« first day (3342 days earlier)      last day (1613 days later) » 

4:04 PM
Hi guys.
I'm using a JWT OAuth2 APIe
API*
 
Ok?
@HassanAlthaf Are you also using node and need suggestions on how to handle the token issued by your authorization server?
 
The API provides 2 tokens:

- client_secret, this is used to validate valid clients. I have wrapped it with a middle-man server, as previously I only had a front-end that communicated with a 3rd party API
The second token would be the Authorization token
Once the user is authorized, the token must be passed as "Authorization: Bearer <token here>" header.
 
I did a bit of research, some sites suggest it's safe to store it in a cookie, while some suggest it leaves it exposed to CSRF.
I'm confused.. localStorage and sessionStorage apparently make you exposed to XSS.
My front-end uses React.
React SPA.
 
Oh that sounds dangerous
(ignore my troll / ogre nature above)
@HassanAlthaf how do you get the token?
 
4:11 PM
The Web API uses Laravel Passport
The manager of the API provided me with the token
Bby token, I mean client_secret, that identifies the client. (Like a product key?)
The other token
I get user input: email, password
From React,
And send it to my middle-man server
My middle-man server which is an actual backend,
Adds in the client_secret to the request
because since it is plaintext and needs to be hardcoded, there's no way to store it in a react app, without it getting exposed
The request is then sent to the destination API, the results are fetched and returned to my react app
@ShrekOverflow So, what do you think I should do?
The second token would be the Authorization token
Once the user is authorized, the token must be passed as "Authorization: Bearer <token here>" header.

I am having trouble here.
 
user10864482
so you receive secret in the front end?
 
no.
the client_secret is stored in the middle-man server
Hard-coded as a string somewhere in the config.
Only the Bearer Token, after authentication of a user in that app
Has to be persisted in the front-end app
To remember the user
@ShrekOverflow Not Node really, it's a PHP Laravel API on the server side.
 
4:27 PM
Lemme read
 
A'ight man.
 
This sounds ultra dodgy as - is
 
I'm kind of proud of this. I'm creating a treeview table and I wanted to show branch lines connecting the parents and children. I used inline SVG background images, generated on the fly as the javascript was generating the table from the JSON.
 
Maybbe I've done a bad job explaining
 
Usually what I'd recommend is abstracing the IDM layer to a server
 
4:28 PM
IDM?
 
and then that server has a stateful session
@HassanAlthaf Identity Management (whatever user login logic you have)
so basically you login to say accounts.yourapp.com
Then app.yourapp.com can basically get a new token anytime beyond that point
thereby it has no need to store the token or anything
 
if you already have some kind of login system use that
 
Ok, I think I might have confused you a ibt.
Ok, let me explain.
 
Well, Im going to ask this question again since there are new people...

Does ANYONE know how to use web components?? Im making a custom HTML tag, and I followed an "Uptodate" tutorial about using the custom elements from here: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements

and I created this code based off of that tutorial:
 
4:29 PM
By chance are you using Auth0 or
Okta
 
class CConR extends HTMLElement {
 constructor() {
  super();
  let sh = this.attachShadow({mode: 'open'});
  let st = document.createElement('style');
  st.textContent = "r-r{color:red;}";
  sh.appendChild(st);
 }
}
var CConElR = customElements.define('r-r', CConR);
 
or Azure AD ?
 
It's a Laravel API
 
it causes my elements to be almost "invisible"
 
Uses Oauth2
 
4:30 PM
your token provider
So your laravel server is exposing an OAuth 2 api?
 
Ok, let me explain as well as possible.
Ever heard of Passport?
 
> Adds in the client_secret to the request because since it is plaintext and needs to be hardcoded, there's no way to store it in a react app, without it getting exposed

Sounds like you are doing something with either Resource Owner Password Grant
or CCG
 
Previously,
 
Im not trying to be a help vampire, but I feel like no one can even hear me
 
It was just a Laravel API
The resource owner, provides me with a client_id and client_secret
 
4:31 PM
@TaylorS I hear you
 
There's no authentication done to get that.
It's done in person.
 
@HassanAlthaf who owns the users?
you or the resource owner?
 
resource owner.
the users are stored on the resource owners end
once I get the client_secret from him,
I make a front-end app for the API.
Make lets say Login, Dashboard, few analytics from the data provided, etc.
Ok, so for the Login, I need to call the API. Now I faced one challenge here.
How do I protect the client_secret and client_id from the Resource Owner?
Neil in this group suggested that I add a back-end server that adds the headers for me =)
That's the client_id and client_secret
 
You shouldn't be accepting the user's passwords then
 
Then comes my app
 
4:34 PM
you should be able to ask for the user's access token via OAuth
 
Has a login page
user enters credentials
 
if the RO owns the user then RO should expose a protocol that your app simply consumes
 
Lets just say
 
No
Stop right there
 
the RO owns both my app and the API itself.
 
4:35 PM
@HassanAlthaf Are these user's credentials for the RO's service or your service or are they the same?
If they are the same I cannot stress how janky this is, and you should totally change this if possible
 
both use the same. my service is to provide a frontend to the RO's service.
 
Then you should get the token over OAuth
perhaps using Authorization Code grant
 
instead of having your backend marshall the credentials
 
Authorization Code grant
 
4:36 PM
IF yu are using authorization code grant
 
Requires a username and password
 
Authorization code grant doesn't require a username and password, that is its design goal
 
I have no clue why Laravel does that.
If you've heard of Passport.js its the same thing ported to PHP
 
does no one here know how to use web components
 
I know the author of passport.js :P
 
4:37 PM
I cant find anything online
 
worked with him
 
awesome guy!
 
developer.mozilla.org/en-US/docs/Web/Web_Components/… This sort of thing is supposed to be useful
 
@HassanAlthaf I didn't read the entire thing but storing an auth token in a cookie is fine.
 
I even went to the point of copy pasta-ing the code and it still didnt work
 
@JBis I heard problems aout CSRF
 
@TaylorS fix it
 
> Laravel Passport is native OAuth 2 server for Laravel apps
 
about*
 
4:38 PM
I dont know how
 
@JBis depends on what that token is doing
 
theres no errors, the tutorial is followed by the official documentation
 
and who is it issued by
 
@HassanAlthaf Yes. CSRF tokens can be stored in cookies
 
it doesnt make sense
 
4:38 PM
thats fine
 
and what is the threat model around it
@JBis I'd recommend your closest browser tab to visit the owasp guide on that
 
@JBis So, it does mean that I need to implement some CSRF preventionn mechanism?
 
If they can access the users cookies, there are bigger issues.
 
@JBis can you please shut up?
 
@ShrekOverflow I've read it a bunch of times
 
4:39 PM
you are completely derailing the convo
 
@JBis Every request sends all the cookies to the relevant domain
 
cookies / tokens are pointless
if this person is literally accepting a 3rd party credential in their app
at that point his app theoritically has full access to the RO
 
> I didn't read the entire thing....
 
ok resume (sorry about the rudeness)
 
Yes, full access.
Basically, I have access to the source code as well.
Except for the rights to modify.
 
4:41 PM
@ShrekOverflow I was NOT saying what he was doing was ok. I was simply saying that storing CSRF tokens or auth tokens in a cookie are ok.
 
@JBis Which is why I humbly asked you to stop
 
HAMMERTIME!
 
I followed this:
https://help.github.com/en/github/authenticating-to-github/working-with-ssh-key-passphrases

and it STILL asks me for username on github and password..... what is going on
 
@JBis vOv they are risky
but yeah they are fine
 
"can you please shut up?" quite humble ._.
 
4:41 PM
so long as you don't need a frontend that is not web
 
@ShrekOverflow how?
 
@JBis That is as humble as I get
 
Your italics (should) suggest otherwise
 
@ShrekOverflow The current API lets say is integrated with a mobile app
Which is outdated and broken due to the API updates.
 
@JBis I have seen many many people mess that by not realizing what that actually means (aka, letting people make XHR calls not cors blocked etc)
 
4:42 PM
So the current scope is to get a Web interface working with React first, and work on moile apps after that.
 
also I have seen folks store ATs issued for a backend service in to the cookie
where they are now available to the FE 😃 with way more permissions
as a "caching mechanism"
 
@ShrekOverflow Thats a bad argument
CORS is a different issue entirely
 
@ShrekOverflow I came up with another idea.
 
I will stop discussing as I have not read the entire convo.
 
@JBis Yes.
 
4:44 PM
letting the client authenticate is risky
 
CORS is a different problem altogether
 
@user400654 The client and the API are both owned by the same organization, just two separate development teams.
 
what I am trying to communicate is you need to understand what cookies open your backend to
 
Why does git still keeps asking for github username after i have added ssh?
 
@HassanAlthaf Laravel Passport doesn't look like passport.js
Passport.js is a client
Laravel Passport looks like a server
 
4:46 PM
My bad in that case, I read somewhere that it was ported as a PHP thing
 
You probably need an oAuth client for PHP and simply point it to your ROs server
If your app is purely frontend
 
It was purely frontend, but to protect the client credentials
We wrapped the API calls
 
and your authorization server supports issuing frontend tokens directly you can use something like openid-client purely in the browser without the backend altogether
 
On a middle-man server
 
@ShrekOverflow A kinda of relevant package I made: npmjs.com/package/csurf-login-token
 
4:48 PM
@JBis source?
 
It's supposed to be linked on the page but must have gotten screwed up
 
@HassanAlthaf I would encourage you to talk to whoever you are writing this frontend for, and then figuring out what capabilities the backend supports
 
Wait I think you're confused.
The ROs backend is Laravel PHP Passport
 
Jeebus
 
The backend issues login tokens when u provide username, password
And then with that login token, you can access restricted content
 
4:50 PM
You said your application accepts the tokens from the user?
 
well I am way too confused now :P
 
lol
There's TWO tokens
One is from the RO
Client Credentials
 
If your application is purely a frontend to the ROs application why do you need another token?
 
With that, the frontend has permission to even connect to the ROs services
Without that, the services would deny to serve the frontend
 
4:52 PM
@JBis <3 I like it
but havent't read the whole code
You should apply 😛 for us x)
I'll be happy to recommend you
 
Now, the content that is not restricted, can be accessed with that client credentials.
However, if you want to gain access to restricted content
You need to authenticate your self.
You enter your credentials in the frontend.
 
That makes 100% sense
what doesn't make is why do you need a CCG for this
Lets assume api.com as the RO
hassan.com as a pure react Frontend
and passport.com as the token provider
 
The front-end sends them to to the server for you and obtains a code to represent you and your actions.
 
@ShrekOverflow Thanks :)
 
the token provider and the RO are the same.
 
4:54 PM
@ShrekOverflow wdym?
 
hassan.com - request authorization -> passport.com
passport.com - (access token) -> hassan.com
hassan.com - Request with (access token) -> api.com
@JBis Auth0.com
 
hi peeps
 
Noooooooooo this is not how it works
 
can anyone recommend the best html renderer for react-native?
 
The authorization step is manual. A key is generated on the ROs end.
 
4:55 PM
@HassanAlthaf I know, that is how it should work
 
Let me explain
The keys is generated and passed to the client. This is not done using digital transmission.
 
I can understand your backend calling the RO but I can't undersatnd why would the RO want to lose all user scoped access
 
simple as copying the code to a text file and storing it in a pendrive for future
@ShrekOverflow I don't get you
Its like this
hassan.com (request authorization) -> server.hassan.com
 
@JBis we are hiring 😛, and I noticed your gh mentions "PLS HIRE ME"
 
@ShrekOverflow Thanks. Didn't know you hired 16 year olds ;)
 
4:58 PM
server.hassan.com (forwards request after adding the client credentials) -> api.com
 
@JBis vOv are you 16? That might work differently lol
but if the law allows we'd probably end up hiring you
 
api.com (returns token for user with valid username, password)
 
Hassan press shift + enter to create a multiline message
 
hassan.com (uses the token above to access restricted content(
 
@ShrekOverflow actually? cool. I'll take a look. Thanks :)
 
4:59 PM
@ShrekOverflow owh i didn't realize lol. Thanks <3
 
@JBis I'd personally mention your bot sandboxing it is pretty damn good and this module hwich I think is great!
 

« first day (3342 days earlier)      last day (1613 days later) »