Skip to main content

OAuth...is vague

I've recently been working on a project to integrate with a 3rd party.  This is normal work in software development; we constantly work to make this system talk to that system and so on.  The web has made this a lot easier, as many groups are moving their APIs to a more standard kind of setup.  REST is ruling the integration world right now (as far as I can tell), and I don't see that changing any time soon.

Security... is a different matter.  Authorization and authentication tools keep evolving, sometimes in sync with integration... and sometimes not.  Spring is currently pushing out new and shiny updates to spring boot (2.1.0 just came out!), but spring security has not necessarily been keeping up.  This isn't unique to spring.  The 3rd party integration I'm working on is still using OAuth1.0 (NOT 1.0a if I can believe the documentation).  When I saw that, I am sad to say that I was not surprised.

Sparing the debate of OAuth1.0a vs OAuth2.0 and the comparison of OAuth to other options like JWT, I find two things frustrating:

  1. Security always seems to take a back seat... which leads to problems.  Feature work is important, I know.  It keeps the lights on.  But in a world where data leaks are regular news, I fear for this continuous cycle of security falling behind.
  2. Documentation for OAuth is vague.  Many places that claim to document OAuth are for OAuth 2.0, but they don't say 2.0.  I can understand that older documentation referencing OAuth 1.0 would just say 'OAuth' because 2.0 hadn't come out yet.  What makes this worse is the weirdly different nature of OAuth 1.0(a) vs 2.0.  I'm not a security expert at all, but I see over and over again that 1.0(a) and 2.0 are nothing alike, so it is super frustrating to keep digging for documentation on 1.0(a), and I won't know whether what I am reading is referencing one or the other.  So much of what the documentation on OAuth has to say is #toovague.

Comments

Popular posts from this blog

JHipster, Liquibase, MySQL, and initializing data, including booleans!

When generating a data model from JHipster JDL, we will often declare entities with Boolean fields.  I have so far abandoned H2 as a database because of liquibase issues, and both my dev and production databases will be MySQL.  This is relevant to the Boolean field desire there is a long history in software development of how to store Boolean data types in a SQL database whose standards classically do not support Boolean. In the current JHipster/Liquibase incarnation, tables in MySQL are generated for us, which is really nice.  The Boolean data types are stored as BIT  (1).  This is not a problem so far -- most developers seem to agree now that as a best practice, we should store values in databases as false = 0 and true = 1, and a BIT(1) is a great, simple way to do that. An issue arises when we try to use liquibase to set/update our database to the desired starting state.  For my project, I've chosen gradle instead of maven as a build tool, and gradle has a plugin for liquiba

Deploying Spring Boot talking to MySQL on AWS

In a recent post, I listed some very basic information about running a MySQL database on AWS.  In most cases, we don't want a database alone; we want an application that uses that database for CRUD. I've created a simple Spring Boot application that exposes a REST API to create and manage lists of things.  The list values are all stored in a MySQL database. When I went to deploy the application on AWS using Elastic Beanstalk, there were some really good, automatic things that happened to make my life easy: AWS can deploy a Spring Boot jar very easily by simply uploading the jar during setup. AWS creates security groups on the fly so I don't have to worry about extra security configuration. AWS automatically generates DNS information and provides me a URL for accessing the application. As I deployed the application and saw all of these things, I was pretty excited.  It is nice to have a lot of this stuff taken care of for me. Then, I tried to test my applica

Spring Security - Authority vs Role

I have spent a lot of time recently trying to understand the difference between Authority and Role in Spring Security.  This is a brief review of what I found. When creating a UserDetailsService or overriding configure(AuthenticationManagerBuilder auth) in the security config class that extends WebSecurityConfigurerAdapter, I basically get complete control over what I populate inside of the UserDetails that is used/returned.  This is important because the UserDetails interface really only cares about how to return one thing: Collection<? extends GrantedAuthority> getAuthorities(); A GrantedAuthority just seems like a glorified String wrapper that names some thing.  The question is... what is that thing? This is where the subtle difference between Authority and Role comes into play. I think that Role is an older thought/construct that automatically gets plugged into Authority if we just create a user with a Role.  But completely forget about the code and classes for a mi