Konubinix' opinionated web of thoughts

Ory

Fleeting

Ory Identities implements special browser APIs which use additional security measures such as anti-CSRF cookies

[…]

uncommon approach that might require a shift in thinking

[…]

don’t have to worry about refreshing tokens or deciding whether to store them in localStorage or document.cookies

[…]

devote all your focus and time to developing great software for your users, while Ory takes care of the security by giving you the best-in-class protection from all common browser attack vectors, such as Cross-site scripting (XSS) or Cross-site request forgery (CSRF).

https://www.ory.sh/docs/security-model

To manage HTTP cookies, Ory APIs must be exposed on the same domain as your application. If you don’t fulfill this requirement, HTTP Cookies are ignored by the browser, which prevents the Ory Identities from functioning properly.

https://www.ory.sh/docs/security-model

HTTP cookies are a central part of the unique security model in Ory.

[…]

HTTP cookies to store session states and protect against attack vectors such as CSRF

https://www.ory.sh/docs/security-model

Ory issues HTTP cookies with the following flags for the highest level of security:

  • secure: The cookie is only sent over HTTPS connection to protect against man-in-the-middle attacks.
  • httpOnly: The cookie is not available to JavaScript code to protect against XSS.
  • sameSite=Strict: The cookie can only be requested from the same origin to protect against CSRF attacks.

https://www.ory.sh/docs/security-model

kratos: the authentication layer

hydra: the OIDC layer

Actually, OAuth2 and OpenID Connect don’t even specify how your users sign in

https://www.ory.sh/docs/hydra/concepts/before-oauth2

they only establish that you need a method for users to sign in.

https://www.ory.sh/docs/hydra/concepts/before-oauth2

common misconception is that access and refresh tokens represent a user session. They don’t.

https://www.ory.sh/docs/hydra/concepts/before-oauth2

Access and refresh tokens allow developers you don’t know to do things in your application in the name of your users over a prolonged period of time

https://www.ory.sh/docs/hydra/concepts/before-oauth2

ever wondered why, when signing into Google/Facebook/Twitter/…

  • you don’t see a screen asking you to grant permission (“Do you want to allow … to access your …?”)?
  • their mobile app doesn’t open a browser window or use an embedded WebView?
  • our browser doesn’t perform tons of redirects?

The answer is quite simple - they don’t use OAuth2 or OpenID Connect for login and session management in first-party scenarios

https://www.ory.sh/docs/hydra/concepts/before-oauth2

Without OAuth 2.0, a resource owner who wants to share resources in their account with a third party would have to share their credentials with that third party.

https://www.ory.sh/docs/hydra/concepts/oauth2

With OAuth, clients can request access to resources on a server, and the owner of these resources can grant the requested access together with dedicated credentials.

https://www.ory.sh/docs/hydra/concepts/oauth2

OpenID Connect is a protocol built on top of OAuth 2.0 for just authentication (instead of authorizing access to resources).

https://www.ory.sh/docs/hydra/concepts/oauth2

Audience of an Access Token refers to the Resource Servers that this token is intended for.

https://www.ory.sh/docs/hydra/concepts/oauth2

primary use case for OpenID Connect is to solve “Login with <Google|Facebook|Hydra>” flows.

https://www.ory.sh/docs/hydra/concepts/openid-connect-oidc

ID Token’s purpose is to authenticate the End-User at the OAuth2 Client Application

https://www.ory.sh/docs/hydra/concepts/openid-connect-oidc

it’s just a “certificate”.

https://www.ory.sh/docs/hydra/concepts/openid-connect-oidc

webhooks to add custom claims to tokens

keto: the permission layer

It claims to implement zanzibar.

Notes pointant ici