Authentication as a Microservice: Portable Customer Identity Management

on YouTube ↗38m

" summary

Argues for replacing session state with JSON Web Token payloads verified by RSA or HMAC, warns about the “none” and HMAC->RSA key tricks, and recommends fetching keys from a well-known JWKS endpoint and rotating by kid. Describes locking long-lived refresh tokens to device storage, using cookies or secure keychains, and a webhook-driven revocation window (example: 30 minute JWT lifetime) plus three scopes for kills: global/app/user revocation. Notes performance costs (bcrypt, RSA signing) and that these approaches scale if cached and lightweight.

AI-written summary · about

" chapters (23)

1. 0:00Introduction
2. 2:09How did we log into these apps
3. 3:32Cookies are secure
4. 4:16Why is this painful
5. 5:49The evolution
6. 6:44Tokenization
7. 8:04Token Mapping
8. 9:07JSON Web Token
9. 10:01Header and Body
10. 11:08Signature
11. 11:21Select Change
12. 11:39Show Code
13. 12:26No Signature
14. 13:06HMAC Hack
15. 14:22RSA Public Key
16. 16:17Verifying RSA Signature
17. 16:36Rotating Keys
18. 16:49Key ID
19. 17:03JSON
20. 17:15Hackproof Security
21. 20:46Refresh Tokens
22. 25:16Revocation
23. 30:29Auth to access tokens

" related talks

• 01h 06mMicroservice Authentication and AuthorizationNic Jackson · DevOpsCon Berlin 2018
• 32mPortable Sessions with JSON Web TokensLance Ivy · RailsConf 2017
• 34mStateless Auth w/ JSON Web TokensDamir Svrtan · Southeast Ruby 2017
• 39mMicroservice Security via MicroProfile JWTJonathan Gallimore · EclipseCon Europe 2018
• 37mKnock knock, who's there? Authenticating your single page apps using JSON Web TokensSam Bellen · Jfokus 2019
• 32mREST security essentialsAleksandar Radisavljević · Heapcon 2019
• 29mKnock knock, who's there? Authenticating your single page apps using JSON Web TokenSam Bellen · AngularDay 2019
• 40mKnock knock, who's there? Authenticating your single page apps using JSON Web TokensSam Bellen · GrillJS 2019