サクサク読めて、アプリ限定の機能も多数!
トップへ戻る
災害への備え
darutk.medium.com
IntroductionThis article explains X.509 certificate. 1. Digital Signature (Prior Knowledge)To read this article, knowledge about digital signature is needed. That is, this article assumes that you understand “By verifying signature with the public key which is paired with the private key used to generate the signature, you can confirm that the target data has been surely signed by the owner of the
What happens if ID tokens issued by external OpenID providers (IdP) are used for API protection? The following diagram is my understanding. A client that has no relationship with the resource server can access APIs of the resource server using an ID token that the client has legitimately obtained in an utterly irrelevant context.The user has granted a permission for the client to get an ID token,
1. IntroductionFrom an engineer's point of view, an abstract explanation like “ID Token is a token issued as a result of user authentication” is not so valuable because engineers cannot imagine how to implement ID Token at all by the explanation. Instead, what engineers want to know first, at least what I should have known before diving into reading OpenID Connect Core 1.0, is what an ID token loo
For the past three years, I've repeated to explain OAuth 2.0 to those who don't have a technical background, mainly to investors as a co-founder of Authlete, Inc. (Tech In Asia: "API security startup Authlete raises $1.2m in seed funding"). As a result, I found a way to explain OAuth 2.0 in an easily understandable manner. This article introduces the steps. 1. There are data of a user. 2. There is
1. Semi-Hosted Service PatternThis article describes details about a new architecture of OAuth 2.0 and OpenID Connect implementation which is categorized as "Semi-Hosted Service" pattern in “Deployment and Hosting Patterns in OAuth”. In the pattern, a frontend server (an authorization server and an OpenID provider) utilizes a backend service which provides APIs to help the frontend server implemen
Diagrams and movies of all the 4 authorization flows defined in RFC 6749 (The OAuth 2.0 Authorization Framework) and one more flow to re-issue an access token using a refresh token. 1. Authorization Code FlowThis is the flow defined in RFC 6749, 4.1. Authorization Code Grant. A client application (a) makes an authorization request to an authorization endpoint, (b) receives a short-lived authorizat
このページを最初にブックマークしてみませんか?
『darutk.medium.com』の新着エントリーを見る
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く