FusionAuth’s Post

OAuth flows can be quite daunting. The OAuth flow to be used depends on the type of applications involved in the transaction. Came across this link below which I found really useful. https://lnkd.in/ghQA7CGP

Here’s a quick rundown of what’s new in the past 6 months (changes are mirrored on WWW + mobile) Token Upgrade: Implemented the industry standard in security with Access and Refresh tokens for better user authentication. Central API: This new hub handles all the token magic - sending, refreshing, retrying failed queries, and even bunching similar ones together. Banking with Plaid: You can now link your bank accounts directly for easy deposits and withdrawals. Kafka Message Passing: I’m using Apache Kafka for smarter message passing. Like, when a new order pops up, Kafka’s can send this message to any service that wishes to subscribe to it. Docker: Our server code and services are now dockerized, making it a breeze to set up the whole system anywhere. Admin Overlay: Created a nifty front-end admin overlay, making my life (and debugging) a whole lot easier. Server-side Makeover: Big revamp here to streamline adding API endpoints, handling tokens, and standardizing responses. Pack Opening: One of the site's core functionality of opening packs (which is what distributes cards out to users for trading) has been implemented. Centralized Notification: Set up a central system for all kinds of notifications, making it super easy for any component to send or receive alerts. Logging Everything: We’re logging all API requests and user sessions to spot issues and improve the user experience. Pre-Auth Experience: Guest users may not access limited functionality before being required to login.

FusionAuth 1.50 aka the Scopes Salamander 🦎 release is now available! Here are some highlights of the 20 issues, enhancements, and bug fixes: 🔗 Custom OAuth Scopes, which lets you allow an ecosystem of third-party developers to access your user data 😊 An improved setup wizard, making it easier to get started ⚙️ The ability to remove PII or add additional claims when requesting the UserInfo endpoint Check out the details ⬇️ https://lnkd.in/gWQRBf_n

Authentication in REST APIs acts as the crucial gateway, ensuring that solely authorized users or applications gain access to the API's resources. Some popular authentication methods for REST APIs: https://buff.ly/4eoRwgp (via @bytebytego)

🔒 Just discovered some intriguing insights into the world of JSON Web Tokens (JWT) and wanted to share with you all! 🚀 Using JWT is generally hailed as a best practice, especially with dedicated clients. However, challenges arise when tokens spill beyond your infrastructure, especially into the hands of third-party clients. These tokens hold critical claims information that services use to make savvy business decisions – think access permissions and data retrieval capabilities. ⚠️ But here's the catch: JWTs are easily decodable, potentially leading to privacy concerns when the data becomes public. The key is to ensure no sensitive information ends up in the JWT's claims. And it's not just about security; developers building integrations might become reliant on JWT data. Changing token claims could trigger breaking changes, requiring costly upgrades in all third-party clients. 🛠️ In my pursuit of a solution, I stumbled upon the Obscure token approach, an alternative to JWTs. This method ensures privacy by making token information less transparent. My preferred strategy is the Split Token method, Which I used in a Mendix-based project. Where building this in mendix is very easy, efficient. Combining with the available JWT module in mendix marketplace is added advantage. 💡 How does it work? The Token Service sends clients the signature part of the token and simultaneously forwards a hashed signature, along with the head and body parts of the token, to the API Gateway. The API Gateway caches these parts, allowing clients to use the signature as an opaque access token. When clients send requests to the API, the API Gateway hashes the signature, looks up the token in the cache, and forwards the complete JWT to the API service. 📚 For a deep dive into Split Tokens, check out the documentation (https://lnkd.in/efimdiuX). #JWT #Security #mendix #developercommunity #developer #DataPrivacy #APIIntegration #lowcode #lowcodedevelopment #TechInnovation 💻🔐

In our newest blog, learn how easy it is to add custom claims to SlashID-issued tokens using webhooks. Our approach has 3 core advantages: Testability - it is significantly easier to test custom authentication logic via webhooks compared to hosted scripts or other approaches; Data protection - by using a webhook you never expose key material (e.g., credentials to access a database with the enrichment information) or sensitive data to SlashID. Flexibility - you can customize the token at any step of its journey, including at your backend level when you need to differentially enrich tokens for specific microservices. Test it live in our playground to see for yourself!

A component for Ping Identity's authentication within your Delphi application: https://lnkd.in/dnjyigBi

Delved into the intricacies of authentication using JWT, bcrypt, and cookie-parser for web application. Included mastering secure password handling with bcrypt, implementing JWT token-based authentication, and managing tokens with cookie-parser. I've documented detailed notes on Notion for those interested in a deeper dive: https://lnkd.in/gFWHdZKR As a practical application, I've developed an authentication API project. It demonstrates user registration, login, logout, and profile management. Explore the project on GitHub: https://lnkd.in/gFn3qctJ

💡 Discover the Magic of JWT: Elevate your understanding of JSON Web Tokens and their pivotal role in modern authentication, authorization, and secure data exchange. #jwt #webdevelopment #frontenddeveloper #mernstack