{"id":15705301,"url":"https://github.com/brahmlower/webservice-authentication-example","last_synced_at":"2026-02-02T11:41:25.969Z","repository":{"id":39132472,"uuid":"175931001","full_name":"brahmlower/webservice-authentication-example","owner":"brahmlower","description":"A project to demonstrate authentication using 3rd party oauth providers, 2fa, and password best practices","archived":false,"fork":false,"pushed_at":"2023-01-26T15:14:07.000Z","size":4290,"stargazers_count":1,"open_issues_count":26,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-04-07T06:35:56.869Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/brahmlower.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":"license.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-03-16T05:37:33.000Z","updated_at":"2020-06-04T02:48:32.000Z","dependencies_parsed_at":"2023-02-02T17:15:35.984Z","dependency_job_id":null,"html_url":"https://github.com/brahmlower/webservice-authentication-example","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/brahmlower/webservice-authentication-example","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brahmlower%2Fwebservice-authentication-example","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brahmlower%2Fwebservice-authentication-example/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brahmlower%2Fwebservice-authentication-example/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brahmlower%2Fwebservice-authentication-example/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/brahmlower","download_url":"https://codeload.github.com/brahmlower/webservice-authentication-example/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brahmlower%2Fwebservice-authentication-example/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":261700855,"owners_count":23196506,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-03T20:15:22.404Z","updated_at":"2026-02-02T11:41:25.914Z","avatar_url":"https://github.com/brahmlower.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"\n# Authenticated Buildings API\n\n## Project Background\n\nThis project is a case study in tying various authentication methods together\naround a central user account, and providing functionality on the aggregate\nidentity data. Inspiration for this project stems from several sources:\n\n- Simple account implementations at work\n- Frustrations on managing multiple personal acounts on services (creds vs oauth provider)\n- Plain ol' curiosity (What's it like to integrate with an oauth provider? To provide 2FA? Sms/email verification?)\n\nBefore jumping into the project, I did a little bit of cursory research on\nexisting best practices. Most roads pointed back to various OWASP resources, most\nof which are distilled in their\n[various](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Forgot_Password_Cheat_Sheet.md)\n[authentication](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md)\n[cheetsheets](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md).\nThis project is split into several phases to help keep focused while in\ndevelopment:\n\n1. Basic platform\n\n    Get decently designed frontend and backend put together, mocking out some\n    buisiness need, and providing end user controls (login, logout, account\n    management interfaces)\n\n2. Standard Authentication\n\n    Implement details around username/password authentication. Beyond hashing\n    credentials, this involves supporting migrating hashing strategies, denoting\n    force password resets, user initiated account merges\n\n3. Oauth provider integration\n\n    Support as many third party Oauth providers as I can. Google, Facebook and\n    Github are the common providers I've seen, but others like Auth0, Playstation\n    network, Xbox?, Microsoft?, Amazon?. There's a ton out there, and I'm sure\n    they all work nearly identically, but if I can find even 1 that's significantly\n    different than the rest, the quantity will be worth it.\n4. 2FA \u0026 Recovery keys\n    I expect this phase to be the most broad, as the various options for 2FA can\n    require significantly different mechanisms for authentication. The methods I\n    plan to implement are SMS, Email, Due, Google Authenticator, YubiKey and\n    printable recovery keys. I want to note that SMS and Email would be implemented\n    only because they're common strategies I've seen offered, even though both\n    are considered insecure options for 2FA.\n\nIf you poke through the codebase at this point, you will notice that scafolding\nand partial implementations are already in place for a couple phases- these were\nfrom basic proof of concept tests before I built a proper project timeline.\n\n### Phase 1 Update\n\nAt this time, phase 1 is nearly complete. The UI for basic account management\nprocesses needs to be finished, but aside from that, **super** basic platform\nfunctionality has been implemented or mocked. A decent portion of phase 2 has\nbeen completed or partially implemented. So once phase 1 is finished, most of the\nwork will be in solidifying tests and tying API endpoints to UI components.\n\n## Project Structure\n\nThe project layout is relatively self explainitory, but it's worth covering:\n\n- /backend\n\n    Python package for the backend api lives here. This directory contains all\n    the build assets needed for the python package as well as the docker image\n    used as the final delivery artifact.\n\n- /docker\n\n    This project uses a simple nginx container to serve static frontend assets\n    and to proxy api requests along to the backend service. The nginx\n    configurations live in this directory and are mounted in as volumes by\n    docker-compose.\n\n- /frontend\n\n    React source and assets live in here. This was bootstraped by the create-react-app\n    utility.\n\n- /sql\n\n    Sqitch is used as a general SQL migrations manager, and as such, this directory\n    structure is largely dictated by sqitch. The makefile is useful for executing\n    common actions without having to invest too much time in remembering sqitch\n    usage.\n\n### Makefiles\n\nI tend to use makefiles as an entrypoint user interface during development. Most\ncommon tasks are writen out in a makefile for easy execution, and for reference.\nYou'll notice that the toplevel makefile itself hardly does anything original- it\njust calls out to the makefiles in the various subdirectories. If you're unsure\nabout what can be done in some directory, running `make help` or looking at the\nmakefile is a great first step in getting familiarized.\n\n## Setup \u0026 Build\n\nProject dependencies:\n- Docker\n- Docker Compose\n- [Sqitch](https://sqitch.org/)\n- Python3 (including pip, virtualenv)\n- Make\n- NPM\n- React\n\n### Backend\n\nThe backend is set up as a single package that gets installed in a docker image,\nwhich keeps the initial installation process relatively simple.\n\n```\n$ virtualenv -p python3 venv\n$ source venv/bin/activate\n$ make backend-build\n$ docker-compose build api\n```\n\n### Frontend\n\nThe frontend build process is pretty simple as far as NPM projects go- just cd\ninto the directory, install and build. Disclaimer: I'm not a frontend dev by\ninterest, so I haven't invested as much time in learning about, improving, or\ncleaning up this build process.\n\n```\ncd frontend\nnpm install\nnpm run build\n```\n\n### Database\n\nThe makefiles aim to make applying and reverting sqitch migrations as easy as\npossible. You should be able to start the postgres container, and apply the\nmigrations using the following two steps:\n\n```\ndocker-compose up -d db\nmake deploy\n```\n\nIf you want to revert the database, you can destroy the container volume, or run\n\n```\nmake revert\n```\n\n### The full stack\n\nIf you've completed the build process for the previous three sections (backend,\nfrontend, and database), then you should be able to bring up all the docker\ncontainers and visit the site locally.\n\n```\ndocker-compose up -d\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbrahmlower%2Fwebservice-authentication-example","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbrahmlower%2Fwebservice-authentication-example","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbrahmlower%2Fwebservice-authentication-example/lists"}