awesome-authentication
Resources to learn and implement authentication in your application
https://github.com/gitcommitshow/awesome-authentication
Last synced: 20 days ago
JSON representation
Fundamentals You Must Know
About Frameworks
About Tokens
Cryptography
- Assymetric Cryptography
- Digital Signatures : Verifying authenticity of message
- Forward Secrecy : A way to protect against future compromises of private key
- Encryption vs Signing
- Encryption vs Encoding
Invalidating JWT
- Strategies to invalidate jwt - SO Q&A
- Discussion: Is refreshing an expired JWT token a good strategy?
Maintaining Forward Secrecy
- Double Rachet Algo
- Signal protocol specs - protocol-javascript)
Secure Key Exchange In Public
- Diffie Hellman Key Exchange
- Diffie-Hellman key exchange implementation in node.js
- An SO answer to build more understanding around DH algo, signatures, forward secrecy, etc.
Web-Security Recommendations
Implementations(Examples/Demos)
Invalidating JWT
- JWT Authentication & Authorization in NodeJs/Express & MongoDB REST APIs(2019)
- JWT+Passport
- JWT+Passport : Code
- JWT+Passport : Guide on DO
- Refreshing token using node-jsonwebtoken
- Passport-jwt
- Inspiration: Read Firefox Accounts Code- All services including autyh-server, profile-server - services/docs/accounts/welcome.html)**
- oAuth2 server toolkit for node.js
- OAuth2 Server and OpenID Connect Provider written in Go - sdk in all languages
- JavaScript client SDK to communicate with OAuth 2.0 and OpenID Connect providers
- AuthZ lib supports ACL, RBAC, ABAC in Node.js
- oAuth2 server with node.js
- Demo: How Docusign APIs auth workflow using JWT access token and refresh tokens
- oAuth libraries for node.js
- Google OpenIDConnect authentication
Securtity Risks and Criticism of JWT
Invalidating JWT
- JWT attack - signature as MAC
- Why JWTs Suck as Session Tokens
- No Way, JOSE! Javascript Object Signing and Encryption is a Bad Standard That Everyone Should Avoid
- Things to Use Instead of JWT
- Paseto is a Secure Alternative to the JOSE Standards (JWT, etc.)
- Stop using JWT for sessions - using-jwt-for-sessions-part-2-why-your-solution-doesnt-work/)
- Recreating JWT validation bypass
- 3 JWT design flaws
- Branca as an Alternative to JWT?