-: REST. 2 2
In this lesson we're going to talk about REST, 3 3
the Representational State Transfer. 4 4
Now, REST is a software architectural style 5 5
that defines a set of constraints 6 6
to be used for creating web application services. 7 7
When we talk about REST 8 8
you also hear it referred to as RESTful APIs 9 9
and these are a looser architectural framework 10 10
than SOAP's tightly specified protocol. 11 11
Now, if you remember 12 12
we talked about SOAP used XML based messages. 13 13
Well, REST has a lot more options. 14 14
REST is going to support HTTP, XML, CSV 15 15
which is comma separated value format 16 16
or even JSON messages. 17 17
All of these are messages 18 18
that can be accepted and passed over REST 19 19
instead of just relying on a properly formatted XML document 20 20
like SOAP does. 21 21
Now, let me give you an example of how this all works. 22 22
If you wanted to go to my website and log into your account 23 23
you would go to the domain name of diontraining.com 24 24
and then go to the resource myaccount. 25 25
It would look like diontraining.com/myaccount. 26 26
Now, when you do this it performs an HTTP get request 27 27
to receive a list of all of the courses you're enrolled in. 28 28
It's also going to give you your progress or percent complete 29 29
in the courses you're enrolled in 30 30
and some other basic profile information. 31 31
Now, on the other hand, 32 32
when you start taking a quiz on my site 33 33
and you click the submit button at the end, 34 34
it's going to take that information 35 35
as part of a RESTful API command 36 36
and use the HTTP post command to send that to my server. 37 37
Now, as we go through this lesson 38 38
we're going to talk a little bit more 39 39
about REST and RESTful APIs, 40 40
and we're specifically going to talk 41 41
about three major concepts. 42 42
We're going to talk about OAuth, 43 43
we're going to talk about OpenID Connect, or OIDC 44 44
and we're going to talk about JSON Web Tokens or JWT. 45 45
Now, when we talk about OAuth, 46 46
this is a delegated authorization framework 47 47
for RESTful APIs that enables applications 48 48
to obtain limited access, also known as scopes 49 49
to a user's data without giving away a user's password. 50 50
Now, when you're dealing with OAuth, 51 51
this is a form of authentication and authorization 52 52
using this RESTful API. 53 53
Now, when we talk about OAuth, 54 54
this stands for the open authorization 2 protocol. 55 55
It's version 2. 56 56
Now, OAuth comes in two versions. 57 57
There's version 1 58 58
which is not commonly implemented anymore, 59 59
and there's version 2. 60 60
Now, notice what I said there. 61 61
It's called OAuth 62 62
because it's the open authorization protocol. 63 63
That means this is all about authorization, 64 64
not authentication. 65 65
Now, when you're using OAuth 66 66
it's going to serve four types of parties. 67 67
You have clients, you have resource owners, 68 68
you have resource servers, 69 69
and you have authorization servers. 70 70
Again, OAuth is for authorization. 71 71
When we talk about a client, 72 72
these are applications that the user wants to access or use. 73 73
When we talk about the resource owners, 74 74
these are the end users who are being serviced. 75 75
When we talk about the resource servers, 76 76
these are the servers provided by a service 77 77
that the user wants to access. 78 78
And then we have the authorization server. 79 79
When we talk about the authorization server, 80 80
we're talking about servers owned by the identity provider 81 81
or the IdP. 82 82
Now, how does this all work in the real world? 83 83
Well, let me give you an example here. 84 84
Here on the screen you'll see three columns. 85 85
We have the client, the authorization servers 86 86
and the resource owners. 87 87
Now, this example comes from Flickr, 88 88
and this is assuming you're going to be using 89 89
the Flickr OAuth service. 90 90
This is their version of single sign on. 91 91
Now, when I talk about a client here 92 92
I'm not talking about a client as in an end user. 93 93
Remember my definition I just used in OAuth. 94 94
A client is an application 95 95
that the user wants to access or use. 96 96
So, let's assume that my website 97 97
was going to use Flickr single sign on 98 98
as a way for you to log into it. 99 99
If you wanted to get into my website 100 100
you would go to my website, the application, 101 101
in this case, the client, 102 102
you would click on the login button 103 103
and select the logon with Flickr. 104 104
If you do that, you are now requesting a token. 105 105
At this point, 106 106
my server is going to communicate to the authorization server, 107 107
going from the client to the authorization server 108 108
and we are going to request that token. 109 109
At that point 110 110
the authorization server should give us back that token. 111 111
They're going to return it to us. 112 112
Now that that's happened, 113 113
we're going to direct the user 114 114
to go to Flickr for authorization. 115 115
So you're going to get sent over to Flickr 116 116
and you're going to put in your username and password 117 117
on the Flickr site. 118 118
At that point, Flickr server, 119 119
which again is the authorization server here 120 120
is going to prompt the user to provide their authorization, 121 121
their username and password. 122 122
Now, if you have put in the right username and password 123 123
the resource owners in this case, 124 124
which is the end user wanting to be serviced, 125 125
in this case, you, 126 126
is going to authorize applications to have access. 127 127
So, you're going to get a button that says from Flickr says, 128 128
diontraining.com would like to allow you 129 129
to log into their site using your Flickr account 130 130
and you'll say yes or no. 131 131
At that point 132 132
you're going to be redirected back from Flickr server, 133 133
the authorization servers, to the application, 134 134
that game or website, in my case, my website 135 135
and that way you're going to get this OAuth verifier sent over. 136 136
Now, the client, again, my application 137 137
which could be a game or my website or something like that 138 138
is going to exchange the required token for an access token. 139 139
Once we have that access token, 140 140
we're going to grant that access token over to Flickr 141 141
to their authorization servers 142 142
and they're going to associate that with your account. 143 143
Now, anytime you log in 144 144
and try to log into my service or my application 145 145
using Flickr, 146 146
it's going to know what rights you have on my system. 147 147
And at that point, you're going to have this OAuth token 148 148
that's now going to allow you to have protected access 149 149
to different resources, 150 150
maybe videos or quizzes or lessons or whatever it is, 151 151
and then I can send those over to you, 152 152
the resource owner, being the end user. 153 153
That's how this works. 154 154
Now, this is a little bit different 155 155
than what we talked about with SOAP and SAML, 156 156
but it kind of uses the same concept 157 157
because OAuth was based on those things. 158 158
Now, when we talk about OAuth2 159 159
it is vulnerable to some attacks. 160 160
For instance, it is vulnerable 161 161
to a cross-site request forgery attack, 162 162
and also to open redirects. 163 163
This is where the attacker is going to attempt 164 164
to get you as the user to click on a link 165 165
so your browser will perform the actions as that user 166 166
using your credentials. 167 167
And so you have to be careful of these things 168 168
and we've talked before about cross-site request forgeries. 169 169
Now, OAuth2 is explicitly designed to authorize claims 170 170
and it is not used to authenticate users. 171 171
Notice, this is an authorization protocol 172 172
open authorization 2, that's what it stands for, 173 173
so keep that in mind. 174 174
OAuth is an authorization, not an authentication platform. 175 175
Now, that means if you wanted to use it 176 176
you have to have some way to authenticate users too. 177 177
So how are you going to do that? 178 178
Well, one of the most common ways is to use OIDC 179 179
which is Open ID Connect. 180 180
This is an authentication protocol 181 181
and it can be implemented as special types of OAuth flows 182 182
with precisely defined token fields. 183 183
This will allow OAuth to be used for the authorization 184 184
which is what it's good for 185 185
and Open ID Connect can be used for authentication 186 186
which is what it's best for. 187 187
Now, I know I've been throwing around the words 188 188
authorization and authentication over and over again 189 189
in this lesson and some previous lessons, 190 190
and if it's been a while since you've done security plus 191 191
you may not remember 192 192
what the difference is between these two. 193 193
So let me just go and take a pause here 194 194
and tell you exactly what that means. 195 195
When we talk about authorization, 196 196
this is the function of specifying access rights 197 197
and privileges to certain resources. 198 198
So if you wanted to access this video lesson in the course 199 199
you need to have authorization to do that. 200 200
For instance, if you wanted to take this Friday off of work 201 201
you need authorization from your boss to not show up. 202 202
They have to give you permission. 203 203
Now, if we look at authentication, 204 204
this is the process of verifying the identity 205 205
of a person or device. 206 206
So when you go to my website 207 207
and you put in your username and password, 208 208
that is authentication. 209 209
Once you do that, and we know who you are 210 210
we then check what courses you're in 211 211
and based on those courses 212 212
you have the authorization to access those videos. 213 213
If you signed up for this course 214 214
you have the authorization to watch the CySA videos 215 215
but if you didn't sign up for the pen test plus course, 216 216
you can't watch those, you're not authorized. 217 217
But you use the same authentication 218 218
to get into the system for both, right? 219 219
And so that's the difference here. 220 220
Now, when we talk about OAuth, 221 221
this must be paired with another tool 222 222
to perform that authentication 223 223
because you have to have a way to verify that identity. 224 224
And again, the best way to do that is with Open ID Connect. 225 225
It's one of the most popular ways of doing this. 226 226
Now, the third thing we need to talk about 227 227
is JSON Web Tokens. 228 228
Now, when you see JWT, which stands for JSON Web Tokens 229 229
this is actually pronounced as Jot like J O T 230 230
but it is JSON Web Tokens. 231 231
Now, this is a token format that contains a header, 232 232
a payload, and a signature 233 233
in the form of a JavaScript Object Notation message, 234 234
which is a JSON message. 235 235
Now, when you think about a JSON Web Token 236 236
I want you to think about OAuth. 237 237
These are used to provide authorization 238 238
and specify what access rights and privileges 239 239
a user would have on a system. 240 240
Again, these are a form of assertion 241 241
that's being made about the person, 242 242
and it assumes that person has already been authenticated. 243 243
So if you're using a JSON token, you're making assertions. 244 244
This, again, is the authorization piece 245 245
not the authentication piece. 246 246
Now, if you want to see what a JSON Web Token looks like, 247 247
it looks something like this. 248 248
Notice, you've got some curly brackets 249 249
and we have these different key pairs together. 250 250
alg, h256, what do you think that means? 251 251
That's an algorithm. 252 252
What algorithm we're going to use 253 253
to hash this and make sure it has integrity? 254 254
In this case, h256, which means SHA-256. 255 255
It says what type it is? 256 256
In this case, a JWT, a JSON Web Token. 257 257
Then you see the next set, 258 258
we have sub, which is the subject. 259 259
Who are we talking about? 260 260
What's the ID of that person? 261 261
Then we have the name, in this case, Jason. 262 262
We have the email, in this case, support@diontraining.com. 263 263
Now, these are just two fields 264 264
that are attributes of that subject 265 265
whoever that ID string is, 266 266
and in this case it's Jason with support@diontraining.com. 267 267
We can have lots of different fields in this, 268 268
but in this case I wanted to keep it simple 269 269
and just show you the basics 270 270
and this would be a very, very simple JWT. 271 271
Now, if you want to send this JWT over to a web server, 272 272
how can you send it? 273 273
Well, just like we were using with SOAP and SAML, 274 274
where we can put it in as part of the url, 275 275
we can do the exact same thing. 276 276
Here you'll see diontraining.com/authorize, question mark, 277 277
and then all that stuff in white, 278 278
which is essentially base 64 encoding. 279 279
We take that JWT, we encode it using base 64 280 280
and we pass it as part of the url. 281 281
That's a great way to get information from one place 282 282
to another using JSON Web Tokens.