The newest Authentication resources are on the Authentication page. For a reading order instead of a date order, see the Authentication learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2021-09-07 2021 | CISA adds single-factor authentication to its catalog of 'Bad Practices' news 1 min read | Catalog entry detailing CISA's addition of single-factor authentication to its "Bad Practices" list. This entry highlights the inadequacy of single-factor authentication for remote or administrative access, contrasting it with CISA's recommended multi-factor authentication approach. The catalog also includes practices like using unsupported software and default credentials, and is open to community submissions for additional detrimental configurations. |
| 2021-07-19 2021 | Where to Store the JSON Web Token (JWT)? intermediate JWT | Storing JSON Web Tokens (JWTs) securely is crucial for application security. Common storage locations include HTTP-only cookies and browser local storage. HTTP-only cookies offer better protection against Cross-Site Scripting (XSS) attacks, as JavaScript cannot access them. Local storage, while convenient for client-side applications, is more vulnerable to XSS. Other options like session storage (cleared on tab close) and memory storage (lost on refresh) have their own trade-offs. The choice depends on the application's security requirements and the specific threat model. |
| 2021-06-21 2021 | OAuth 2.0 Token Binding intermediate API Sec | OAuth 2.0 Token Binding enhances security by binding access tokens to the transport layer security (TLS) connection. This prevents tokens from being reused if intercepted, mitigating risks like token theft and replay attacks. By ensuring a token can only be used with the specific TLS session it was issued for, it strengthens the overall security posture of OAuth 2.0 deployments. This mechanism provides a crucial layer of defense against various attack vectors targeting token authentication. |
| 2021-05-24 2021 | Understanding SAML beginner 10 min read | Reference detailing SAML concepts, focusing on federated identity for web-based authentication. It explains the roles of Service Providers (SP) and Identity Providers (IdP), the SAML request and response mechanisms, and the asynchronous, browser-brokered authentication flow. The entry highlights key configuration elements like certificates and endpoints, and mentions the utility of open-source SAML toolkits for implementation, especially for ISVs supporting multiple IdPs. |
| 2021-05-14 2021 | The Right Way To Hash a Password or Create an Encryption Key: PBKDF2 bcrypt and scrypt beginner | This content discusses secure password hashing and encryption key generation using PBKDF2, bcrypt, and scrypt. These methods are designed to be computationally intensive, making brute-force attacks significantly harder. The article likely explains the strengths and weaknesses of each algorithm, guiding readers on choosing the most appropriate one for their security needs. The primary focus is on preventing unauthorized access by properly hashing sensitive data. |
| 2021-05-14 2021 | Creating an Authentication API with GolangUsing Gin & Nrok intermediate API Sec | This content likely details how to build an authentication API using Golang, the Gin web framework, and Nrok for local testing and exposure. It probably covers fundamental aspects of authentication API development, such as user registration, login, and potentially token management. The focus would be on practical implementation steps, demonstrating how to combine these technologies to create a functional and secure authentication system. |
| 2021-05-10 2021 | Kerberos Authentication and Kerberoasting Explained! intermediate | This content explains Kerberos authentication, a network authentication protocol widely used in Windows environments. It also details "Kerberoasting," a common cyberattack that exploits Kerberos. Attackers target Kerberos service accounts by requesting service tickets for accounts that are not human users but instead are service accounts. By then attempting to crack the password hashes of these service tickets offline, attackers can gain credentials for powerful service accounts, leading to potential system compromise. |