Application Security in ASP.NET Core
•
0 j'aime•48 vues
Application Security in ASP.NET Core
Recommandé
Recommandé
Contenu connexe
Similaire à Application Security in ASP.NET Core
Similaire à Application Security in ASP.NET Core (20)
Plus de NETUserGroupBern
Plus de NETUserGroupBern (20)
Dernier
Dernier (20)
Application Security in ASP.NET Core
- 1. ASP.NET Core Security • Damien Bowden Microsoft MVP • https://damienbod.com • @damien_bod
- 2. https://github.com/damienbod ASP.NET Core, OpenID Connect, OAuth, Identity, Azure Angular, angular-auth-oidc-client npm
- 3. Security & Applications today OpenID Connect, OAuth2 Protecting APIs Authorization: ASP.NET Core Policies
- 5. Application
- 7. Application Authentication Business Data Access Authorization Identity Application 2 Authentication Business Data Access Authorization Identity
- 8. Application Authentication Business Data Access Authorization Identity Application 2 Authentication Business Data Access Authorization Identity
- 12. WAF HTTPS everywhere, Certs Protected Zone
- 13. WAF HTTPS everywhere, Certs Protected Zone
- 14. Authentication, Authorization, Accounting Session Protection HTTP headers HTTPS Certs TLS 1.2, 1.3 WAF Web Application Firewall
- 16. USE Standards Don’t implement this yourself, use certified libs, packages, tested
- 19. OpenID Connect http://openid.net/connect/ • Standard, Specification • Authentication and Authorization • built on top of OAuth2 (access control) • Identity (Person can have n Identities) • UserInfo Endpoint
- 20. Open ID Connect (OIDC) is supported by almost all systems. Azure AD, Azure B2C, OKTA, IdentityServer4, google accounts, Openiddict, node-oidc-provider
- 22. OpenID Connect Flows OAuth2 Flows http://openid.net/specs/openid- connect-core-1_0.html OAuth2 Resource Owner Credentials Flow OpenID Connect Code flow OpenID Connect Hybrid flow OpenID Connect PKCE Authorization Code Flow RFC 7636 OAuth Device Flow
- 23. id token token (access token) reference / self contained token refresh token scope Back-Channel Front-Channel User Agent
- 24. OAuth2 Resource Owner Credentials Flow • MC to MC applications • trusted client • grant_type=client_cred ential&client_id=xxxxx xxxxx&client_secret=xx xxxxxxxx • Limited user cases
- 25. OAuth2 Resource Owner Credentials Flow
- 26. OpenID Connect Authorization Code flow • Server to server applications with User • Can keep secrets, is trusted • Client is authenticated • response_type = code
- 27. OIDC Authorization Code flow
- 28. OIDC Authorization Hybrid flow • Mix of the Code and Implicit Flow • Can be used for Web applications with server side rendering. • response_type = code id_token | code id_token token | code token
- 29. OIDC Hybrid flow
- 30. Native App PKCE Authorization Code Flow RFC 7636 https://tools.ietf.org/html/rfc 7636
- 32. Single Page Applications Cookies OIDC Code Flow with PKCE OIDC Implicit Flow
- 33. OpenID Connect Code flow with PKCE • For browser applications, SPAs • Client is not authenticated, or trusted • response_type = code • NO SECRET
- 34. OAuth Device Flow RFC 7636 https://tools.ietf.org/html/dra ft-ietf-oauth-device-flow-12
- 36. https://github.com/damienbod/AspNetCoreHybridFlowWithApi https://github.com/damienbod/AspNetCoreWindowsAuth OpenID Connect Hybrid Flow Code examples
- 38. https://github.com/damienbod/AspNetCoreHybridFlowWithApi https://github.com/damienbod/AspNetCoreWindowsAuth OAuth2 Resource Owner Credentials Flow Code examples
- 42. Protecting APIs
- 43. JWT Bearer Authentication Introspection Cookies … not for APIs mostly...
- 44. Public APIs use same access_token Private APIs, APIs in protected Zones use a new access_token, not the public access_token
- 46. Authorization is the responsibility of the Application / API, not the STS. This can be implemented in an separate library.
- 47. Standard Requirements Complex Requirements Policies uses Requirements Authorization Handlers
- 49. Make a Handler
- 50. Create a Policy
- 51. Apply the Policy (Controller)
- 52. Apply the Policy (Razor Page)
- 53. Apply a Requirement directly
- 55. ASP.NET Core Policies, Handlers and Requirements makes it easy to focus on Authorization