authentication – Page 58

What is an Endpoint?

October 6, 2022 by Tarik

Come on guys 🙂 We could do it simpler, by examples: /this-is-an-endpoint /another/endpoint /some/other/endpoint /login /accounts /cart/items and when put under a domain, it would look like: https://example.com/this-is-an-endpoint https://example.com/another/endpoint https://example.com/some/other/endpoint https://example.com/login https://example.com/accounts https://example.com/cart/items Can be either http or https, we use https in the example. Also endpoint can be different for different HTTP methods, for … Read more

JWT refresh token flow

October 5, 2022 by Tarik

Below are the steps to do revoke your JWT access token: When you do log in, send 2 tokens (Access token, Refresh token) in response to the client. The access token will have less expiry time and Refresh will have long expiry time. The client (Front end) will store refresh token in his local storage … Read more

In Subversion can I be a user other than my login name?

October 4, 2022 by Tarik

Most Subversion commands take the –username option to specify the username you want to use to the repository. Subversion remembers the last repository username and password used in each working copy, which means, among other things, that if you use svn checkout –username myuser you never need to specify the username again. As Kamil Kisiel … Read more

Add Keypair to existing EC2 instance

October 4, 2022 by Tarik

You can’t apply a keypair to a running instance. You can only use the new keypair to launch a new instance. For recovery, if it’s an EBS boot AMI, you can stop it, make a snapshot of the volume. Create a new volume based on it. And be able to use it back to start … Read more

How does cookie based authentication work?

October 4, 2022 by Tarik

To expand on Conor’s answer and add a little bit more to the discussion… Can someone give me a step by step description of how cookie based authentication works? I’ve never done anything involving either authentication or cookies. What does the browser need to do? What does the server need to do? In what order? … Read more

Why does AuthorizeAttribute redirect to the login page for authentication and authorization failures?

October 3, 2022 by Tarik

When it was first developed, System.Web.Mvc.AuthorizeAttribute was doing the right thing – older revisions of the HTTP specification used status code 401 for both “unauthorized” and “unauthenticated”. From the original specification: If the request already included Authorization credentials, then the 401 response indicates that authorization has been refused for those credentials. In fact, you can … Read more

Where to store JWT in browser? How to protect against CSRF?

October 3, 2022 by Tarik

We need to store the JWT on the client computer. If we store it in a LocalStorage/SessionStorage then it can be easily grabbed by an XSS attack. If we store it in cookies then a hacker can use it (without reading it) in a CSRF attack and impersonate the user and contact our API and … Read more

What if JWT is stolen?

October 3, 2022 by Tarik

I’m the author of a node library that handles authentication in quite some depth, express-stormpath, so I’ll chime in with some information here. First off, JWTs are typically NOT encrypted. While there is a way to encrypt JWTs (see: JWEs), this is not very common in practice for many reasons. Next up, any form of … Read more

user authentication libraries for node.js?

October 2, 2022 by Tarik

If you are looking for an authentication framework for Connect or Express, Passport is worth investigating: https://github.com/jaredhanson/passport (Disclosure: I’m the developer of Passport) I developed Passport after investigating both connect-auth and everyauth. While they are both great modules, they didn’t suit my needs. I wanted something that was more light-weight and unobtrusive. Passport is broken … Read more

Where do you store your salt strings?

October 1, 2022 by Tarik

The point of rainbow tables is that they’re created in advance and distributed en masse to save calculation time for others – it takes just as long to generate rainbow tables on the fly as it would to just crack the password+salt combination directly (since effectively what’s being done when generating rainbow tables is pre-running … Read more