andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

How to deal with the most common security threats in web development.

The focus on security has never been more important than in the current times. In the IT world, it gains more relevance every day. But ensuring security is not just about system administrators. It must also be a developer's skill, especially if they are web developers.

Auth0 brings you [a free ebook about security and web development](https://auth0.com/resources/ebooks/security-for-web-developers). Learn more about it and why you should care about web development security.

## The Web as a Development Platform

Today's Web is not the Web of the early '90s when it was invented. Originally, it was created primarily as a content management system, that is, a platform for sharing and linking static documents. The HTTP protocol and HTML language were sufficient to achieve these basic goals, and security concerns were mostly limited to controlling access to confidential documents.

The demand for interactivity led to the introduction of JavaScript and dynamic page generation technologies, both on the client and on the server sides. That has completely changed the primary use of the Web. It has evolved from a simple way to share and link documents to the backbone of the software and human connection. **The old content management system platform has switched to become a development platform**.

This paradigm change has brought benefits but also pitfalls. And it also brought a slew of new challenges, the most pressing of which is security.

## Web Applications and Security

Web application security refers to the measures taken to protect a website or web application from external attacks that could result in data loss, denial of service, or privacy violation, among other things.
When you deploy a web application, it can be accessed by anyone. You can't make any assumptions about who will access it: authorized or unauthorized users, humans, or bots. By default, **you should assume that your application is exposed to any security risk**. But what are security risks?

Three key concepts should be clear to you when analyzing your application security:

- **Threats** are incidents that can potentially harm your application. Think of them as external processes that your application must defend against.
- **Vulnerabilities** are weaknesses in your application that attackers can exploit. They can depend on design flaws or bugs, not just in your code, but also in its dependencies. Deficiencies can also exist at the infrastructure level, such as insecure protocols or network issues.
- **Risks** are the potential damage your application can suffer when a threat exploits a vulnerability. You can think of risks as the intersection of threats and vulnerabilities.

Understanding these concepts is fundamental for protecting your applications against attackers.

<include src="BigQuote" quoteText="Know your enemy and know yourself, find naught in fear for 100 battles. Know yourself but not your enemy, find level of loss and victory. Know not thy enemy nor yourself, wallow in defeat every time" quoteAuthor="Sun Tzu" />

**Consider threats as your enemy’s weapons and vulnerabilities as your weakness**. You need to know both to face the battle and make decisions with a calculated risk. In other words, learning how security attacks work is the first pass to avoiding them.

## Common Web Application Threats

It is not possible to make a complete list of potential threats to which a web application is exposed. The constantly-shifting state of web security means that there are too many variables at play. However, there are well-known threats that you should be aware of.
The [Open Web Application Security Project](https://owasp.org/) (OWASP), the online community devoted to spreading knowledge and awareness about web security, tracks the most common security risks for web applications in its [OWASP Top Ten](https://owasp.org/www-project-top-ten/). This document intends to create security awareness in the developer audience by detailing the ten most critical security risks. It represents an excellent first step towards creating a security culture in the developers’ community. Hopefully, this first step may push developers for the adoption of a [security by design](https://en.wikipedia.org/wiki/Secure_by_design) mindset, i.e., an **approach that makes you think of security at each step of your application development**.

<include src="SignupCTA" text="Try out the most powerful authentication platform for free." linkText="Get started →" />

## Security for Web Developers

In this path toward security awareness, Auth0 wants to contribute with a free ebook dedicated to security for web development: "[Security for Web Developers](https://auth0.com/resources/ebooks/security-for-web-developers)".

As we said, to protect your web applications from security risks, **you need to know how threats work to understand your application's vulnerabilities**. Each chapter of this book is dedicated to one threat and provides you with working examples of vulnerable applications. Using these examples, you’ll learn the “behind the scenes” details of each threat and how to remediate the application’s vulnerability.

For example, you will learn how *Cross-Site Scripting* (XSS), *Cross-Site Request Forgery* (CSRF), and *Clickjacking* attacks work in practice and how you can prevent them. But it's not all about reading. You can also download and get your hands on the code explained in the book. So, what are you waiting for? [Download your free copy](https://auth0.com/resources/ebooks/security-for-web-developers) and leave your feedback in the comments!

<include src="ebook-ads/WebSecurity" />


Security and Web Development

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

A preview of our new ebook about OIDC, the de facto standard for handling authentication in the modern world.



**TL;DR:** In August 2019, Auth0 published an ebook called [The OpenID Connect Handbook](https://auth0.com/resources/ebooks/the-openid-connect-handbook) to help developers leverage this modern identity layer to provide an easy and secure authentication mechanism to their users. This ebook covers all the main concepts that you must know to integrate your app with OpenID Connect providers. If you are in a hurry and would like to dive right into the content of the ebook, click the link below to get your free copy.

<include src="ebook-ads/OidcHandbook" />

The rest of this article will summarize the content of the ebook so you can take a glimpse of what you will learn about on the ebook.

<include src="TweetQuote" quoteText="The OpenID Connect Handbook teaches you everything you need to handle end-user authentication securely."/>

## The Contents of the OpenID Connect Handbook

As of October 2019, the handbook covers six main areas related to OpenID Connect. Each area has a chapter of its own that is subdivided into other sections to help you understand OpenID Connect, how this identity layer was born, and how to use it to secure your applications:

1. Introduction
2. OpenID Connect Introduction
3. OpenID Connect in Action
4. OpenID Connect and Traditional Web Applications
5. Traditional Web Apps and the Delegated Authorization Flow
6. OpenID Connect and Single-Page Applications

The following sections will cover each one of these chapters separately, so you can learn what to expect on them. Hopefully, if you are looking to learn about a topic in particular, you will be able to download the free ebook and dive right into it.

## Introduction

The Introduction chapter of this handbook disserts about topics that are not part of OpenID Connect per se, but that are important for you to grasp before you start learning about it. In this chapter, you will learn about the terms Entity and Identity and you will learn about how they are interconnected. There, you will learn that an entity has multiple identities and that people, or other entities, perceive entities through their identities.

![Every entity have multiple identities that others use to perceive them.](https://images.ctfassets.net/23aumh6u8s0i/2nKkQmov8tv3VgxNExyjjp/b0898dc4882fc7104241af91feb63850/entity-identity-concepts)

After that, you will learn about the terms Authentication and Authorization. More specifically, you will learn how these terms are related, how one thing can lead to another, and how they differ. Authentication vs. Authorization is an important topic that causes great confusion, even on members of the IT workforce around the world.

![Authentication and authorization are topics that cause confusion and that are often used interchangeably by mistake.](https://images.ctfassets.net/23aumh6u8s0i/olPsGOC0fQLSBHxkP4Ujp/384681fbed0a5587f1646e7becb0e378/end-user-authentication)

## OpenID Connect Introduction

After learning about the conceptual topics that preamble this ebook, you will start learning about OpenID Connect. This chapter will begin by guiding you through a ten-thousand-foot overview of how an OpenID Connect authentication transaction works. After that, you will briefly read about other authentication mechanisms and how the IT community went from simple usernames and passwords, to Kerberos, to SAML, and OpenID Connect.

![A brief illustration that shows how SAML works.](https://images.ctfassets.net/23aumh6u8s0i/2l4JlPlLlYCqLPfYCZILmj/bbbb9ea320109fa04ee89c2344fb666d/an-illustration-of-how-saml-works)

The chapter will then move into more details about the OpenID Connect specification and will talk about OAuth 2.0, the underlying technology that the identity layer builds on top. In the end, you will read about some OpenID Connect use cases so you can learn when this technology can be helpful.

## OpenID Connect in Action

The next chapter on the ebook, called OpenID Connect in Action, will start to teach you the inner workings of the OpenID Connect specification. There, you will set up an OpenID Connect provider that you will use through the hands-on exercises, and you will prepare your local environment to run the samples that you will learn about. As the goal of the ebook is to show, step by step, how you can secure your applications with OpenID Connect, the exercises will use the most popular programming language in the world (i.e., JavaScript) to lower the barrier.

![Creating an OpenID Connect provider to use throughout the handbook exercises](https://images.ctfassets.net/23aumh6u8s0i/3XeqIvJa9337fCbQyqQAtM/a133df9d47c5e2f1f5dcc93a7d56d0a7/creating-an-openid-connect-provider)

## OpenID Connect and Traditional Web Applications

Having created your OpenID Connect provider and prepared your local development environment, the next chapter will be the first hands-on activity of the ebook. However, besides being a hands-on activity, the chapter will also teach about important topics such as [the authentication flows](https://auth0.com/docs/flows). You will find a few other useful resources on the internet that inform you about OpenID Connect. The main problem with them, which this ebook aims at solving, is that they introduce a lot of theory before giving you anything you can use.

In this ebook, you will see that you will learn about the abstract parts of OpenID Connect on the fly. That is, instead of investing time to learn about all the different authentication flows that OpenID Connect supports and about all the abstract terms involved in them, this ebook will briefly teach you about them, then it will use these concepts right away.

For example, after you read about what an authentication flow is, you will jump right into using one. Besides that, you will read and learn how to use Discovery Endpoints, an prominent piece of OpenID Connect providers, right away. You will also learn about other important topics in this chapter like the Authentication Callback and user profiles.

## Traditional Web Apps and the Delegated Authorization Flow

After you learn about how OpenID Connect securely promotes end-user authentication, the ebook will continue by teaching you about one of the most prominent scenarios where OpenID Connect and OAuth 2.0 are used: on delegated authorization. The chapter will show you all you need to know about this kind of authorization but, basically speaking, delegate authorization is when you let an app act on your behalf. The example that you will read about everywhere, including in this ebook, is when a third-party application wants to help you schedule tweets. In this scenario, this third-party app will have to ask you for permission to tweet on your behalf on the date and time you configure it. When this app issues a request to Twitter to create the tweet, the app will be acting on your behalf.

![Delegated authorization sample where the app wants to tweet on behalf of the user.](https://images.ctfassets.net/23aumh6u8s0i/6JNFmYekPxdetLv4IP2E7H/7613f4ab8889cda76b97605430526401/delegated-authorization)

## OpenID Connect and Single-Page Applications

The last chapter of the handbook (so far, because we will publish more chapters soon) talks about how to secure Single-Page Applications with OpenID Connect. In the modern internet, most popular apps (and those that are not popular also) are using this approach to promote a better user experience to their customers. Therefore, it wouldn't make sense to have an ebook that does not cover the most popular paradigm when it comes to web development.

In this chapter, you will learn about terms like PKCE (Proof of Key for Code Exchange) while integrating a single-page app with your OpenID Connect provider. Besides that, you will also take a look at a popular alternative called the Implicit Grant and why this approach is not encouraged anymore. As SPAs are usually hosted as static files in a cloud provider, you will also use delegated authorization in this chapter. That is, you will have an API that contains data that belong to users and you will make the SPA ask users permission to consume this API on their behalf.

![Single-Page Apps can securely authenticate end-users with OpenID Connect providers by using PKCE.](https://images.ctfassets.net/23aumh6u8s0i/338DB6V09xi9ufeUEy5nzS/b76da928c2481cf90500ef5492094b6e/spa-and-the-pkce-flow)

## Conclusion

As you can see, if you are interested in learning about OpenID Connect and how this technology can help you secure your applications, you came to the right place. In this ebook, you will learn everything you need to make your apps behave as OpenID Connect clients and how to make them consume APIs on their users behalf. Another interesting thing that you will learn in this handbook is about how popular and official SDKs (like the ones supported by Auth0) can help you be more efficient. That is, the ebook will show you everything you need to code in any application to make it integrate with an OpenID Connect provider, but it will also show you a more straightforward way to achieve your goals. With this, you will have both the tools to debug any misconfiguration and to be as focused as possible on what makes your app unique.

If you need help with any matter related to the OpenID Connect Handbook or to identity, authentication, and authorization, let us know in the comment box below.

<include src="TweetQuote" quoteText="OpenID Connect is an easy and powerful tool you can use to secure your applications."/>

<include src="asides/AboutAuth0" />


"ebook"