Implementing MFA in React Using Auth0 and AWS Amplify

I. React Configuration
II. AWS Amplify Configuration
III. Auth0 URL Configuration

By Roy Rodan, Partner Solutions Architect – AWS; Mark Kriaf, Partner Solutions Architects – AWS; Michele Riso - AWS Certified Solutions Architect Professional 

This guide showcases the simplicity of adding Multi-Factor Authentication (MFA) to a React Single-Page Application (SPA) using Auth0 and AWS Amplify.

[AWS Amplify](https://aws.amazon.com/amplify/) is a set of tools and services that can be used, together or on their own, to help frontend web and mobile developers build scalable full stack applications.

With Amplify, you can configure app backends and connect your app in minutes, deploy static web apps in a few clicks, and easily manage app content outside the [AWS Management Console](https://aws.amazon.com/console/).

[Auth0](https://auth0.com/partners/aws) is an [AWS ISV Partner](https://partners.amazonaws.com/partners/001E000000YKGRTIA5/Auth0) with Competency designations in Security and Mobile. Auth0 helps developers secure their applications by providing an easy-to-implement, adaptable authentication and authorization platform.

- Updated React and Auth0 SDK for React versions
- Code migration from Rules to Auth0 Actions
- Updated the code to follow the latest best practices and recommendations

Angular Handbook: Identity and State Management

Introduction 05

Chapter 1 - Navigating and Routing 07
- Routers Configuration 08
- How it works 14
- Nested Router Outlet 16
- Navigation 24
- Programmatically 25
- Styling and Theming 28
- Component Level Styling 36
- Inline 38
- Pages and Layouts 40
- Layout Components 75
- Dispaly Local Data 97
- Using the MenuStateService 113
- Form Handling 154
- Display External Data 187

Chapter 2 - How to manage State Better 200
- Intro to NgRx 201
- Configure NgRx 204
- Menu State Management 210
- Create Menu Action 212
- Update Application to Use Menu Actions 221
- Create Menu Selectors 228
- Update Applications to Use Menu Selectors 231
- Create Menu Reducer 239
- Configure Store Module 242
- Create Menu Effects 244
- User State Management 252
- Create User Reducer 265
- Create User Effects 267

Chapter 3 - How to Secure The Dashboard 270
- Intro to Auth0 271
- Configure Auth0 272
- Instal Auth0 274
- Connect Angular with Auth0 274
- Update AppModule 276
- Connect External API with Auth0 279
- Login and Logout 280
- Make Secure API Calls 286
- Secure Routes 295
- Auth0’s Route Guards 296
- Configure Route Guards 297
- Display User Profile 300
- Role Based Acces Control 305
- Show/Hide “Add” Button 312
- Show/Hide “Edit” and “Delete” Button 315

Conclusion 320

Angular is an application design framework and development platform to create efficient and sophisticated single-page applications. While Angular helps developers build robust applications fast,  Auth0 helps developers secure those applications quickly by simplifying the implementation of Identity and Access Management.

This handbook provides you with a practical approach on how to use Angular and Auth0 to build and secure an admin dashboard.

----------

Release Notes

- Create and configure web applications in the Auth0 dashboard
- Setup an Angular application and secure it using Auth0
- Use NgRx to manage your application's state
- Integrate Auth0 with NgRx to manage user-related stat

Secured and Assured Unit 4 Workbook

# Contents

Introduction
Secured and Assured Unit 4
Get to Know Data Privacy
Data Privacy Best Practices
CIAM  Customer Identity Access Management Unit 4 Review
Key Takeaways
Review Questions
Additional Resources
Unit 4 Review Answer Key

In Secured and Assured Unit 4, we’re going to take a look at what data privacy is (and isn’t), go over some best practices and a solution that can help organizations with their privacy needs, and then wrap it up with a review of all the material covered in this unit.  It’s short, but packed full of useful information you can apply right away.

Here are some highlights of Unit 4’s Learning Outcomes:
- What data privacy is and is not
- How to ensure privacy is priority at your organization
- Learn how privacy + consent can build trust and help meet compliance
- Why organizations should practice the data minimization collection principle
- What CIAM is & how it helps with privacy

Secured and Assured Unit 4

Secured and Assured Unit 3 Workbook

# Contents

Introduction
Secured and Assured Unit 3
The 3 States of Data
Data in-Transit
Best Practices for Protecting Data in-Transit Encryption & Tokenization
Data in-Use
Best Practices for Protecting Data in-Use Data at-Rest
Best Practices for Protecting Data at-Rest Encryption & Tokenization
Unit 3 Review
Review Questions
Additional Resources
Unit 3 Review Answer Key

This Workbook, Secured and Assured Unit 3, teaches about the three states of data, reviewing some practices for each along with some corresponding tools often used by impact organizations and other businesses, and finally a brief review of the material covered in Data Protection.

Here are some highlights of Unit 3’s Learning Outcomes:
- The 3 states of data to protect
- Best practices for protecting Data in-Transit, in-Use, and at-Rest
- What encryption and tokenization is
- Tools that can help protect data

Secured and Assured Unit 3

Secured and Assured Unit 2 Workbook

# Contents

Introduction
Secured and Assured Unit 2
Data Security Best Practice #1
Systems Used to Safeguard Data at the Source
Components Used in Some Authentication & Authorization Systems
Additional Components Used in Some Authentication & Authorization Systems
Data Security Best Practice #2
Systems Used to Provide and Manage Access to Data
Systems Used to Provide all-in-one Authentication, Authorization, and Access Management of Data
Unit 2 Review
Review Questions Additional Resources
Unit 2 Review Answer Key

Navigating the ever-changing world of data compliance, protection, and privacy can be challenging, even for experienced professionals. However, it's crucial for leaders and individual contributors to understand key concepts, nomenclature, systems, and toolsets in a digital-first world, especially during a time of digital transformation. 

This Workbook, Secured and Assured Unit 2, discusses best practices for data security and reviews the systems and components that make up the tools used by organizations around the world to help secure their infrastructure and digital assets. 

Here are some highlights of Unit 2’s Learning Outcomes:
- Learn what an authentication and authorization system is and how it works to help secure data at the source
- Understand the ins and outs of SSO, MFA, Passwordless, and Layered Protection mechanisms 
- Get to know IAM; the framework, system and the application behind every login

Secured and Assured Unit 2

Secured and Assured Unit 1 Workbook

# Contents

Introduction
Secured and Assured Unit 1
Key Data Privacy, Protection, and Security Concepts
Data Privacy
Data Protection
Data Security
Data by Type and Compliance Measures
Unit 1 Review
Key Takeaways
Thinking About Compliance
Additional Resources

Navigating the ever-changing world of data compliance, protection, and privacy can be challenging, even for experienced professionals. However, it's crucial for leaders and individual contributors to understand key concepts, nomenclature, systems, and toolsets in a digital-first world, especially during a time of digital transformation. 

This Workbook, Secured and Assured Unit 1, addresses critical concepts in data privacy, protection, and security and how they relate to data compliance.

By prioritizing cyber-wellness and compliance, organizations can mitigate legal risk and build trust and transparency with external audiences. Download our guide today to gain the knowledge and skills needed to succeed in today's data-driven landscape.

Secured and Assured Unit 1

Enterprise-Ready Identity

## Contents

1. Introduction
  2. Trading control for opportunity: Meet the new boss
  3. Identity is essential to enterprise buyers
4. Enterprise Identity Requirements
  5. Enterprise single sign-on (SSO)
  6. Authorization and access control
  7. Multi-factor Authentication (MFA)
  8. Beyond the basics
9. Additional Requirements
  10. Availability
  11. Scalability
  12. Identity security
  13. Compliance and certifications
  14. Monitoring and logging
  15. Other potential requirements
16. Summing it all up
  17. Grow your SaaS applications, one login at a time

For a small or medium-sized business (SMB), signing a deal with their first enterprise customer is a big deal. Going upmarket is frequently a goal and sometimes a necessity for B2B SaaS vendors, but it isn’t easy. 

In addition to ensuring your core features meet the needs of enterprise buyers, you also have to satisfy a long list of additional requirements in other areas like security, compliance, and scalability—all of which identity plays a crucial role in. While the needs of SMB customers may have been met with straightforward authentication, authorization, and identity management features, enterprise decision-makers expect much more.

In this guide, we will walk through the identity requirements and the ancillary functionality that enterprises need while highlighting what you — the B2B SaaS vendor — need from your customer identity implementation to scale your business sustainably.

Enterprise-Ready Identity Guide

.NET Identity with Auth0

## Contents

1. Introduction
2. Chapter 1 - Authentication and Authorization
3. Chapter 2 - Introduction to Auth0 21
4. Chapter 3 - Regular Web Applications
5. Chapter 4 - APIs
6. Chapter 5 - Single-Page Applications
7. Conclusion

__A guide to using Auth0 in .NET applications__

The recent evolution of .NET aims to provide one development platform for any kind of application and operating system. While the .NET platform aims to relieve the developer’s burden in building applications, Auth0 helps make them more secure by simplifying Identity and Access Management.

This book will show you how to leverage Auth0’s authentication and authorization services in the various application types you can create with .NET.

Throughout the book, you will be guided in the steps for adding Auth0 to your applications with a practical approach. You will build and integrate simple applications to learn by doing and will have the opportunity to download their code to play with.


#### Releases
- Authentication and Authorization
- Introduction to Auth0
- Regular Web Applications
- APIs
- Single-Page Applications and more!

The Log Inn #NoDistractions

__How leaders unlock value in their business.__

We provide you with exclusive industry insights into how leaders can align their business strategies with their technical development to maximize their ROI.

Public Sector Infographic: Secure, Frictionless CIAM in the UK

Secure, Frictionless Customer Identity and Access Management

Customer identity and access management (CIAM) helps public sector agencies achieve secure, seamless, frictionless interaction that builds trust with citizens. To assess trends in CIAM adoption in the United States (US), United Kingdom (UK), and Australia and New Zealand (ANZ), Auth0/Okta partnered with Market Connections to identify and quantify how government agencies at all levels are providing digital services. The study specifically looked at the current state of identity authentication and security; challenges to current implementation; current pain points; and plans and concerns about changing systems and processes. These data points highlight key findings.

Public Sector Infographic: Secure, Frictionless CIAM in ANZ

Public Sector Infographic: Secure, Frictionless CIAM in the US

SAML Authentication, Explained

What is SAML, Benefits of SAML Authentication, How does SAML Authentication Work?, SAML Authentication with Auth0, More Auth0 SAML Configurations, Conclusion

Security Assertion Markup Language (SAML) is a login standard that helps users access applications based on sessions in another context. It’s a single sign-on (SSO) login method offering more secure authentication (with a better user experience) than usernames and passwords. 

In this eBook, you’ll learn:
- The advantages to SAML Authentication
- How to set up a SAML identity provider
- How SAML Authentication works with Auth0 
- SAML Configurations for SSO Integrations

https://drive.google.com/drive/folders/1HuxGVxDcrSge8oljOe1IsdeAaYYfEHxA?usp=sharing

Singpass and Auth0 Integration: Enable Singpass Login with a QR Code

- How Singpass QR Login Works
- Integrate Singpass with Auth0
- Technical details
- Deploy Singpass with integration proxy
- Universal login
- How it looks in action
- User profile

## Leverage Singapore’s national digital identity system for user authentication.

Singpass, launched in 2003 as a government agency authentication service, is quickly gaining steam in Southeast Asia as a private-sector auth solution. Learn how to seamlessly integrate Singpass QR Login and Auth0 Universal Login using OIDC authorization code flow and Singpass’s embedded SDK. 

In this eBook you’ll learn:
- The Singpass SDK authorization flow using digital identifiers (UUID and NRIC)
- How to configure the Singpass integration proxy within Auth0
- Technical steps to deploy Singpass as a login option for your end-users

Auth0 Integration with Singpass

Security for Web Developers EBook - PDF version

Security for Web Developers - ePub version

1. Introduction
2. Cross-site scripting
3. Cross-site request forgery (CSRF)
4. Clickjacking
5. Third-party assets security risks
6. HTTPS downgrade attacks
7. Where to go next

Web security is a vast and constantly evolving topic, just like web technologies themselves. Among your duties as a professional web developer, you must be aware of the dangers to which the applications you create may be exposed and apply appropriate solutions to protect them.

This book will drive you through a hands-on exploration of a few of the most
notorious threats that can affect web applications. Reading it you will learn:
- How Cross-Site Scripting (XSS) works and how you  prevent it
- The mechanics of Cross-Site Request Forgery (CSRF) attacks and how you can defend against them
- How to prevent Clickjacking attacks
- How to mitigate Third-Party assets security risks
- How attackers can downgrade HTTPS connections to unencrypted HTTP traffic

Security for Web Developers

Infographic: Secure, Frictionless CIAM

- Current State of Digitizing Citizen Services
- How to Free up Resources
- Important Aspects of Implementing Single IAM System
- Username and Password Still Leading Authentication Method for Digital Applications and Services

A companion piece to our [Secure, Frictionless CIAM Whitepaper](https://auth0.com/resources/whitepapers/pubsec-secure-frictionless-ciam), this infographic highlights the current state of IAM in the public sector, surprising statistics, and important aspects to consider when implementing Customer Identity and Access Management solutions

Building A Secure E-diary Using Fauna, Netlify, and Auth0

The guide focuses more on how to integrate Fauna and Netlify with Auth0 in building a secure online E-diary.

## A practical insight into role-based authorization with Fauna, Netlify, and Auth0

This eBook is a practical guide on how to utilize Auth0’s enhanced security features in building modern web applications and seamlessly integrate them with other serverless solutions like Fauna, and Netlify. The guide focuses more on how to integrate Fauna and Netlify with Auth0 in building a secure online E-diary.

At the end of this article, readers will be able to:
- Create and configure a simple application on Auth0.
- Setup a Fauna database and configure it to support Auth0 as a security provider.
- Build a simple web application that uses both Auth0 and Fauna to function seamlessly.
- Deploy the web platform using Netlify and Heroku.

Infographic: State of Healthcare’s Digital Front Door

With healthcare organizations advancing virtual care investments to address patients' desires for convenient access to care, ensuring seamless access has become increasingly essential to drive better engagement and care outcomes.  

In healthcare, the Digital Front Door is meant to address this, acting as a single hub or wrap-around experience through which all interactions can occur whether that's an  e-referral, symptom assessment, virtual care or remote monitoring.  

This infographic details key identity and access management considerations when building or advancing Digital Front Door strategies.

Authentication After Passwords

- Introduction
- The future of identity
- The frictionless imperative
- Identity flows are fundamental elements of the customer journey
- First things first: passwordless authentication
- The loginless roadmap
- What you can do now


From improving customer experience through seamless single sign-on (SSO) to making multi-factor authentication (MFA) quick and easy, your login box must find the right balance between user convenience, security, and privacy. 

In fact, we believe that the companies that will succeed in the next five years will be the ones best-equipped to meet the ever-growing consumer expectations for these three attributes. But what will that future look like, and by what path can today’s companies become tomorrow’s leaders?

In this ebook, we will answer these questions and take a closer look at the future of authentication, and the impacts of passwordless.

CIAM for Dummies

Download this free guide to find out:
- What CIAM is and why it matters
- What capabilities and features to look for in a modern CIAM solution
- Ten steps to implementing the right CIAM solution for your business

Usernames and passwords have become a part of everyday life. Consumers manage different accounts for online shopping, bank accounts, and mobile apps. This is customer identity and access management (CIAM), and you no doubt recognize some of the differences between good CIAM and bad CIAM in many of your digital experiences. For example, your mobile banking app may give you a strong sense of security and ease of use by simply authenticating you with a fingerprint or face scan. On the other hand, you’ve likely abandoned more than one online shopping cart when a retailer wants you to complete a lengthy registration process. Registration can take more time than finding the products you were looking for!

Download your free guide and find out:
- What CIAM is and why it matters
- What capabilities and features to look for in a modern CIAM solution
- Ten steps to implementing the right CIAM solution for your business

Customer Identity & Access Management For Dummies

IDaaS for Dummies

Chapter 1: The importance of identity, what it is, and how it has evolved
Chapter 2: What modern identity (Identity as a Service) is and how it helps organizations
Chapter 3: The components of modern identity
Chapter 4: New trends and innovations to address the future of identity
Chapter 5: Key capabilities and benefits of modern identity

Identity as a Service (IDaaS) solutions enable your organisation to bolster security and manage identity and access with speed and confidence. To leverage IAM services and security at scale, many organisations are adopting modern identity from the cloud. In this book, you’ll learn what modern identity is all about and how IDaaS can help your enterprise. Get a sneak peek at what’s inside:
- Chapter 1: The importance of identity, what it is, and how it has evolved
- Chapter 2: What modern identity (Identity as a Service) is and how it helps organizations
- Chapter 3: The components of modern identity
- Chapter 4: New trends and innovations to address the future of identity
- Chapter 5: Key capabilities and benefits of modern identity

IDaaS for Dummies Cover

Identity as a Service for Dummies

Infographic: Top 3 Attacks That Threaten Identity Security

The State of Secure Identity 2021: Top 3 Attacks That Threaten Identity Security

Released as part of Auth0's inaugural [State of Secure Identity report](https://auth0.com/resources/whitepapers/state-of-security-identity-report), this infographic reveals the top 3 attacks that threaten identity security. 

Released in June, 2021, the Auth0 State of Secure Identity Report reveals insights from our own trends and analysis to help define the identity security space, clarify emerging threats, and provide concrete strategies for mitigation. 

For a more in-depth analysis, read the full-length [State of Secure Identity report](https://auth0.com/resources/whitepapers/state-of-security-identity-report) to learn about:
- Credential stuffing
- Injection attacks
- Fake account creation
- MFA bypass attacks
- What defensive measures are being adopted to combat these attacks

Auth0AWS-CloudSecurity-eBook-FINAL

Research reveals that 79% of organisations have experienced an identity-related security breach in the last two years. Given the rapid rise in remote working and business migration to cloud-based apps, this is only a problem that is going to get worse. For organisations to meet the growing demands of cloud-based computing, they will need to ensure they have a robust, scalable IAM solution. This eBook discusses why identity-as-a-service is key to managing the challenges of secure access and frictionless digital experiences.

Guía del Comprador de CIAM

Auth0AWS CloudSecurity eBook Cover

Cómo Solucionar una Autenticación Vulnerada

Initial release that contains the first three chapters.

Security in the Cloud: Identity & Access Management & Mitigating Risk

AWS+Auth0 eBook Image 3

OAuth2 and OpenID Connect The Professional Guide PDF v0.2

OAuth2-and-OpenID-Connect-The-Professional-Guide PDF-v02

OAuth2 and OpenID Connect The Professional Guide EPUB v02

OAuth2-and-OpenID-Connect-The-Professional-Guide EPUB-v02

0. Introduction
1. Chapter 1 - Introduction to Digital Identity  
    1.1 From User Passwords in Every App...  
    1.2 ...to Directories  
    1.3 Cross-Domain SSO  
    1.4 The Password Sharing Anti-Pattern  
    1.5 Delegated Authorization: OAuth2  
    1.6 Layering Sign In on Top of OAuth2: OpenID Connect  
    1.7 Auth0: an Intermediary Keeping Complexity at Bay  
2. Chapter 2 - OAuth2 and OpenID Connect  
    2.1 OAuth2 Roles  
    2.2 OAuth2 Grants and OIDC Flows
3. Chapter 3 - Web Sign-In  
    3.1 Confidential Clients  
    3.2 The Implicit Grant with form_post  
    3.3 A detailed walkthrough  
    3.4 Anatomy of an ID Token  
    3.5 Principles of Token Validation  
    3.6 Metadata and Discovery
4. Chapter 4 - Calling an API from a Web App  
    4.1 The Authorization Code Grant  
    4.2 Sidebar: Essential Authorization Concepts and Terminology  
    4.3 The Refresh Token Grant  
    4.4 Sidebar: Access Tokens vs. ID Tokens  
    4.5 ID Tokens and the Back Channel  
    4.6 The Userinfo Endpoint  
    4.7 The Hybrid Grant  
    4.8 Client Credentials Grant
5. Chapter 5 - Desktop and Mobile Apps (COMING SOON) 
6. Chapter 6 - Single Page Applications (COMING SOON)

Authentication and authorization are critical parts of any application. They evolved over the years to meet the challenging requirements of the modern Web. OAuth2 and OpenID Connect offer a framework for handling them in an effective way. Learn the best practices in using both standards in different scenarios and application types. This e-book will explain not just the hows, but also the whys of OAuth2 and OpenID Connect.

OAuth2 and OpenID Connect

Cover for the OAuth2 and OpenID Connect ebook

cover-oauth-and-openid

OAuth2-and-OpenID-Connect-The-Professional-Guide PDF

OAuth2-and-OpenID-Connect-The-Professional-Guide notification image

New release:
- Added "Chapter 4 - Calling an API"
- Typo fixes

OAuth2 and OpenID Connect: The Professional Guide

Twitter Card for the OAuth2 and OpenID Connect Ebook

TwitterCard OAuth2-and-OpenID-Connect Ebook

Why AWS + Auth0 - eBook

## Contents

1. Introduction 

2. Architected with Security in Mind 
    1. Advanced Security Architecture - Built-in
    2. Roadmap input, early emerging threat detection
 
3. AWS Increases Security Scan Freedom 
    1. What This New Policy Means for Security Teams
    2. What We Are Doing at Auth0
    3. Moving From Manual to Automated
 
4. How to set up an AWS/API gateway
    1. How API Gateway Custom Authorizers Work 
    2. Before you Begin 
    3. Step 1 - Configure Auth0
    4. Step 2 - Import and Deploy the Gateway API
    5. Step 3 - Create the Custom Authorizers
    6. Step 4 - Secure the API Using Custom Authorizers
 
5. Additional Resources 
6. Best Practices & project planning 
7. Questions? 

This eBook explores how Auth0 and AWS work together to ensure that AWS customers can have the quick, easily implemented identity solution they need for their specific application.

Download to learn about:

- How to get ready to have your identity wired and running in minutes
- Advanced security architectural considerations
- Configuring Auth0 for API Gateway with custom Authorizers

AWS + Hands

Why AWS + Auth0 

An updated version of the #nodistractions eBook, with the removed customer quotes

nodistractions_eBook

# Contents	

__1 Innovation__
1.1 Recognized for Solving Different Needs	
1.2 Decreasing Project Risk	
1.3 Supporting (and Providing) Continual Innovation	
1.4 Collaboration Brings Success	

__2 Time to Market__
2.1 Beat the POC Waiting Game	
2.2 How Fast is Implementation?	
2.3 The Benefit of Focus	

__3 Security__
3.1 Decreasing Project Risk	
3.2 Proving Trust with Accreditation	
3.3 Getting the ‘Jump’ on Fraudulent Users	
3.4 Security ROI	

__4 Maintenance__	
4.1 Can You Keep up Your Own Success?	
4.2 Will Your Innovations Have to Wait?	
4.3 Can You Scale with Ease — and Speed?	
4.4 Where’s Your Focus?

__5 What’s the Real ROI of going with a service like Auth0?__	
5.1 Recognition	
5.2 Future-Proofing	
5.3 Peace of Mind	
5.4 The Best Offering


How does a company create a common product, and become a market leader? How does a retailer open thousands of stores, in multiple countries, during the high street crisis? How does a utility provider thrive in a crowded energy market?

This ebook discusses some of the factors that sees businesses align their strategy with their technical development, making it easier to:

- Centralize systems
- Eliminate technical debt and mitigate risk
- Bring innovations in their products, applications and services to market, faster




No distractions

No_Distractions_Cover_Image

No Distractions Cover Image

#nodistractions: an eBook

No Distractions eBook Twitter Card

The-Enterprise-Architect-Cookbook

## Contents
1. CIAM/B2C Planning Guide
   1. Introduction
   2. Phase 1: Application integration and User Authentication
   3. Phase 2: API Authorization and advanced Authentication, Provisioning and Profile Management
   4. Phase 3: Extended use cases for Authentication, Profile Management and Operations support

2. B2B Planning Guide
   1. Phase 1: Application integration and User Authentication
   2. Phase 2: API Authorization and advanced Authentication, Provisioning and Profile Management
   3. Phase 3: Extended use cases for Authentication, Profile Management and Operations support
   4. Resources

3. Resources

Looking for best practices on how to maximize your Auth0 B2B or B2C implementation? You’ve come to the right place. This eBook is grounded in real-world customer implementations from Auth0 Professional Services offering you valuable assets wherever you are in your project journey.

Inside, you’ll find:

- A delivery approach for B2C or B2B projects with Auth0
- Focuses on what to do and why to do it
- Guidance on how to approach your design and implementation approach with implementation checklists
- Phased delivery mapped to milestones and feature areas
- Acts as a guide to Auth0’s existing documentation
- Links to evolving resources

Auth0 + Computerwoche

Cover Auth0 Enterprise Architect Cookbook

Enterprise Architect Cookbook

The Enterprise Architect Cookbook

Enterprise Architect Cookbook - Twitter Card

the-openid-connect-handbook-1_1

1. Introduction
   1. A Word on Entity and Identity
   1. Authentication vs. Authorization
   1. Recap
1. OpenID Connect Introduction
   1. Authentication Protocols in a Nutshell
   1. How OpenID Connect Works
   1. OAuth 2.0 Overview
   1. OpenID Connect Use Cases
   1. Recap
1. OpenID Connect in Action
   1. Creating an Auth0 Account
   1. Prerequisites
1. OpenID Connect and Traditional Web Applications
   1. OpenID Connect and the Authentication Flows
   1. Bootstrapping the Project
   1. Register a Regular Web App with Auth0
   1. Fetching Information from the Discovery Endpoint
   1. Initiating the Authentication Process
   1. Handling the Authentication Callback
   1. Requesting More Information About Users
   1. Using SDKs to Authenticate Users
   1. Recap
1. Traditional Web Apps and the Delegated Authorization Flow
   1. The Authorization Code Flow
   1. Spinning Up a Resource Server
   1. Requesting Delegated Authorization
   1. Using SDKs to Request Delegated Authorization
   1. Recap
1. OpenID Connect and Single-Page Applications
   1. The Authentication Dance for SPAs
   1. Register a Single-Page Application with Auth0
   1. Bootstrapping the Project
   1. Integrating SPAs with OIDC Providers
   1. Integrating SPAs with OIDC Providers – the Easy Way
   1. Recap

OpenID Connect is the de facto standard for handling authentication in the modern world. From traditional web applications to single-page apps to native applications, OpenID Connect provides a template for interoperability that makes it easy to incorporate identity management seamlessly and securely. Learn how this standard works and how you can leverage it to enhance user experience and security today.

OpenID

eBook-OpenID

popup-oidc

Added the “Traditional Web Apps and the Delegated Authorization Flow” chapter.

The OpenID Connect Handbook

TC-OpenID-ebook

intro-to-ethereum

## Contents
1. Special Thanks `3`
1. Foreword `4`
1. Bitcoin and The Blockchain `5`
    1. Bitcoin and the Double-Spending Problem `5`
    1. The Blockchain `7`
        1. Validating Transactions `8`
        1. Ordering Transactions `11`
            1. Physics to the Rescue `14`
        1. Definition `17`
    1. Example: a Perpetual Message System Using Webtasks and Bitcoin `20`
        1. The implementation `21`
            1. The /new endpoint `21`
            1. The /address endpoint `21`
            1. The /message endpoint `21`
            1. The /debugNew endpoint `22`
        1. The Code `22`
        1. Deploying the example `24`
    1. Summary `25`
2. Ethereum: a Programmable Blockchain `26`
    1. Introduction `26`
        1. Blockchain Recap `26`
    1. Ethereum: a Programmable Blockchain `28`
        1. Ether `31`
        1. Smart Contracts `31`
            1. State `32`
            1. History `35`
            1. Solidity and a Sample Smart Contract `36`
        1. Current and Potential Uses `37`
            1. The Decentralized Autonomous Organization (DAO) `38`
            1. A Central Bank or Your Own Coin `38`
            1. A Crowdfunding System `38`
            1. Prove That You Said Something in the Past `39`
            1. Proof of Existence for Digital Assets `39`
    1. Example: A Simple Login System using Ethereum `40`
        1. Running the Example `44`
            1. Get an Ethereum node client `44`
            1. Create a new Ethereum account to mine some Ether `44`
            1. Start mining some Ether `45`
            1. Compile and deploy our Login contract `45`
            1. Install an Ethereum wallet `46`
            1. Tell the Ethereum wallet of the contract `46`
            1. Deploy the backend `49`
            1. Serve the frontend `49`
            1. Test everything together! `50`
    1. Summary `50`
3. A Practical Authentication Solution for Ethereum Users `51`
    1. Introduction `51`
    1. Towards a Practical Authentication Solution for Ethereum Users `52`
    1. A Login System for Ethereum Users `53`
        1. Registration `57`
        1. Authentication `59`
        1. Cons `60`
    1. Try it out! `60`
        1. Get an Ethereum Wallet `61`
            1. Get Metamask `61`
            1. Create a New Account `61`
            1. Get Some Ether `61`
        1. Get the Mobile Authenticator App `62`
            1. Get the App `62`
            1. Register `62`
        1. Enable Your Ethereum Address for Logins `62`
            1. Get Your Mobile App (Secondary) Address `62`
            1. Call the Contract! `63`
        1. Login to Our Test Site `64`
        1. Explore the Code `64`
    1. Summary `65`


Ever wondered how blockchains work? Or how Bitcoin managed to change the landscape of monetary transactions? Or what's the magic behind Ethereum?
Then this e-book is for you. In it we delve into the development of blockchains: distributed, immutable, verifiable ledgers for transactions.
We explore how they became instrumental in the development of the first large-scale cryptocurrency, Bitcoin, and how its ideas were extended to give birth to Ethereum, a powerful blockchain that marries decentralized transactions with Turing-complete contracts.

Ethereum

eBook An Introduction to E

An Introduction to Ethereum and Smart Contracts

data-playbook

## Contents
1. Preface `3`
    1. What we’ll learn `3`
    1. Codee xamples `4`
    1. Data `4`
1. The Essence of Data `1`
    1. What exactly is data? `1`
    1. Where can we find data? `2`
1. Data Collection `3`
    1. Backend databases `3`
    1. Backend tracking `4`
    1. Frontend tracking `4`
    1. Atomicity `5`
    1. Dates `6`
    1. Entities `6`
1. Information Theory `7`
    1. Let’s start playing `7`
    1. Shannon’s entropy `9`
    1. Maximal information coefficient `12`
1. Statistical functions `18`
    1. Analyzing the distribution `18`
    1. What do we mean with the mean? `20`
1. Univariate, bivariate, and multivariate analysis `24`
    1. Another dataset `24`
    1. Univariate analysis `24`
    1. Bivariate analysis `25`
    1. Multivariate analysis `29`
1. Causation vs. Correlation `32`
    1. Back to Wikipedia `32`
    1. Machine learning help `33`
    1. A/B testing `33`
    1. Causal inference `33`
1. Data Visualization `34`
    1. Bar charts `34`
    1. Line charts `36`
    1. Scatter plots `39`
    1. Box plots `39`
    1. Pie/donut charts `40`
1. Machine Learning `42`
    1. Supervised learning `42`
    1. Unsupervised learning `44`
    1. Learnmore `45`


This book is aimed at sharing best practices we use when working with data at Auth0.
In this book, you'll find various best practices and examples that will help you be as effective as possible when working with data.

Data Playbook

eBook The Data Playbook

#### Releases
- The essence of data.
- Properly collecting data.
- Information theory and why it is important.
- Statistical functions.
- Univariate/Bivariate/multivariate analysis.
- Data visualization, and more!

The Data Playbook

data-playbook-tc

migrating-to-angular

## Contents
1. Introduction `4`
    1. AngularJS 1 and Angular 2+ `4`
    1. Migrate vs.Upgrade `5`
2. Angular 1 App “ng1-dinos”  `6`
    1. Dependencies `6`
    1. Install and Run “ng1-dinos” `6`
3. Introducing Angular 2 App “ng2-dinos” `8`
    1. Dependencies `8`
    1. Initialize ng2-dinos `9`
    1. Linting and StyleGuide `9`
4. Customizing Our Angular 2 Project for Migration `11`
    1. Bootstrap CSS `11`
    1. Third Party Libraries `12`
    1. Global SCSS `13`
    1. Update App File Structure `15`
5. Angular 2 Root App Component `16`
    1. App Component Template `17`
    1. App Component Styles `18`
    1. App Component TypeScript `18`
6. Angular 2 Header Component `20`
    1. Add Header Element to App Component Template `21`
    1. Header Component Template `22`
    1. Header Component Styles `22`
7. Angular 2 Component Interaction `25`
    1. Header Component TypeScript `25`
    1. Header Communication with App Component `26`
8. Angular 2 Observables and DOM Properties `29`
    1. Add Observable to App Component TypeScript `29`
    1. Add DOM Property to App Component Template `31`
9. Angular 2 Footer Component `33`
    1. Footer Component TypeScript `33`
    1. Footer Component Template `34`
    1. Footer Component Styles `34`
    1. Add Footer to App Component Template `34`
10. Migrating Angular 2 Pages `36`
    1. Create Home, About, and 404 Page Components `36`
    1. Add Title Provider to App Module `36`
    1. Add Title to Page Components `37`
    1. Home Component Template `39`
    1. About Component Template `39`
    1. 404 Component Template `40`
11. Routing in Angular 2 `41`
    1. Create a Routing Module `41`
    1. Import Routing Module in App Module `43`
    1. Display Routed Components `43`
    1. Route Navigation `44`
    1. Router Events `45`
    1. Auto-close Menu in Header Component `45`
12. Calling an API in Angular 2 `47`
    1. Dinosaur API Data Model `47`
    1. Add HTTP Client Module to App Module `48`
    1. Get API Data with Dinos Service `49`
    1. Provide the Dinos Service in App Module `50`
    1. Use the Dinos Service in Home Component `51`
    1. Display a List of Dinosaurs `52`
13. Display Dino Cards `55`
    1. Dino Card Component TypeScript `55`
    1. Dino Card Component Template `56`
    1. Display Dino Card in Home Component `56`
14. Migrating Angular 1 Filtering to Angular 2 `58`
    1. No Filter or OrderBy Pipes `58`
    1. Create a Filter Service `59`
    1. Use Angular 2 Filter Service to Search `60`
        1. Filter in Home Component TypeScript `60`
        1. Filter in Home Component Template `62`
        1. Filter in Home Component Styles `63`
15. Migrating Detail Component to Angular 2 `65`
    1. Routing with Parameters `65`
    1. Linking to Routes with Parameters `66`
16. Calling the API for Data by ID `67`
    1. Create a Dino Details Model `67`
    1. Add HTTP Observable to Get Dinosaur by ID `68`
    1. Using API Data in Detail Component `69`
        1. Detail Component TypeScript `69`
        1. Detail Component Template `70`
        1. Detail Component Styles `72`
17. Loading State for API Calls `74`
    1. Loading Image Asset `74`
    1. Loading Component TypeScript `74`
    1. Add Loading Component to App Module `75`
    1. Add Loading Component to Home Component `76`
        1. Implement Loading Functionality in Home Component TypeScript `76`
        1. Implement Loading Functionality in Home Component Template `77`
    1. Add Loading Component to Detail Component `79`
        1. Implement Loading Functionality in Detail Component TypeScript `79`
        1. Implement Loading Functionality in Detail Component Template `80`
        1. Remove “Loading. . . ” Text from Index HTML `80`
18. Completed Migration `82`
    1. Refactoring Suggestions `82`
19. Bonus: Authenticate an Angular App and Node API with Auth0 `83`
    1. Features `84`
    1. Sign Up for Auth0 `85`
    1. Set Up a Client App `85`
    1. Set Up an API `85`
    1. Dependencies and Setup `85`
    1. Authentication Service `87`
    1. Making Authenticated API Requests `90`
    1. Final Touches: Route Guard and Profile Page `90`
    1. More Resources `91`
20. Conclusion `92`


Are you an Angular developer who hasn't had a practical opportunity to really dig into Angular v2+ yet? Do you have AngularJS 1.x applications in development, production, or maintenance and are curious how you would tackle migrating them to Angular 2+? If you have experience with AngularJS and are looking for a way to apply your previous knowledge while learning the intricacies of Angular, then this tutorial is for you.

Angular

eBook Migration an AngularJS App

migrating-to-angular2

#### Releases
- Angular application updated to Angular v4.3, including updates to the Angular CLI and HttpClient implementation.

Migrating an AngularJS App to Angular

migrating-to-angular2-tc

migrating-a-php5-app-to-php7

## Contents
1. Introduction `4`
    1. PHP5 and PHP7 `4`
2. Upgrading your development environment to PHP7 `6`
    1. Mac OS X `6`
    1. Windows `7`
    1. Ubuntu `7`
    1. Debian `8`
    1. Cent OS / Red Hat Enterprise Linux `8`
    1. phpbrew `9`
    1. Vagrant `11`
        1. Laravel Homestead `11`
        1. phpdev `12`
    1. Valet `12`
    1. Docker `15`
        1. php7-dockerized `15`
        1. Laradock `15`
        1. phpdocker `16`
3. Elementary Language Changes `17`
    1. SpaceShip operator `17`
    1. Array Constants `19` 
    1. Null Coalescing Operator `19`
    1. Integer Division `20`
    1. Regular Expressions `20`
    1. Filtered unserialize() `21`
        1. Cryptographically Secure Pseudorandom Number Generator (CSRPNG) `22`
        1. session_start config enhancements `22`
        1. Unpack objects with list() `22`
        1. dirname() enhacement `23`
        1. Reflection API Enhancements `23`
        1. Reserved Words `24`
4. Scalar Typehinting & Return type declarations `26`
    1. Typehinting `26`
    1. Return Types `27`
    1. Strong types checks `28`
5. Error handling, Expections and Assertions `29`
    1. Expections and Assertions `30`
6. Closures and Generators `32`
    1. Generator return expressions `33`
    1. Generator Delegation `33`
7. Object-oriented Programming enhancement `35`
    1. Anonymous Classes `35`
    1. Group Use Declarations `36`
8. Better Unicode support `37`
    1. IntlChar `38`
9. Deprecated and removed features `39`
    1. Removed extensions and Server APIs `40`
    1. Backward Incompatible changes `41`
10. Uniform Variable syntax and static values `43`
    1. Accessing static values `43`
11. Migration Tools `45`
    1. PHP 7 MAR `45`
    1. PHP 7 Compatibility Checker `46`
    1. Phan `46`
    1. phpto7aid `46`
    1. PhpStorm PHP 7 Compatibility Inspection `46`
12. Practial Migration of two Apps `48`
    1. Building a PHP5 App `48`
        1. Create and configure Auth0 client `48`
        1. Build the App `53`
        1. Run the App `62`
        1. Migrate to PHP 7 `64`
    1. API `64`
        1. Use PHP 7 Features `66`
13. Introducing PHP 7.1 Features `71`
    1. Nullable Types `71`
    1. Void Type `72`
    1. Symmetric Array Destructuring `72`
    1. Class constant visibility `73`
    1. Multi-Catch Exception Handling `73`
    1. Iterables `74`
    1. Keys support in list() `74`
    1. Negative string Offset Support 75
    1. Conversion of Callables to Closures `75`
    1. Asynchronous Signal Handling `76`
    1. Support for HTTP/2 Server Push `76`
    1. Better Error Retrieval `76`
    1. Throw Error on Passing too fews functions arguments `77`
14. Performance Evaluation `78`
15. Conclusion `85`

Many PHP applications are still running on PHP 5.x, not taking full advantage of the awesome features that PHP 7 offers.
A lot of developers have not made the switch because of certain fears of compatibility issues, migration challenges, and the awkward feeling that migrating their apps will take away a big chunk of their time.
If you are looking for a way to understand PHP 7 features like a boss, and migrate that PHP 5 app without hitting your head against the wall, then this handbook is for you.

eBook PHP

migrating-to-php7

#### Releases
- Setup and development environment.
- A comprehensive rundown of PHP 7 features.
- Migrating an API and a Web Application to PHP 7.

Migrating a PHP 5 app to PHP 7 Guide

migrating-to-php7-tc

jwt-handbook

## Contents
1. Special Thanks `4`
1. Introduction `5`
    1. What is a JSON WebToken? `5`
    1. What problem does it solve?  `6`
    1. A little bit of history  `6`
1. Practical Applications `8`
    1. Client-side/Stateless Sessions `8`
        1. Security Considerations  `9`
            1. Signature Stripping  `9`
            1. Cross-Site Request Forgery (CSRF)  `10`
            1. Cross-Site Scripting (XSS) `11`
        1. Are Client-Side Sessions Useful? `13`
        1. Example  `13`
    1. FederatedIdentity  `16`
        1. Access and Refresh Tokens `18`
        1. JWTs and OAuth2  `19`
        1. JWTs and OpenID Connect  `20`
            1. OpenID Connect Flows and JWTs `20`
        1. Example  `20`
            1. Setting up Auth0 Lock for Node.js Applications `21`
1. JSON Web Tokens in Detail `23`
    1. The Header `24`
    1. The Payload  `25`
        1. Registered Claims  `25`
        1. Public and Private Claims  `26`
    1. Unsecured JWTs `27`
    1. Creating an Unsecured JWT  `27`
        1. Sample Code  `28`
    1. Parsing an Unsecured JWT `28`
        1. Sample Code  `29`
1. JSON Web Signatures `30`
    1. Structure of a Signed JWT  `30`
        1. Algorithm Overview for Compact Serialization `32`
        1. Practical Aspects of Signing Algorithms  `33`
        1. JWS Header Claims  `36`
        1. JWS JSON Serialization `36`
            1. Flattened JWS JSON Serialization `38`
    1. Signing and Validating Tokens  `38`
        1. HS256: HMAC 1. SHA-256  `39`
        1. RS256: RSASSA 1. SHA256 `39`
        1. ES256: ECDSA using P-256 and SHA-256 `40`
1. JSON Web Encryption (JWE) `41`
    1. Structure of an Encrypted JWT `44`
        1. Key Encryption Algorithms `45`
            1. Key Management Modes `46`
            1. Content Encryption Key (CEK) and JWE Encryption Key `47`
        1. Content Encryption Algorithms `48`
        1. The Header `48`
        1. Algorithm Overview for Compact Serialization `49`
        1. JWE JSON Serialization `50`
            1. Flattened JWE JSON Serialization `52`
    1. Encrypting and Decrypting Tokens `52`
        1. Introduction: Managing Keys with node-jose `52`
        1. AES-128 Key Wrap (Key) 1. AES-128 GCM (Content) `54`
        1. RSAES-OAEP (Key) 1. AES-128 CBC 1. SHA-256 (Content) `54`
        1. ECDH-ESP-256 (Key)1. AES-128 GCM (Content) `55`
        1. Nested JWT: ECDSA using P-256 and SHA-256 (Signature) 1. RSAES-OAEP (Encrypted Key) 1. AES-128 CBC 1. SHA-256 (Encrypted Content) `55`
        1. Decryption `56`
1. JSON Web Keys (JWK) `58`
    1. Structure of a JSON Web Key `59`
        1. JSON Web Key Set `60`
1. JSON Web Algorithms `61`
    1. General Algorithms `61`
        1. Base64 `61`
            1. Base64-URL `63`
            1. Sample Code `63`
        1. SHA `64`
    1. Signing Algorithms `69`
        1. HMAC `69`
            1. HMAC 1. SHA256 (HS256) `71`
        1. RSA `73`
            1. Choosing e, d and n `75`
            1. Basic Signing `76`
            1. RS256: RSASSA PKCS1 v1.5 using SHA-256 `76`
                1. Algorithm `76`
                    1. EMSA-PKCS1-v1_5 primitive `78`
                    1. OS2IP primitive `79`
                    1. RSASP1 primitive `79`
                    1. RSAVP1 primitive `80`
                    1. I2OSP primitive `80`
                1. Samplecode `81`
            1. PS256: RSASSA-PSS using SHA-256 and MGF1 with SHA-256 `86`
                1. Algorithm `86`
                    1. MGF1: the mask generation function `87`
                    1. EMSA-PSS-ENCODE primitive `88`
                    1. EMSA-PSS-VERIFY primitive `89`
                1. Sample code `91`
        1. Elliptic Curve `94`
            1. Elliptic-Curve Arithmetic `96`
                1. Point Addition `96`
                1. Point Doubling `97`
                1. Scalar Multiplication `97`
            1. Elliptic-Curve Digital Signature Algorithm (ECDSA) `98`
                1. Elliptic-Curve Domain Parameters `100`
                1. Public and Private Keys `101`
                    1. The Discrete Logarithm Problem `101`
                1. ES256: ECDSA using P-256 and SHA-256 `101`
    1. Future Updates `104`


Ever wondered how JWT came to be and what problems it was designed to tackle?
Are you curious about the plethora of algorithms available for signing and encrypting JWTs?
Or are you interested in getting up-to-speed with JWTs as soon as possible? Then this handbook is for you.

eBook JWT Handbook

#### New:
- Added Annex A: JWT Best Current Practices (based on draft from IETF OAuth Working Group)

#### Fixes:
- Changed deprecated Pandoc command line parameter.
- Fixed typos.

JWT Handbook

jwt-handbook-tc

authentication-survival-guide

## Contents
1. Special Tanks `4`
1. Introduction `5`
1. Concepts `7`
1. OAuth 2.0 `8`
1. OpenID Connect `12`
1. Enterprise Protocols `14`
    1. SAML `15`
    1. WS-Federation `16`
1. Brief look into the past (OpenID and OAuth 1.0a) `18`
1. Token overload `19`
    1. Formats `20`
    1. Types `22`
    1. Storage `27`
    1. But I love my cookies `31`
1. Troubleshooting `33`
    1. It's just HTTPS `33`
    1. Tools `36`
1. Pitfalls `38`
1. Glossary `40`


This book aims to be an accessible starting point for everyone that is starting to work with authentication.
    In this book, you'll find a concise review of all the key protocols, formats, concepts and terminology that you'll likely
    come across when implementing authentication.

Authentication Survival Guide

eBook Authentification Survival Guide

#### Releases
- Authentication terminology.
- OAuth 2.0
- OpenID Connect.
- Enterprise protocols.
- Tokens tokens tokens.
- Troubleshooting tips.

survival-guide-tc

SC-Magazine-Product-Review-Identity-Management-Auth0

0. Introduction
1. Strengths
2. Weaknesses 
3. Verdict



Identity and access management products are vital to enterprise security across industries and greatly enhance existing security investments. In addition to bringing in an extra layer of security and going a step farther with data loss prevention, their capabilities and features can increase productivity and overall return on investment.  

In this report, SC Labs examines Auth0, a cloud-based identity solution offering a universal authentication and authorization platform that protects the identities of all user types in any application. 

From SC Media. ©2020 CyberRisk Alliance, LLC.  All rights reserved. Used under license.

SC Magazine Product Review

Resources Page Cover (2)

Resources Page Share Asset (3) (1)

SC Magazine Product Review: Identity and Access Management - Auth0

Infographic: Building Constituent Trust

What you need to know about:
1. Building IAM
2. Buying IAM
3. Doing both


__A Better Way to Implement Identity and Access Management:__
State and local government organizations traditionally faced a tough choice on access management tools: Build it yourself or buy it off the shelf from a third-party vendor? In this infographic, see how organizations today can do both.

Gartner Peer Insights Ebook Auth0

I. What Is Access Management?
II. What Is Gartner Peer Insights “Voice of the Customer”?
III. What Is the Gartner Peer Insights Customers’ Choice?

In April 2021, Auth0 was recognized with Gartner Peer Insights’ Customers’ Choice distinction for Access Management. The recognition, along with the review criteria for the distinction, are found in Gartner’s annual Voice of the Customer document. This eBook discusses what Gartner Peer Insights and its recognitions are, as well as highlights Auth0’s placement. 

Gartner Peer Insights Customers’ Choice constitute the subjective opinions of individual end-user reviews, ratings and data applied against a documented methodology; they neither represent the views of, nor constitute an endorsement by, Gartner or its affiliates.

[Share Asset] Guide (Square)

gartner-cover-image

Voice of the Customer: Access Management

gartner-share-horizontal

OAuth2 e OpenID Connect: o Guia Profissional

Este e-book explicará tudo o que você precisa saber sobre o OAuth2 e o OpenID Connect.

A autenticação e a autorização são partes críticas de qualquer aplicativo. Elas evoluíram ao longo dos anos para atender aos requisitos desafiadores da Web moderna. O OAuth2 e o OpenID Connect oferecem uma estrutura para tratá-las de maneira eficaz. 

Aprenda as melhores práticas no uso de ambos os padrões em diferentes cenários e tipos de aplicativos. Este e-book explicará tudo o que você precisa saber sobre o OAuth2 e o OpenID Connect.

OAuth2 e OpenID Connect: Guia Profissional

Autenticação após senhas

- Apresentação
- O futuro da identidade
- A necessidade do acesso sem atrito
- Fluxos de identidade são elementos fundamentais da jornada do cliente
- O que vem primeiro: Autenticação Passwordless
- O roteiro do acesso sem login
- Resumo
- O que você pode fazer agora

Desde melhorar a experiência do cliente por meio do login único (SSO) até tornar a autenticação multifator (MFA) rápida e fácil, sua caixa de login precisa encontrar o equilíbrio certo entre a conveniência, a segurança e a privacidade do usuário.

De fato, acreditamos que as empresas que terão sucesso nos próximos cinco anos serão as mais bem equipadas para atender às crescentes expectativas do consumidor para esses três atributos. Mas como será esse futuro e por qual caminho as empresas de hoje podem se tornar os líderes de amanhã?

Neste ebook, responderemos a essas perguntas e analisaremos mais a fundo o futuro da autenticação e os impactos do passwordless.

Manual do JWT

Agradecimentos especiais

Capítulo 1
Introdução
1.1 O que é um JSON Web Token?
1.2 Que problema ele resolve?
1.3 Um pouco de história

Capítulo 2
Aplicações práticas
2.1 Sessões do lado do cliente/sem estado
2.1.1 Considerações de segurança
2.1.1.1 Remoção de assinatura
2.1.1.2 Falsificação de solicitação entre sites (CSRF)
2.1.1.3 Cross-site Scripting (XSS)
2.1.2 As sessões do lado do cliente são úteis?
2.1.3 Exemplo
2.2 Identidade federada
2.2.1 Tokens de acesso e atualização
2.2.2 JWTs e OAuth2
2.2.3 JWTs e OpenID Connect
2.2.3.1 Fluxos OpenID Connect e JWTs
2.2.4 Exemplo

Capítulo 3
JSON Web Tokens em detalhes
3.1 O header
3.2 O payload
3.2.1 Claims registrados
3.2.2 Claims públicos e privados
3.3 JWTs não protegidos
3.4 Criação de um JWT não protegido
3.4.1 Código de exemplo
3.5 Análise de um JWT não protegido
3.5.1 Código de exemplo

Capítulo 4
JSON Web Signatures
4.1 Estrutura de um JWT assinado
4.1.1 Visão geral do algoritmo para serialização compacta
4.1.2 Aspectos práticos de algoritmos de assinatura
4.1.3 Claims do header do JWS
4.1.4 Serialização JWS JSON
4.1.4.1 Serialização JSON do JWS achatada
4.2 Assinatura e validação de tokens
4.2.1 HS256: HMAC + SHA-256
4.2.2 RS256: RSASSA + SHA256
4.2.3 ES256: ECDSA usando P-256 e SHA-256

Capítulo 5
JSON Web Encryption (JWE)
5.1 Estrutura de um JWT criptografado
5.1.1 Algoritmos de criptografia de chave
5.1.1.1 Modos de gerenciamento de chaves
5.1.1.2 Chave de criptografia de conteúdo (CEK) e chave de criptografia JWE
5.1.2 Algoritmos de criptografia de conteúdo
5.1.3 O header
5.1.4 Visão geral do algoritmo para serialização compacta
5.1.5.1 Serialização JSON do JWE achatada
5.2 Criptografia e descriptografia de tokens
5.2.1 Introdução: gerenciamento de chaves com node-jose
5.2.2 AES-128 Key Wrap (Chave) + AES-128 GCM (Conteúdo)
5.2.3 RSAES-OAEP (Chave) + AES-128 CBC + SHA-256 (Conteúdo)
5.2.4 ECDH-ES P-256 (Chave) + AES-128 GCM (Conteúdo)
5.2.5 JWT aninhado: ECDSA usando P-256 e SHA-256 (assinatura) + RSAES-OAEP (chave criptografada) + AES-128 CBC + SHA-256 (conteúdo criptografado)
5.2.6 Descriptografia

Capítulo 6
JSON Web Keys (JWK)
6.1 Estrutura de um JSON Web Key
6.1.1 JSON Web Key Set
Capítulo 7
Algoritmos JSON Web
7.1 Algoritmos gerais
7.1.1 Base64
7.1.1.1 Base64-URL
7.1.1.2 Código de exemplo
7.1.2 SHA
7.2 Algoritmos de assinatura
7.2.1 HMAC
7.2.1.1 HMAC + SHA256 (HS256)
7.2.2 RSA Figura 7.4: Expressão básica do RSA
7.2.2.1 Escolha de e, d e n Figura 7.5: Simetria entre e e d
7.2.2.2 Assinatura básica
7.2.2.3 RS256:  RSASSA PKCS1 v1.5 usando SHA-256
7.2.2.3.1 Algoritmo
7.2.2.3.1.1 Primitiva EMSA-PKCS1-v1_5
7.2.2.3.1.2 Primitiva OS2IP Figura 7.7: Resultado da OS2IP
7.2.2.3.1.3 Primitiva RSASP1 Figura 7.8: Resultado de RSASP1
7.2.2.3.1.4 Primitiva RSAVP1 Figura 7.9: Resultado de RSAVP1
7.2.2.3.1.5 Primitiva I2OSP Figura 7.10: Decomposição de I2OSP
7.2.2.3.2 Código de exemplo
7.2.2.4 PS256: RSASSA-PSS usando SHA-256 e MGF1 com SHA-256
7.2.2.4.1 Algoritmo
7.2.2.4.1.1 MGF1: a função de geração de máscara
7.2.2.4.1.2 Primitiva EMSA-PSS-ENCODE
7.2.2.4.1.3 Primitiva EMSA-PSS-VERIFY
7.2.2.4.2 Código de exemplo
7.2.3 Curva elíptica Figura 7.11: Equação da curva elíptica Figura 7.13: Função exponencial
7.2.3.1  Aritmética da curva elíptica
7.2.3.1.1 Adição de pontos Figura 7.14: Adição de pontos
7.2.3.1.2 Duplicação de pontos Figura 7.15: Duplicação de pontos
7.2.3.1.3 Multiplicação escalar Figura 7.16: Multiplicação escalar
7.2.3.2 Algoritmo de assinatura digital de curva elíptica (ECDSA)
7.2.3.2.1 Parâmetros de domínio de curva elíptica
7.2.3.2.2 Chaves públicas e privadas
7.2.3.2.2.1 O problema do logaritmo discreto Figura 7.17: Chave privada como o logaritmo da chave pública
7.2.3.2.3 ES256:  ECDSA usando P-256 e SHA-256 Figura 7.18: s
7.3 Atualizações futuras

Capítulo 8
Anexo A. Práticas recomendadas atuais
8.1 Armadilhas e ataques comuns
8.1.1 Ataque “alg:  none”
8.1.2 Ataque de chave pública RS256 como segredo HS256
8.1.3 Chaves HMAC fracas
8.1.4 Pressuposições erradas de verificação empilhada de criptograf + assinatura
8.1.5 Ataques de curva elíptica inválida
8.1.6 Ataques de substituição
8.1.6.1 Destinatário diferente
8.1.6.2 Mesmo destinatário/JWT cruzado
8.2 Mitigações e práticas recomendadas
8.2.1 Executar sempre a verificação de algoritmo
8.2.2 Usar algoritmos adequados
8.2.3  Sempre realizar todas as validações
8.2.4  Sempre validar as entradas criptográficas
8.2.5  Escolher chaves fortes
8.2.6 Validar todos os claims possíveis
8.2.7 Usar o claim typ para separar tipos de tokens
8.2.8 Usar regras de validação diferentes para cada token
8.3 Conclusão

Já se perguntou como o JWT surgiu e quais problemas foi projetado para resolver? Você tem curiosidade sobre a infinidade de algoritmos disponíveis para assinar e fazer o encrypt de JWTs? Ou você tem interesse em começar a usar os JWTs o mais rápido possível?

Então este manual é para você.

Resources