OAuth 2.0 es un protocolo abierto que nos brinda autorización y delegación para nuestras APIs HTTP. En esta sesión daremos un repaso al estado del arte de la seguridad en las APIs HTTP. A continuación pasaremos a entender que es este protocolo y como funciona. Daremos un repaso a todos sus flujos: Authorization Code, Implicit, Client Credentials, ROPC, PKCE… y veremos ejemplos en directo para acabar de tener un imagen completa de todo lo que nos ofrece y que nos servirá para cuando empecemos a trabajar con servidores de identidad OIDC.

1. OAUTH2 PARA
DESARROLLADORE
S

2. Luis Ruiz
Lead Developer at PlainConcepts
lruiz@plainconcepts.com
@luisruizpavon

3. ANTES DE OAUTH

4. OAUTH2
Introducción

5. OAuth2 - ¿Qué es?
Protocolo de Autorización
Protocolo de delegación

6. OAuth2 - ¿Qué
soluciona?
¿Cuántas aplicaciones
tienen tu contraseña?
¿Confías en ellas?

7. OAuth2 - Jugadores
■ Resource Owner (Nosotros)
■ Authorization Server (El servidor de OAuth2
de Github)
■ Client Application (La aplicación cliente que
quiere acceder a nuestros commits)
■ Protected Resource (Las apis de Github)

8. OAuth2 - Endpoints
Para autorización:
/authorize
Para pedir tokens:
/token

9. OAuth2 - Scopes
■ Son permisos para hacer algo en un recurso protegido en
nombre del usuario.
api.read
api.update

10. OAUTH2
Grant types

11. OAuth2 – Grant types
• Authorization Code
• Implicit
• Client credentials
• Resource Owner Password Credentials (ROPC)
• Device code

12. OAuth2 – ¿Qué flujo debería elegir?

13. OAuth2 – Authorization Code

14. OAuth2 – Authorization Code
https://authorizationserver.com/authorize
?response_type=code
&client_id=asd5Gyy67
&redirect_uri=https://client.com/callback
&state=aH5jki908UJHa
&scope=api.read api.update

15. OAuth2 – Authorization Code
https://clientapplication.com/callback
?code=Aw5546754ggFHK8sdli45
&state=aH5jki908UJHa

16. OAuth2 – Authorization Code
POST https://authorizationserver.com/token
Host: authorizationserver.com
Content-Type: application/x-www-form-urlencoded
Authorization: BasicYWFhYWFhYTphYWFhYWFh
grant_type=authorization_code
&code=Aw5546754ggFHK8sdli45
&redirect_uri=https://client.com/callback
&client_id=dg6H78kjYt78&client_secret=hyt67Jdfr5

17. OAuth2 – Authorization Code
Basic Authentication Style (RFC 7617)
Base64 (cliente_id:client_secret)
OAuth Style (RFC 6749)
Base64 (urlformencode(cliente_id):urlformencode(
client_secret))

18. OAuth2 – Authorization Code
HTTP/1.1 200 OK
Content-Type: application/json
{
“access_token”: “3dfRTg67hjnbHJU87Uj”,
“token_type”: “Bearer”,
“expires_in”: 3600,
“scope”: “api1”
}

19. Authorization
Request
Authentication and consent
Authorization
Grant
Authorization
Grant
Access
Token
Authorization: Bearer aas7789danADSA898das
Resource Owner
Client Application
Authorization Server
Protected Resource

20. OAuth2 – Implicit

21. OAuth2 – Implicit
https://authorizationserver.com/authorize
?response_type=token
&client_id=asd5Gyy67
&redirect_uri=https://client.com/callback
&state=aH5jki908UJHa
&scope=api.read api.update

22. OAuth2 – Implicit
https://clientapplication.com/callback
#access_token=Aw5546754ggFHK8sdli45
&state=4Y6jjkflkffgGt6H74545Ggedgrt45yTYRdsfSDF
&token_type=Bearer
&expires_in=3600

23. OAuth2 – Implicit
Consideraciones:
■ Los access tokens están expuestos al Resource
Owner.
■ Los access tokens son accesibles a través de
JavaScript.

24. OAuth
Authentication and consent
AccessToken
Access
Token
Authorization: Bearer aas7789danADSA898das
Resource Owner
Client Application
Authorization Server
Protected Resource
Trust

25. OAuth2 – Client Credentials

26. OAuth2 – Client Credentials
POST https://authorizationserver.com/token
Host: authorizationserver.com
Content-Type: application/x-www-form-urlencoded
Authorization: BasicYWFhYWFhYTphYWFhYWFh
grant_type=client_credentials
&scope=emilios_api.read
&client_id=client_credentials&client_secret=secret

27. OAuth2 – Client Credentials
HTTP/1.1 200 OK
Content-Type: application/json
{
“access_token”: “3dfRTg67hjnbHJU87Uj”,
“token_type”: “Bearer”,
“expires_in”: 3600,
“scope”: “api2.read”
}

28. OAuth2 – Client Credentials
Client Credentials != API Keys / Basic Authentication
• Las credenciales no se envían en cada petición.
• AccessTokens.
• Limitar el tiempo de acceso al recurso.

29. 29
Credentials
NO USER
Access
Token
Authorization: Bearer aas7789danADSA898das
Client Application
Authorization Server
Protected Resource
Trust

30. Resource Owner Password Credentials

31. OAuth2 – Device Code

32. OAuth2 – Device Code
POST https://authorizationserver.com/deviceauth
Host: authorizationserver.com
Content-Type: application/x-www-form-urlencoded
Authorization: BasicYWFhYWFhYTphYWFhYWFh
scope=scope1 scope2
&client_id=clientid
&client_secret=secret

33. OAuth2 – Device Code
{
"verification_uri": "https://authorization-server.com/authorize",
"verification_uri_complete": "https://authorization-server.com/authorize",
"user_code": "94248",
"device_code": "74tq5miHKB",
"interval": 5
}

34. OAuth2 – Device Code
POST https://authorizationserver.com/token
Host: authorizationserver.com
Content-Type: application/x-www-form-urlencoded
Authorization: BasicYWFhYWFhYTphYWFhYWFh
grant_type=urn:ietf:params:oauth:grant-type:device_code
&client_id=s6BhdRkqt3
&client_secret=secret
&device_code=74tq5miHKB

35. OAuth2 – Device Code
{
"access_token": "2YotnFZFEjr1zCsicMWpAA",
"token_type": "bearer",
"expires_in": 3600
}

36. Authorization: Bearer aas7789danADSA898das
Client Application
Authorization Server
Protected Resource
Trust
Use User Code and Consent Scopes

37. OAuth2 – RefreshTokens

38. OAuth2 – RefreshTokens
https://authorizationserver.com/authorize
?response_type=code
&client_id=asd5Gyy67
&redirect_uri=https://client.com/callback
&state=aH5jki908UJHa
&scope=api1 api2.read offline_access

39. OAuth2 – RefreshTokens
HTTP/1.1 200 OK
Content-Type: application/json
{
“access_token”: “3dfRTg67hjnbHJU87Uj”,
“refresh_token”: “565Ghyff655gHGt65g”
“token_type”: “Bearer”,
“expires_in”: 3600,
“scope”: “api2.read offline_access”
}

40. OAuth2 – RefreshTokens
POST https://authorizationserver.com/token
Host: authorizationserver.com
Content-Type: application/x-www-form-urlencoded
Authorization: BasicYWFhYWFhYTphYWFhYWFh
grant_type=refresh_token
&refresh_token=tY67ytgghRryFGU7675gfGFDE4esss
&scope=api2.read

41. OAuth2 – RefreshTokens
HTTP/1.1 200 OK
Content-Type: application/json
{
“access_token”: “3dfRTg67hjnbHJU87Uj”,
“refresh_token”: “565Ghyff655gHGt65g”
“token_type”: “Bearer”,
“expires_in”: 3600,
“scope”: “api2.read offline_access”
}

42. OAuth2 – RefreshTokens
GrantType0 offline_access
Authorization Code SI
Implicit No
Client Credentials No
ROPC Si

43. ¿Cómo es un flujo Code + PKCE?

44. Proof Key for Code Exchange (PKCE) A.K.A
Pixie
Native Client
Authorization Server
Authorization Request: Include code_challenge
Authorization Code
Token Request: Include code_verifier
AccessToken
Store code_challenge
Compare code_verifier and
code_challenge

45. PKCE
https://authorizationserver.com/authorize
?response_type=code
&client_id=asd5Gyy67
&redirect_uri=com.plainconcepts.windows:/callback
&code_challenge=asd344dfd
&code_challenge_method=S256
&state=aH5jki908UJHa
&scope=api1 api2.read

46. PKCE
POST https://authorizationserver.com/authorize/token
Host: authorizationserver.com
Content-Type: application/x-www-form-urlencoded
grant_type=authorization_code
&code=Aw5546754ggFHK8sdli45
&code_verifier=random-string-non-hashed-used-to-genterate-code-challenge
&redirect_uri=com.plainconcepts.windows:/callback
&client_id= asd5Gyy67

47. ¿PREGUNTAS?
Gracias!