Open Identity - getting to know your users
•
2 j'aime•1,306 vues
This talk is about Open Identity and using it to create an amazing user experience. Also it handles topics like secure API communication to protect your service and users from different kind of attacks like CSRF. The difference between Authentication and Authorization are being highlighted and OAuth, OpenID Connect etc. get explained.
Recommandé
Contenu connexe
En vedette
En vedette (17)
Similaire à Open Identity - getting to know your users
Similaire à Open Identity - getting to know your users (20)
Plus de PayPal
Plus de PayPal (20)
Dernier
Dernier (20)
Open Identity - getting to know your users
- 1. OPEN IDENTITY … ge$ng to know your users TIM MESSERSCHMIDT @SeraAndroid & cool stuff you can do with it
- 3. What does PayPal do at JSConf.eu?
- 4. Rebuild Developer Experience: developer.paypal.com
- 6. Do we always use the same idenHty?
- 7. Should we always use the same idenHty?
- 11. OAuth 1.0
- 12. Request Request Token Grant Request Token Direct User to Service Obtain AuthorizaEon Direct to Consumer Request Access Token Grant Access Token Access Resources Consumer Service Provider
- 13. OAuth 1.0a
- 14. OAuth 2.0
- 15. Direct User to Service Obtain AuthorizaEon Request Access Token Greant Access Token Direct to Consumer Access Resources / Profile Consumer Service Provider
- 16. OAuth 2.0 and the Road to Hell hPp://hueniverse.com/2012/07/oauth-‐2-‐0-‐and-‐the-‐road-‐to-‐hell/
- 18. IdenEficaEon
- 19. Name Email Date of Birth Locale Time Zone Address Gender Language Phone Number CreaHon Date
- 20. OpenID
- 22. How to combine both?
- 23. OpenID with OAuth Hybrid Extension
- 24. OpenID Connect
- 25. IdenHty Providers Social vs. Concrete
- 27. Yeah, nice.. but why? People forget passwords… 45% admit to leaving a website instead of re-‐ se$ng their password or answering security quesEons * * Blue Inc. 2011
- 28. Also they hate to register Out of 657 surveyed users 66% think that social sign-‐in is a desirable alternaEve. * * Blue Inc. 2011
- 29. Where else should we use authenHcaHon?
- 30. JSONP Cross-‐domain Request (XDR)
- 31. CORS Cross-‐Origin Request Sharing
- 32. API communicaHon curl -‐v hPps://api.paypal.com/v1/payments/payment -‐H 'Content-‐Type:applicaEon/json' -‐H 'AuthorizaHon:Bearer MyAwesomeToken' -‐d '{ "intent":"sale", "payer":{ "payment_method":"paypal" }, "transacEons":[{ "amount":{ "total":"7.47", "currency":"USD" }, }] }‘
- 33. XMLHpRequest Request: POST /cors HTTP/1.1 Origin: hPp://api.bob.com Host: api.bob.com Response: Access-‐Control-‐Allow-‐Origin: hPp://api.bob.com Access-‐Control-‐Allow-‐CredenEals: true Access-‐Control-‐Expose-‐Headers: FooBar Content-‐Type: text/html; charset=un-‐8 source: hPp://www.html5rocks.com/en/tutorials/cors/
- 34. Wrap up Difference between authen.ca.on and authoriza.on IdenHty does maer Token based authenHcaHon for API communicaHon
- 35. QuesHons? tmesserschmidt@paypal.com @SeraAndroid slideshare.com/paypal