9 min read
Updating an application to use OAuth 2.0 doesn't need to be complicated. Most of the time, your language or framework will already have an OAuth library. Sometimes, this isn't the case, and you need to find an alternative. In this post, I'll walk through setting up and using OAuth2 Proxy…
Read moreAnyone who has tried to type a password using a television remote can tell you what a pain it is. Not only will you be frustrated with the keyboard, but it's not secure; everyone else in the room can see what you are typing. Fortunately, the OAuth 2.0 Device Authorization…
Read moreIf you're developing a web application, chances are you want your dev environment as close to production as possible. One of the often-overlooked differences between local development and production servers is the use of Transport Layer Security (TLS), or Hypertext Transfer Protocol Secure (HTTPS). In this post, I'll cover three…
Read more4 min read
Most applications require some sort of secret or password to enable access: database connection info, API keys, OAuth client secrets, and JWT keys, to list some examples. Dealing with secrets in your projects is always a chore, and it's often done wrong. In this post, I'll describe five common problems,…
Read moreIn August, Okta's developer relations team invited intrepid developers to participate in the virtual Okta Identity Engine Early Access Hackathon, and challenged them to build a working app with our limited availability new customer identity and access management (CIAM) platform. A month or so after, judges convened, winners were announced,…
Read moreWe all know that all software has bugs and that security is hard, but somehow we are still surprised when we see new vulnerabilities.
Read moreA common OAuth 2.0 question we get: "How do I deal with OAuth in a load-balanced application?" The short answer: There's nothing specific about session clustering for OAuth. The longer answer is—you likely still need to worry about cluster session management. This post will discuss how an OAuth login relates…
Read moreContent negotiation allows for an HTTP server to respond to different types of clients. Many modern clients expect a JSON response, but there may be a need to format responses differently, maybe XML for older clients or a binary format for newer ones. Content negotiation is the mechanism used to…
Read more2 min read
Setting up a new YubiKey as a second factor is easy—your browser walks you through the entire process. However, setting up a YubiKey to sign your Git commits and Secure Shell (SSH) authentication is a very different experience. In this post, I'll walk through configuring a YubiKey and highlight some…
Read more4 min read
JSON Web Tokens (JWT) are used everywhere (even places they shouldn't be). This post will cover the basics of what you need to know about JWT and the related specifications in the Javascript Object Signing and Encryption (JOSE) family.
Read moreThe topic of validating an OAuth 2.0 access tokens comes up frequently on this blog. Often we talk about how to validate JSON Web Token (JWT) based access tokens; however, this is NOT part of the OAuth 2.0 specification. JWTs are so commonly used that Spring Security supported them before…
Read more4 min read
Arm processors have been in the news lately, and it's causing confusion and worries about processor performance for some folks. After Apple announced its plan to switch to Arm-based processors, I heard people (incorrectly!) speculating the performance would be similar to a Raspberry Pi. Java on Arm is nothing new,…
Read morePASETO is a new security token format designed to be easy to use and free from the issues inherent with JSON Web Token (JWT) related specifications. Platform Agnostic SEcurity TOkens (PASETO) is a draft RFC spec created by Scott Arciszewski. PASETO reduces the scope of the JavaScript Object Signing and…
Read more5 min read
Recently, a colleague pointed out that I was still configuring Travis-CI on new GitHub repos and suggested I used GitHub Actions instead. I had given Actions the ol' five-minute test when it was still in beta, but ran into a few problems and gave up. After all, I've been a…
Read moreApache Shiro is a Java security framework that can perform authentication, authorization, session management, along with a host of other features for building secure applications.
Read moreOn the Okta blog, we spend much of our time talking about logging in. That is because once you configure your application to log in, the log out just works. But there are a few things you should consider when you're thinking about your app's logout configuration. In this post,…
Read moreMany of us are not familiar with vulnerability reporting and how it is different from reporting a regular bug. Frequently, I've seen people report vulnerabilities or potential security issues incorrectly. A public bug tracker or Stack Overflow is NOT the right tool; developers need to handle vulnerabilities differently and should…
Read more3 min read
PASETO is the latest trend in security token formats. Its primary goal is to reduce the problems the JSON Web Token (JWT) related specifications introduce. In this post, I'll give you a brief introduction to PASETO tokens and then jump into an example that creates and parses tokens using in…
Read moreOne of the biggest challenges of adding OAuth 2.0 support to legacy applications is a lack of support in the underlying framework. Maybe it's homegrown, or maybe it's just old? Either way, migrating away from an old form-based login doesn't need to be so painful. In this post, I'll walk…
Read more6 min read
Writing quality code takes practice. To write better code, you need to know what should improve. Code quality and what makes code easy to read are very subjective; ask five different developers, you will get six different answers. For this post, I'll avoid most of the subjective and focus on…
Read moreThere has been much buzz about GraalVM and what it means for the Java world. GraalVM is a Java distribution from Oracle that adds a bunch of features, most notably a new JIT compiler, polyglot capabilities, an LLVM runtime... and the ability to turn your Java application into a native…
Read more3 min read
How many times have you started a new job, and the first thing you see on the company intranet is a "Your connection is not private" error message? Maybe you asked around and were directed to a wiki page. Of course, you probably had to click through the security warnings…
Read more4 min read
Apache Maven is still the most popular build tool in the Java space, thanks to the popularity of its ecosystem of plugins. It's easy to find an existing plugin to do almost anything your application needs, from ensuring your source files have license headers, to validating binary compatibility between versions.…
Read more4 min read
My favorite way to test Java code is with Groovy. Specifically, writing tests in Groovy with Hamcrest. In this post, I'll walk through how to test a simple Spring Boot application with these tools.
Read more1 min read
I'm excited to announce that I've joined Okta's Developer Relations team! I've been working on Okta's awesome Developer Experience team for the last couple years so I'm not exactly a new face around here. 😉
Read moreMost OAuth 2.0 guides are focused around the context of a user, i.e., login to an application using Google, GitHub, Okta, etc., then do something on behalf of that user. While useful, these guides ignore server-to-server communication where there is no user and you only have one service connecting to…
Read moreIf you have a JavaScript single-page application (SPA) that needs to securely access resources from a Spring Boot application, you likely want to use the OAuth 2.0 implicit flow! With this flow your client will send a bearer token with each request and your server side application will verify the…
Read more3 min read
Developers use APIs to for everything! You build APIs for your own apps to consume, or as a part of a microservices architecture. Bottom line, you're building and using APIs to make your life easier. The ongoing effort to simplify development and work more efficiently, sometimes this also means looking…
Read moreNeed to decouple your web service and client? You're probably using REST endpoints, and if you're a Java shop you've probably tried out JAX-RS, Spring REST, or both. But is one better than the other? In this post I'll go over the differences between the two using basically the same…
Read moreMy favorite thing about Apache Shiro is how easy it makes handling authorization. You can use a role-based access control (RBAC) model of assigning roles to users and then permissions to roles. This makes dealing with the inevitable requirements change simple. Your code does not change, just the permissions associated…
Read more