Okta Developer Blog

https://developer.okta.com/blog/2018/06/11/how-to-prevent-your-users-f… ("How to Prevent Your Users from Using Breached Passwords") | https://github.com/OktaSecurityLabs/passprotect-js is an example. Good behavior: > The new NIST recommendations mean that every time a user gives you a password, it’s your responsibility as a developer to check their password against a list of breached passwords and prevent the user from using a previously breached password. SP 800-63 specifically: https://pages.nist.gov/800-63-3/ | https://pages.nist.gov/800-63-4/

If you, like me, prefer HN comments over articles: The author does not just complain about JOSE and JWT but he also designed an alternative, PASETO: https://paseto.io/ Here's a nice PASETO write-up from Okta, a reputable third party: https://developer.okta.com/blog/2019/10/17/a-thorough-introduction-to-… PASETO looks excellent to me, in that it's proper developer friendly and makes it hard for non crypto nerds like me to shoot themselves in the foot. I can't wait for it to replace JWT in popularity.

I'm thrilled about implementing this on our app so we can make registration and login even more smooth without having to be in bed with Google and Facebook. Can't wait to implement it. I'm even more thrilled to see, that according to the Okta article linked in another thread by simonw [1], Apple uses OAuth and OpenID Connect for this, and not some home-grown protocol. Great news all-round. [1] https://developer.okta.com/blog/2019/06/04/what-the-heck-is-sign-in-wi…

DPoP described in RFC9449 - you can see from the RFC number it's quite new. I don't think there's wide support for it, but at least Okta supports it[1] and I think Auth0 are also working on adding DPoP. Is it good? I'm not a fan. To use DPoP safely (without replay attacks), you need to add server-side nonces ("nonce") and client-generated nonces ("jti", great and definitely not confusing terminology there). You need to make sure client-generated nonces are only used once, which requires setting up... wait for it... A database! And if you'll be using DPoP in a distributed manner, with access tokens then, well, a database shared across all services. And this is not an easy-to-scale read-oriented database like you'd have to use for stateful tokens. No, this is a database that requires an equal number of reads and writes (assuming you're not under a DDoS attack): for each DPoP validation, you'd need to read the nonce and then add it to the database. You'd also need to implement some sort of TTL mechanism to prevent the database from growing forever and implement strong rate limitation across all services to prevent very easy DDoS. It seems like the main driving motivation behind DPoP is to mitigate the cost of refresh tokens being exfiltrated from public clients using XSS attacks, but I believe it is too cumbersome to be used securely as a general mechanism for safe token delegation that prevents "pass-the-token" attacks. [1]…

JNI is the second or maybe third FFI for Java. JRI existed before it and that was worse, including performance. The debugging and instrumentation interfaces have been rewritten more times. https://docs.oracle.com/en/java/javase/24/docs/specs/jni/intro.html mentions JRI. But it seems like JNI has been replaced by third party solutions multiple times as well. https://developer.okta.com/blog/2022/04/08/state-of-ffi-java#a-brief-h…

The way XML digital signatures work is so weird. This routinely comes up year-after-year. When I was working at Okta this also resulted in a number of annoying breaches, including this one: https://developer.okta.com/blog/2018/02/27/a-breakdown-of-the-new-saml…

I knew we documented it somewhere: https://developer.okta.com/docs/concepts/api-access-management/#tokens…

For some prior art, Okta avoids the email link scanning issue by requiring "same browser, same device" (sessions) [1]. An OTP code is included in the email as a fallback for users receiving mail on a different device than they're trying to log in to. [1]: https://developer.okta.com/docs/guides/email-magic-links-overview/main…

This is cool. I wrote a TOTP authenticator for the ArduBoy: https://developer.okta.com/blog/2018/08/30/build-one-time-password-tok…

Bold to make a prediction like that. But I think perhaps the author doesn't understand Kubernetes as much -- you can run Webassembly as the runtime for Kubernetes, and get the other things Kubernetes provide, such as self-healing. It's because Kubernetes is not built monolithically, and things like the runtime or kubelet can be replaced with something else. https://developer.okta.com/blog/2022/01/28/webassembly-on-kubernetes-w…

It's about to get much better once Project Loom is ready. This will introduce virtual threads and structured concurrency. https://developer.okta.com/blog/2022/08/26/state-of-java-project-loom

> I haven't seen a self-discoverable REST API ever in the wild I'm super cognizant this entire discussion hinges upon semantics, nuance, etc but the Okta API isn't terrible about that https://developer.okta.com/docs/reference/core-okta-api/#hypermedia I haven't personally tried `curl https://$ {yourOktaDomain}/api/v1` to see what the bootstrapping process looks like, but I can attest they do return _links in a bunch of their resource responses, and I believe their own SDK uses them, so they're not just lip service

Thank you for the reminder! Based on my (very) limited knowledge, OAuth2 can still be used for so-called "pseudo-authentication" [1]. I'm not saying it is as good as SAML/OIDC, but those technologies are a major pain to implement and support for a small team. Pseudo-authentication seems like a good "bang for the buck" tradeoff. A more refined version of my question might be, "Is pseudo-authentication good enough to get past most security teams until you can scale up to SAML/OIDC?" I'm sure it likely isn't good enough for highly regulated industries (or Fortune 100 companies) that have prescriptive compliance regulations, but maybe it is good enough to get going in less rigid circumstances? [1] https://developer.okta.com/blog/2017/06/21/what-the-heck-is-oauth#pseu…

They don't exist yet, not fully. But what you _really_ want to look at right now is WASM as a replacement for Docker. For example: https://developer.okta.com/blog/2022/01/28/webassembly-on-kubernetes-w… https://training.linuxfoundation.org/blog/how-wasi-makes-containerizat…

> Vendoring dependencies is a simple way to ensure consistent build inputs It wouldn't be necessary if the dependency tree was a pure function of package manifest. https://developer.okta.com/blog/2019/12/16/semantic-versioning

You might find this article informative: https://developer.okta.com/blog/2019/10/17/a-thorough-introduction-to-…

The access token is designed for saving size. Scopes are in the ID token. The disadvantage of the access token is the required back channel. But then this scheme also needs a shared backchannel so it's pretty much an access token implementation (you could express it as such) https://developer.okta.com/docs/guides/validate-id-tokens/overview/

I believe the article is wrong, eg, see: https://developer.okta.com/docs/guides/updating-saml-cert/generate-new…

> Anyone got insights as to how mainstream Paseto is getting? Okta's a pretty big name in authn/authz and their engineers recently published an open source PASETO implementation. https://developer.okta.com/blog/2019/10/17/a-thorough-introduction-to-… https://github.com/paseto-toolkit/jpaseto

They don't call it OAuth/OpenID, but they're using the same terminology and API: https://developer.okta.com/blog/2019/06/04/what-the-heck-is-sign-in-wi…

Okta has a free tier for 1000 active users/month (not 1000 logins but 1000 separate users logging in as many times as you'd like). After 1000 it's cheap as heck. https://developer.okta.com/pricing

Has anyone seen a live online demo of "Sign in with Apple" anywhere on the internet? I've seen a few tutorials - https://developer.okta.com/blog/2019/06/04/what-the-heck-is-sign-in-wi… is particularly good - but no one seems to have deployed a button I can click anywhere yet.

Randall Degges has a blog post on this. It's pretty good actually: https://developer.okta.com/blog/2017/08/17/why-jwts-suck-as-session-to…

We also ran into issues with using the Okta OAuth/OIDC integration with Teleport and ended up using SAML [0]. Perhaps more painful, especially if you are more familiar OAuth/OIDC but it worked. This was when Okta OAuth/OIDC was still in beta so perhaps it has improved since then. [0] https://developer.okta.com/authentication-guide/saml-login/ ; https://gravitational.com/teleport/docs/ssh_okta/

JWT is a buzzword. Some people are attracted to changing shit for the sake of it, and then encouraging others to use the new thing too, to validate their own use, and feel like they're 'ahead of the curve' on trendy tech. Rather than rehashing it all myself, I'd suggest reading http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions… and https://developer.okta.com/blog/2017/08/17/why-jwts-suck-as-session-to…

http://developer.okta.com/docs/api/getting_started/design_principles Good error handling, easy to get started, and they provide Postman collections for each API

The blog mentions right at the start that it's based on OAuth 2.0/OIDC, similar to how you log in to your Google account in Thunderbird for example. > I always wonder how it will work for someone writing their own client, perhaps a very basic client (or a bot). For interactive clients, it'll be the standard OAuth 2.0 Authorization Code flow[1]. For non-interactive services they say in the proposal[2] that one uses the existing method but they will implement the standard OAuth 2.0 Client Credentials flow[3], which is effectively like a traditional username/password deal, though the "password" is not the account password. [1]: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-au… [2]: https://github.com/matrix-org/matrix-spec-proposals/blob/0023db90aca5e… [3]: https://developer.okta.com/docs/concepts/oauth-openid/#client-credenti…

I don't like it either (it's just syntactically annoying), but I am pretty sure it's there just for historical reasons: https://developer.okta.com/blog/2019/01/16/history-and-future-of-async… It's at least cleaner than a bunch of chained .then()s or nested callbacks, which is what we had to do in the old days. If you don't want to use async/await, you can still do it the old-fashioned ways. But it's not really that difficult to just wrap whatever you're doing in an async call, is it? e.g. (async () => { await someAsyncThing(); await Promise.all(aFewAsyncThings[]); await someOtherThing(); })(); Will cause all of those to run in sequence as synchronous operations one after another. Promise.all() can help with concurrent async things, or you can use a queuing library like p-throttle/p-limit if there are rate limits to observe. Yeah, it's a bit of syntactic complexity, but once you get the hang of it, they're not so bad and let you more cleanly think about which operations are synchronous & blocking and which can be async in the background (important for both performance and UX).