.realworldcrypto.com/rwc2017):

>Decryption/Signature verification input is always under attacker’s control

As we will see thorough this post this simple observation will be enough to recover the receiver’s private key. But first we need to dig a bit into elliptic curve bits and pieces.

## Elliptic Curves

An elliptic curve is the set of solutions defined by an equation of the form:

**y^2 = x^3 + ax + b**

Equations of this type are called *Weierstrass equations*. An elliptic curve would look like:

![Elliptic Curve](https://images.ctfassets.net/23aumh6u8s0i/3JMVwOaOP8hav8C2MS8N74/e52a69e348548f4b51730cfd23defc2b/EC)

**y^2 = x^3 + 4x + 20**

In order to apply the theory of elliptic curves to cryptography we need to look at elliptic curves whose points have coordinates in a finite field Fq. The same curve will then look like below over Finite Field of size 191:

![Field Size](https://images.ctfassets.net/23aumh6u8s0i/2HBFINrYLGCVLAu5XTPzY1/829e76c4db6c3e059cdbcaad63b369ac/ECFP)

**y^2 = x^3 + 4x + 20 over Finite Field of size 191**

For JWE the elliptic curves in scope are the one defined in [Suite B](https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml) and ([only recently](https://www.rfc-editor.org/rfc/rfc8037.txt)) [DJB](https://cr.yp.to/djb.html)'s curve.
Between those, the curve that so far has reached the higher amount of usage is the famous P-256.

Time to open [Sage](https://www.sagemath.org/). Let's define P-256:

![P-256](https://images.ctfassets.net/23aumh6u8s0i/1w5nccSNZHZy9uMtZiscOi/1b644b3c53c2740ab5e0364630ebef38/p256)

The order of the curve is a really huge number hence there isn't much an attacker can do with this curve (if the software implements ECDH correctly) in order to guess the private key used in the agreement. This brings us to the next section:

## The Attack

The attack described here is really the classical [Invalid Curve Attack](https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.107.3920&rep=rep1&type=pdf). The attack is simple and powerful and takes advantage from the mere fact that Weierstrass's formula for scalar multiplication does not take in consideration the coefficient b of the curve equation:

**y^2 = ax^3 + ax + b**.

The original's P-256 equation is:

![P-256](https://images.ctfassets.net/23aumh6u8s0i/1w5nccSNZHZy9uMtZiscOi/1b644b3c53c2740ab5e0364630ebef38/p256)

As we mention above, the order of this curve is really big. So we need now to find a more convenient curve for the attacker. Easy peasy with Sage:

![Sage](https://images.ctfassets.net/23aumh6u8s0i/7wF06Ez5NZQpbcDNVqTzDL/c86e6f9a18d6954588b623f181859b61/lift)

As you can see from the image above we just found a nicer curve (from the attacker point of view) that has an order with many small factors. Then we found a point P on the curve that has a really small order (2447 in this example).

Now we can build malicious JWEs (see the **Demo Time section** below) and extract the value of the secret key modulo 2447 with complexity in constant time.

A crucial part for the attack to succeed is to have the victim to repeat his own contribution to the resulting shared key. In other words this means that the victim should have his private key to be the same for each key agreement. Conveniently enough this is how the [Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES)](https://tools.ietf.org/html/rfc7518) works. Indeed ES stands for Ephemeral-Static were Static is the contribution of the victim!

At this stage we can repeat these operations (find a new curve, craft malicious JWEs, recover the secret key modulo the small order) many many times and collecting information about the secret key modulo many many small orders.

And finally [Chinese Remainder Theorem](https://en.wikipedia.org/wiki/Chinese_remainder_theorem) for the win!

At the end of the day the issue here is that the specification and consequently all the libraries I checked missed validating that the received public key (contained in the JWE Protected Header is on the curve), You can see the Vulnerable Libraries section below to check how the various libraries fixed the issue.

Again you can find details of the attack in the [original paper](https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.107.3920&rep=rep1&type=pdf).

## Demo Time

**[INSTANT DEMO CLICK HERE](https://afternoon-fortress-81941.herokuapp.com/)**

![Demo](https://images.ctfassets.net/23aumh6u8s0i/5X3r9P3BfAM4MJr0pLjxW6/ad911b7bc91929f77e4919d7a542f1e7/attacker)

### Explanation

In order to show how the attack would work in practice I set up a live demo in Heroku. In [https://obscure-everglades-31759.herokuapp.com/](https://obscure-everglades-31759.herokuapp.com/) is up and running one Node.js server app that will act as a victim in this case. The assumption is this: in order to communicate with this web application you need to encrypt a token using the [Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES)](https://tools.ietf.org/html/rfc7518). The static public key from the server needed for the key agreement is in [https://obscure-everglades-31759.herokuapp.com/ecdh-es-public.json](https://obscure-everglades-31759.herokuapp.com/ecdh-es-public.json):

![Demo explanation](https://images.ctfassets.net/23aumh6u8s0i/6hUUsH3W5njnGY5NTNKkl1/852801c26b71b9cbf87db67f8fdaf027/ecdh)

An application that wants to POST data to this server needs first to do a key agreement using the server's public key above and then encrypt the payload using the derived shared key using the JWE format. Once the JWE is in place this can be posted to [https://obscure-everglades-31759.herokuapp.com/secret](https://obscure-everglades-31759.herokuapp.com/secret). The web app will respond with a response status 200 if all went well (namely if it can decrypt the payload content) and with a response status 400 if for some reason the received token is missing or invalid. This will act as an oracle for any potential attacker in the way shown in the previous The Attack section.

I set up an attacker application in [https://afternoon-fortress-81941.herokuapp.com/](https://afternoon-fortress-81941.herokuapp.com/).

You can visit it and click the 'Recover Key' button and observe how the attacker is able to recover the secret key from the server piece by piece. Note that this is only a demo application so the recovered secret key is really small in order to reduce the waiting time. In practice the secret key will be significantly larger (hence it will take a bit more to recover the key).

In case you experience problem with the live demo, or simply if  want to see the code under the hood, you can find the demo code in Github:

* [https://github.com/asanso/jwe-receiver](https://github.com/asanso/jwe-receiver) contains the code of the vulnerable server.
* [https://github.com/asanso/jwe-sender](https://github.com/asanso/jwe-sender) contains the code of the attacker.

## Vulnerable Libraries

Here you can find a list of libraries that were vulnerable to this particular attack so far:

* [node-jose](https://github.com/cisco/node-jose) v0.9.3 include the fixes necessary, which was [published few weeks ago](https://github.com/cisco/node-jose/blob/master/CHANGELOG.md). Here the [Gist](https://gist.github.com/asanso/fa25685348051ef6a28d49aa0f27a4ae) of the original proof of concept.*
* [jose2go](https://github.com/dvsekhvalnov/jose2go)'s fix landed in [version 1.3](https://groups.google.com/forum/).
* [Nimbus JOSE+JWT](https://bitbucket.org/connect2id/nimbus-jose-jwt/wiki/Home) pushed out a fixed artifact to Maven central as v4.34.2. Here the [Gist](https://gist.github.com/asanso/5b8cabb862e6f730e00a97d8565dc325) of the original proof of concept.**
* [jose4](https://bitbucket.org/b_c/jose4j/wiki/Home) now comes with a [fix](https://bitbucket.org/b_c/jose4j/commits/0517896170af8d5c057407c70a7b08dae454829e) for this problem since v0.5.5. Here the [Gist](https://gist.github.com/asanso/350e3ce993e44d0509c6023aa77fc6af) of the original proof of concept.**
* [go-jose](https://github.com/square/go-jose) (this is the original library found vulnerable by [Quan Nguyen](https://research.google.com/pubs/pub45790.html))

Some of the libraries were implemented in a programming language that already protects against this attack checking that the result of the scalar multiplication is on the curve:

\* Latest version of Node.js appears to be immune to this attack. It was still possible to be vulnerable when using browsers without web crypto support.

** Affected was the default Java SUN JCA provider that comes with Java prior to version 1.8.0_51. Later Java versions and the BouncyCastle JCA provider do not seem to be affected.  

## Improving the JWE Standard

I reported this issue to the JOSE working group via [mail to the appropriate mailing list](https://www.ietf.org/mail-archive/web/jose/current/msg05612.html). We all seem to agree that an errata where the problem is listed is at least welcomed. This post is a direct attempt to raise awareness about this specific problem.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can help you make your product secure with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) to get started with modern authentication.

## Acknowledgement

The author would like to thanks the maintainers of [go-jose](https://github.com/square/go-jose), [node-jose](https://github.com/cisco/node-jose),[jose2go](https://github.com/dvsekhvalnov/jose2go), [Nimbus JOSE+JWT](https://bitbucket.org/connect2id/nimbus-jose-jwt/wiki/Home) and [jose4](https://bitbucket.org/b_c/jose4j/wiki/Home) for the responsiveness on fixing the issue. [Francesco Mari](https://twitter.com/francescomari) for helping out with the development of the demo application. Tommaso Teofili and Simone Tripodi for troubleshooting. Finally as mentioned above I would like to thank [Quan Nguyen from Google](https://research.google.com/pubs/pub45790.html), indeed this research could not be possible without his initial incipit.

That's all folks. For more crypto goodies, follow me on [Twitter](https://twitter.com/asanso/).

<div class="alert alert-info">
<strong>About Antonio Sanso:</strong><br />
Antonio works as Senior Software Engineer at Adobe Research Switzerland where he is part of the Adobe Experience Manager security team. Antonio is co-author of "OAuth 2 in Action" book. He found vulnerabilities in popular software such as OpenSSL, Google Chrome, Apple Safari and is included in the Google, Facebook, Microsoft, Paypal and Github security hall of fame. He is an avid open source contributor, being the Vice President (chair) for Apache Oltu and PMC member for Apache Sling. His working interests span from web application security to cryptography. Antonio is also the author of more than a dozen computer security patents and applied cryptography academic papers. He holds an MSc in Computer Science.
</div>


Critical Vulnerability in JSON Web Encryption

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Auth0 had the privilege of joining the Seattle 10 Class of 2016



**BELLEVUE, WA** - Every year the [*Seattle Museum of History and Industry*](http://www.mohai.org/) partners with [*GeekWire*](http://www.geekwire.com/) to present the [*Seattle 10*](http://www.mohai.org/component/content/article/70-exhibits/764-seattle-10) - a collection of ten history-making local start-up companies. Auth0 had the privilege of joining the [Seattle 10 Class of 2016](http://www.geekwire.com/2016/meet-seattle-10-hot-startups-transforming-everything-education-enterprise-software/), chosen over dozens of other fantastic nominees. To commemorate, Auth0 and the other winners recreated their business ideas on a six-foot by six-foot cocktail napkin that was unveiled on December 7 at the GeekWire Gala. The pop-up exhibit will run through January 29, 2017.

![Auth0 Napkin](https://images.ctfassets.net/23aumh6u8s0i/1hm9wfNQolgDo4UG0moFiY/e91058b291495e6fa6fbd56bc50c1fe3/auth0-napkin)

<include src="asides/AboutAuth0" />


Auth0 Named in Seattle’s 10 Hottest Entrepreneurial Ventures for 2016

Grean, an Auth0 Technology Partner, has developed a service that makes authenticating and authorizing users to custom apps for b2b companies easy.



One of the great things about offering an extensive authentication platform is seeing how other companies extend and augment it with their own unique solutions.  As Auth0’s ecosystem of partners grows, so too does the value we deliver to [**existing customers**](https://auth0.com/customers) already invested in our service.  An investment made to address one area of a customer’s business quickly finds an accelerated ROI when another part of the business soon realizes how they too can leverage the platform either directly or through a point solution provided by an Auth0 partner.

A great example is [**Grean**](http://www.grean.com) - an [**Auth0 technology partner**](https://auth0.com/partners) based out of Denmark.  Managing Director Niels Flensted-Jensen and his team has done a remarkable job understanding the business of their predominantly B2B enterprise customers and identifying complex and unwieldy processes that are core to the customer’s success yet not their core-business. The end result?  Grean has extracted some of these processes away from the customer by rolling them into a niche managed service and offering it back to customers on a subscription basis.

## Grean extends Auth0 with B2B onboarding and authorization.

Essentially, Grean extends Auth0 with a layer of B2B onboarding and authorization capabilities.  It’s a service for B2B applications – web, mobile or APIs – designed and built to work with Auth0.  Together the two form a complete authentication and authorization solution for business to business collaboration.

Let me hand over to Flensted-Jensen to explain further…

---
So maybe you work at an insurance company and you manage a web application serving brokerage firms. Maybe your company works with fifty brokerage firms, maybe even a thousand. And most of the brokerage firms have several users in different capacities: most work as brokers proper, a few are in finance, one is a manager having access to all accounts, others work just with a subset of customers.

And these are some of your challenges:

* You need a way of getting each brokerage firm on board the web app,
* You need to authenticate their users in a way that’s convenient to them and secure enough to you,
* You need a way for the firms to manage the permissions of the users in the context of your application.

![Grean provides easy onboarding, authentication and authorization of B2B users in custom business apps](https://images.ctfassets.net/23aumh6u8s0i/4cB7M5egNnVMLMjZQkE2aD/ce6504cda988a89cc6c5110fe0869a5e/greansc)

## A full onboarding, authentication and authorization solution

Grean manages everything related to onboarding of business partners and their employees. Subsequently Grean provides management of access roles, that is, how each business partner and their employees are allowed to use your web, mobile, and API applications.

Grean was built to work seamlessly with Auth0 by integrating into the authentication flow, independent of actual authentication method. Put simply, Auth0 determines who you are, Grean determines which organization you belong to and what you will be allowed to do in the context of that organization and the application you are using.

<include src="TweetQuote" quoteText="Grean was built to work seamlessly with Auth0 by integrating into the authentication flow"/>

> “Auth0 determines who you are, Grean determines which organization you belong to and what you will be allowed to do.”

So getting back to our insurance company example (in fact this is not so much an example as it is a generalization of an actual existing customer - RSA Scandinavia, part of global, UK based insurance company RSA) we are able to address the three challenging areas you face:

1. Onboarding of organizations. Your partners and customers should be easy to onboard - either by your invitation or automatically.
2. Each business partner should be recognized as such: You manage what their organization can do, and they then manage what each of their users will be able to do with your applications.
3. When signing in through Auth0, the user information must be augmented with information about their organization and the user’s authorizations as assigned through the previous steps.

Grean couples with Auth0 to deliver all these features and provide a full business-to-business authentication and authorization solution.

---

## Easy to get started if you’re an existing Auth0 customer.

It’s easy to integrate Grean into your existing Auth0 tenants.  Once you’ve signed up for Grean, you will be provided with a small piece of Javascript code to add as a rule to your Auth0 authentication pipeline.

Grean can also provide instructions on how to embed the user management UI into your web applications for your partners to use.

To learn more about Grean and Auth0, check out [**this post over on Grean’s site**](http://grean.com/grean/auth0/2015/12/04/grean-with-auth0.html).


How Partners Make Authentication and Authorization Even Better

“Auth0 introduces pre-release program, Zero To Launch, giving qualifying customers exclusive early access to new features and functionality.”



The pace of innovation in this new world of always-on cloud services is phenomenal.  At Auth0 we live and breathe it everyday – continually releasing updates, service enhancements and amazing new features.

<include src="TweetQuote" quoteText="The pace of innovation in this new world of always-on cloud services is phenomenal."/>

More often than not these improvements to our service stem from the way our customers and partners use our platform.  This eco-system continually challenges us with new use cases, scenarios and requirements - customers, technology partners and solution providers themselves pushing to drive innovation in what they do.  Frankly, it makes me pretty excited!

## 3…2…1… Zero To Launch

<div class="row" style="padding-bottom: 40px;">
<div class="col-xs-12 col-md-3" style="text-align: center;"><img style="margin: 0; margin-bottom: 20px; max-width: 100px;" src="https://images.ctfassets.net/23aumh6u8s0i/1mfMhHJkKI4CRbU9n22BPd/f04bfbc0e9d2320e5a7489f2ae8e334b/logo" alt="" /></div>
<div class="col-xs-12 col-md-9">

That’s why today I’m pleased to announce our new pre-release program, Zero To Launch.  This program will give qualifying customers and partners exclusive early access to new service enhancements and features plus support and resources to get things happening.  It’s seems a fitting way to continually give more value back to the incredible eco-system of customers and partners who challenge us to do more.

Of course, during the pre-release period, we’ll be eagerly listening out for your feedback and gaining a deeper understanding of how you’re using the new features. It’ll help us make final tweaks to UI and documentation as well as helping our engineering and support teams prepare for general availability.  This isn’t beta testing – features released through Zero To Launch can be used in your live projects.
</div>
</div>

## What’s in it For You?


<div class="row" style="padding-bottom: 40px;">
<div class="col-xs-12 col-md-3" style="text-align: center;"><img style="margin: 0; margin-bottom: 20px; max-width: 100px;" src="https://images.ctfassets.net/23aumh6u8s0i/6oFO0P1QmCrdsiuCcD4Lem/6cca13771d651a1c43077e12aa8952f9/3" alt="" /></div>
<div class="col-xs-12 col-md-9">

I haven’t met too many devs, system architects or even just general technology types who don’t love getting their hands on something new.  You can expect to gain knowledge, to be first and to create something new.  It’s a chance to work with like minded people who enjoy pushing the boundaries to create something better.  In fact, we’re developing a recognition and rewards component to ensure you’re honored for your valuable contributions…you could be our first Auth0 MVP!

From a business perspective, it also allows you to look forward and plan – maybe fix a problem, unlock new ways of working, remove a blocker from an existing project or interact with customers in new and different ways.
</div>
</div>

## Mission 1: API Authorization-as-a-Service

In launching the program, we’re also launching availability of the first pre-release feature. If you have an API that stores data from users or exposes data from a service and you want to open that API to 3rd party developers, like Facebook or Dropbox does with their APIs, then this is for you. Kick-start a 3rd party developer ecosystem faster than ever before!


## Get on Board

Zero To Launch is currently by invitation only.  Customers and Partners must meet certain criteria including being a paid subscriber or [**recognized technology or solution partner**](https://auth0.com/partners).  If you haven’t received an invitation but think this sounds pretty awesome, then feel free to [**reach out to me directly**](mailto:clayton@auth0.com?subject=ZeroToLaunch) to see if you qualify.


"cla"