Federated Logins with OAuth 2, OpenID Connect, and JWTs with Matt Cotterell

This month, Matt will revisit the talk he presented at the AppSec NZ conference last month in Auckland.

Federated Logins with OAuth 2, OpenID Connect, and JWTs
Matt (TC) Cotterell - ZX Security

Having a password for every website is falling out of fashion these days in favour of federated auth (like “Sign in with Facebook/Google”), but how does this work? In this talk, I will introduce how authentication, authorisation and credentials work using OAuth 2, OpenID Connect and JSON Web Tokens.

Ever been frustrated with having to wrangle yet another password when you sign up for a new site? Ever felt uncomfortable because a website has asked for your banking password just so it can make a single transaction?

Web developers are quickly finding that using passwords for logins is falling out of fashion in favour of “federated” authentication. These are often quicker, safer and allow users to grant limited access to their stuff on other websites. This is often done using open standards such as OAuth 2, OpenID Connect and JSON Web Tokens (JWTs).

In this talk, we will introduce how to authenticate users to your websites, apps, devices or even between servers using OpenID Connect, and authorise third-party access to some of their resources using OAuth 2. We will also discuss JSON Web Tokens (JWTs, confusingly pronounced “jots”), which we can use as temporary credentials to access APIs and verify identities.

Speaker Biography

Matt Cotterell is a Security Consultant and Software Engineer working for ZX Security in Wellington. His work involves breaking web applications, APIs and cloud configurations looking for security vulnerabilities. Beyond that, he enjoys exploring various authentication patterns and practices, software frameworks and public cloud providers in order to craft beautiful, secure and maintainable solutions to challenging technical problems.

In his spare time, he can be found watching bad movies, gleefully overusing the word “cyber,” and feeling awkward writing biographies in a third-person perspective.