Authentication

Authentication

Basic Auth

• Basic access authentication is a method for an HTTP user agent (e.g. a web browser) to provide a user name and password when making a request
• Server side
  • When the server wants the user agent to authenticate itself towards the server, the server must respond appropriately to unauthenticated requests
  • To unauthenticated requests, the server should return a response whose header contains a HTTP 401 Unauthorized status
• Client side
  • When the user agent wants to send authentication credentials to the server, it may use the Authorization field
• URL encoding
  • A client may avoid a login prompt when accessing a basic access authentication by prepending username:password@ to the hostname in the URL

Intro to JWT

• JSON Web Token (JWT) is an open standard that defines a compact and self-contained way for securely transmitting information between parties as a JSON object
• This information can be verified and trusted because it is digitally signed
• Signed tokens can verify the integrity of the claims contained within it
• Encrypted tokens hide those claims from other parties
• When should you use JSON Web Tokens?
  • Authorization: This is the most common scenario for using JWT
    • Once the user is logged in, each subsequent request will include the JWT, allowing the user to access routes, services, and resources that are permitted with that token
  • Information Exchange: JSON Web Tokens are a good way of securely transmitting information between parties
• What is the JSON Web Token structure?
  • JSON Web Tokens consist of three parts separated by dots (.)
    • Header
      • The type of the token, which is JWT
      • The signing algorithm being used, such as HMAC SHA256 or RSA
    • Payload
      • Contains the claims
      • Claims are statements about an entity (typically, the user) and additional data
      • There are three types of claims: registered, public, and private claims
    • Signature
      • To create the signature part you have to take the encoded header, the encoded payload, a secret, the algorithm specified in the header, and sign that

OWASP Auth Cheatsheet

• Authentication is the process of verifying that an individual, entity or website is who it claims to be
• Session Management is a process by which a server maintains the state of an entity interacting with it
• Authentication General Guidelines
  • Make sure your usernames/userids are case insensitive
  • A key concern when using passwords for authentication is password strength
    • A "strong" password policy makes it difficult or even improbable for one to guess the password through either manual or automated means
  • Implement Secure Password Recovery Mechanism
  • Application must respond with a generic error message regardless of whether:
    • The user ID or password was incorrect
    • The account does not exist
    • The account is locked or disabled
  • Multi-factor authentication (MFA)

Resources

• Bcrypt Docs
• Jsonwebtoken Docs