Protect Your API With OAuth2

A presentation at PHP Yorkshire in April 2017 in York, UK by Rob Allen

Slide 1

Protect Your API with OAuth 2 Slides: http://akrab.at/2nin0yI Rob Allen ~ April 2017 ~ @akrabat

Slide 2

Authentication Know who is logging into your API • Rate limiting • Revoke application access if its a problem • Allow users to revoke 3rd party applications Rob Allen ~ @akrabat

Slide 3

How? Authorization header: GET /books/1 HTTP/1.1 Host: api.example.com Accept: application/json Authorization: Basic QWxhZGRpbjpPcGVuU2VzYW1l base64_encode ( "Aladdin:OpenSesame" )

QWxhZGRpbjpPcGVuU2VzYW1l Rob Allen ~ @akrabat

Slide 4

Problems • All clients have to know user's credentials • Credentials are passed in every request Rob Allen ~ @akrabat

Slide 5

OAuth2 The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service oauth.net Rob Allen ~ @akrabat

Slide 6

Roles • The user (Resource Owner) • The (third-party) application (Client) • The API (Resource Server) • The Authorisation server Rob Allen ~ @akrabat

Slide 7

Grant types Grant type Use case Authorization code 3rd party web or native Password 1st party Client credentials application (no user) Implicit 3rd party JS app Rob Allen ~ @akrabat

Slide 8

Tokens OAuth uses a bearer token GET /books/1 HTTP/1.1 Host: api.example.com Accept: application/json Authorization: Bearer {some-string-here} Rob Allen ~ @akrabat

Slide 9

Password grant (for 1st party apps) Rob Allen ~ @akrabat

Slide 10

Password grant Rob Allen ~ @akrabat

Slide 11

Password flow Rob Allen ~ @akrabat

Slide 12

Password flow Rob Allen ~ @akrabat

Slide 13

Password flow Rob Allen ~ @akrabat

Slide 14

Password flow Rob Allen ~ @akrabat

Slide 15

Implementing in PHP Rob Allen ~ @akrabat

Slide 16

OAuth 2.0 Server PHP by Brent Shaffer $ composer require bshaffer/oauth2-server-php • Implements Authorise and Token endpoints • Mulitple storage backends: PDO, Redis, Mongo, Cassandra, DynamoDB, etc Rob Allen ~ @akrabat

Slide 17

Steps to implement For the client and user credentials grants: 1. Set up the database tables 2. Register the OAuth2 Server 3. Implement the Authorise endpoint Rob Allen ~ @akrabat

Slide 18

Database tables • CREATE TABLE oauth_clients ... • CREATE TABLE oauth_access_tokens ... • CREATE TABLE oauth_authorization_codes ... • CREATE TABLE oauth_refresh_tokens ... • CREATE TABLE oauth_users ... • CREATE TABLE oauth_scopes ... • CREATE TABLE oauth_jwt ... (SQL is in the Cookbook in the docs) Rob Allen ~ @akrabat

Slide 19

Create a Server 1 use MyAuth\PdoStorage ; 2 use OAuth2\GrantType\UserCredentials ; 3 4 $container [ 'OAuth2Server' ]

function ( $c ) { 5 $pdo

$c

get ( 'db' ); 6 $storage

new PdoStorage ( $pdo ); 7 8 $server

new \OAuth2\Server ( $storage ); Rob Allen ~ @akrabat

Slide 20

Add the grant 1 use MyAuth\PdoStorage ; 2 use OAuth2\GrantType\UserCredentials ; 3 4 $container [ 'OAuth2Server' ]

function ( $c ) { 5 $pdo

$c

get ( 'db' ); 6 $storage

new PdoStorage ( $pdo ); 7 8 $server

new \OAuth2\Server ( $storage ); 9 10 /* Add the password grant type */ 11 $userCreds

new UserCredentials ( $storage ); 12 $server

addGrantType ( $userCreds ); 13 14 return $server ; 15 }; Rob Allen ~ @akrabat

Slide 21

Aside: use Bcrypt namespace MyAuth ; class PdoStorage extends \OAuth2\Storage\Pdo { protected function checkPassword ( $user , $pwd ) { return password_verify ( $pwd , $user [ 'password' ]); } } Rob Allen ~ @akrabat

Slide 22

Credentials We need a client: 1 INSERT INTO oauth_clients 2 ( client_id , client_secret , redirect_uri ) 3 VALUES 4 ( "mywebsite" , "$2y$10$mzP0fR...BHu" , null ); Rob Allen ~ @akrabat

Slide 23

Credentials We need a client: 1 INSERT INTO oauth_clients 2 ( client_id , client_secret , redirect_uri ) 3 VALUES 4 ( "mywebsite" , "$2y$10$mzP0fR...BHu" , null ); & a user: 1 INSERT INTO oauth_users 2 ( username , password , first_name , last_name ) 3 VALUES 4 ( "rob" , "$2y$10$Qq1CsK...LV6" , "Rob" , "Allen" ); Rob Allen ~ @akrabat

Slide 24

Token endpoint 1 $app

post ( 2 '/token' , 3 function ( $request , $response ) { 4 $server

$this

get ( 'OAuth2Server' ); 5 $req

\OAuth2\Request :: createFromGlobals (); 6 7 $server

handleTokenRequest ( $req )

send (); 8 exit ; 9 } 10 ); Rob Allen ~ @akrabat

Slide 25

How does this work? 1 $ curl -i -X POST http://localhost:8888/token
2   -H "Accept: application/json"
3   -H "Content-Type: application/json"
4   -d $'{ 5       "grant_type": "password" 6       "client_id": "mywebsite", 7       "client_secret": "abcdef", 8       "username": "rob", 9       "password": "123456" 10   }' Rob Allen ~ @akrabat

Slide 26

Response 1 HTTP/1.1 200 OK 2 Host: localhost:8888 3 Content-Type: application/json 4 5 { 6 "access_token": "65077f90e3baae8aa863", 7 "expires_in": 3600, 8 "token_type": "Bearer", 9 "scope": null, 10 "refresh_token": "be071d2c6193d32a353d" 11 } Rob Allen ~ @akrabat

Slide 27

Protecting your API endpoints Rob Allen ~ @akrabat

Slide 28

Is the token valid? 1 /* test for valid Auth header */ 2 $req

\OAuth2\Request :: createFromGlobals (); 3 if ( ! $server

verifyResourceRequest ( $req )) { 4 /* not valid / 5 } 6 7 / get information */ 8 $token

$server

getAccessTokenData ( $req ); 9 $username

$token [ 'user_id' ]; Rob Allen ~ @akrabat

Slide 29

Unauthorised API call 1 $ curl -i -H "Accept: application/json"
2 http://localhost:8888/authors 3 4 HTTP/1.1 401 Unauthorized 5 Host: localhost:8888 6 Connection: close 7 X-Powered-By: PHP/7.0.15 8 WWW-Authenticate: Bearer realm="Service" 9 Content-Type: application/json Rob Allen ~ @akrabat

Slide 30

Authorised API call 1 $ curl -i -H "Accept: application/json"
2 -H "Authorization: Bearer 65077f90e3baae8aa863"
3 http://localhost:8888/authors 4 5 HTTP/1.1 200 OK 6 Host: localhost:8888 7 Connection: close 8 X-Powered-By: PHP/7.0.15 9 Content-type: application/hal+json 10 11 { 12 "count": 6, 13 "_links": { 14 ... Rob Allen ~ @akrabat

Slide 31

Authorisation Code (for 3rd party apps) Rob Allen ~ @akrabat

Slide 32