ter02#19

Open

spispes wants to merge 228 commits into

NeilMadden:chapter02from

Commits on Apr 15, 2019

Listing 2.1 - update POM with our required dependencies.
Neil Madden
committed
Listing 2.2 Add the database schema SQL file
Neil Madden
committed
Remove Maven-generated App/AppTest classes
Neil Madden
committed
Listing 2.3 Setting up the connection pool
Neil Madden
committed
Listing 2.4 The SpaceController class
Neil Madden
committed
Listing 2.5 Wiring up the Natter API endpoints
Neil Madden
committed
Listing 2.6 Using prepared statements
Neil Madden
committed
Listing 2.7 Create restricted database user
Neil Madden
committed
Listing 2.8 Using the Dalesbred library
Neil Madden
committed
Listing 2.9 Validating inputs
Neil Madden
committed
Listing 2.10 Handling exceptions
Neil Madden
committed
Remove information leakage
Neil Madden
committed
Exploiting XSS against the Natter API
Neil Madden
committed
Listing 2.12 Preventing XSS attacks
Neil Madden
committed
Listing 2.13 Posting a new message
Neil Madden
committed
Listing 2.14 Reading a single message
Neil Madden
committed
Listing 2.15 Searching for recent messages
Neil Madden
committed
Listing 2.16 The Moderator API
Neil Madden
committed

Commits on May 14, 2019

Add Guava dependency
Neil Madden
committed
Listing 3.1 Add rate-limiting with Guava
Neil Madden
committed
Add scrypt dependency
Neil Madden
committed
Add users table
Neil Madden
committed
Listing 3.2 Registering a new user
Neil Madden
committed
Add the user registration endpoint
Neil Madden
committed
Grant database user permissions on user table
Neil Madden
committed
Listing 3.3 Authenticating a request
Neil Madden
committed
Add authentication checks
Neil Madden
committed
Listing 3.4 Enabling HTTPS
Neil Madden
committed
Add audit log table
Neil Madden
committed
Listing 3.5 The audit log controller
Neil Madden
committed
Wire up audit logging
Neil Madden
committed
Require authentication
Neil Madden
committed
Add permissions table and ensure space owner has full perms
Neil Madden
committed
Listing 3.6 Checking permissions in a filter
Neil Madden
committed
Listing 3.7 Add authorization filters
Neil Madden
committed
Listing 3.8 Adding users to a space
Neil Madden
committed
Avoid integrity constraint error in schema
Neil Madden
committed
Wire up addMember operation
Neil Madden
committed
Avoid privilege escalation attack
Neil Madden
committed
Listing 4.1 Calling the Natter API from JavaScript
Neil Madden
committed
Listing 4.2 The Natter HTML UI
Neil Madden
committed
Listing 4.3 Intercepting form submission
Neil Madden
committed
Serve HTML static files from the same origin as the API
Neil Madden
committed
Listing 4.4 CORS filter
Neil Madden
committed
Wire up CORS filter
Neil Madden
committed
Listing 4.5 Producing a session cookie
Neil Madden
committed
Listing 4.6 Avoid session fixation attacks
Neil Madden
committed
Listing 4.7 Validating a session cookie
Neil Madden
committed
Wire up session validation
Neil Madden
committed
Listing 4.8 Calling the login endpoint from JavaScript
Neil Madden
committed
Listing 4.9 The login form HTML
Neil Madden
committed
Listing 4.10 Redirecting to the login page
Neil Madden
committed
Listing 4.11 Removing the WWW-Authenticate challenge
Neil Madden
committed
Listing 4.12 Preventing Flash-based CSRF bypass
Neil Madden
committed
Listing 4.13 CSRF protection filter
Neil Madden
committed
Listing 4.14 Returning the anti-CSRF token after login
Neil Madden
committed
Listing 4.15 Storing the anti-CSRF token in localStorage
Neil Madden
committed
Listing 4.16 Passing the X-CSRF-Token header
Neil Madden
committed
Add X-CSRF-Token to CORS allowed headers
Neil Madden
committed
Remove X-Requested-With filter in favour of CsrfFilter
Neil Madden
committed

Commits on May 21, 2019

Update code to reflect revised chapter 4
Neil Madden
committed

Commits on Jun 2, 2019

Add logout
Neil Madden
committed
Allow running on a different port
Neil Madden
committed
Listing 5.1 CORS filter
Neil Madden
committed
Enable the CORS filter
Neil Madden
committed
The DatabaseTokenStore
Neil Madden
committed
Bearer authentication scheme
Neil Madden
committed
switch to bearer
Neil Madden
committed
Delete expired tokens
Neil Madden
committed
Switch to scheduleAtFixedRate
Neil Madden
committed
Switch to Bearer auth in the UI
Neil Madden
committed
Use localStorage for tokens
Neil Madden
committed
Tighten up the CORS settings
Neil Madden
committed
Client-side stateless tokens
Neil Madden
committed
JsonTokenStore revocation
Neil Madden
committed
Add encryption to client-side tokens
Neil Madden
committed
Encrypted token revocation
Neil Madden
committed
Move to ChaCha20-Poly1305 authenticated encryption
Neil Madden
committed
Verify the audience as a JWT.
Neil Madden
committed
Produce valid HS256 JWTs
Neil Madden
committed
Produce encrypted JWTs with nimbus-jose
Neil Madden
committed
JWT token revocation
Neil Madden
committed
Tidy up hand-rolled JWT validation code.
Neil Madden
committed
Correct Date import
Neil Madden
committed
Fix JWT processing
Neil Madden
committed
Extract JWT header into a separate wrapper store
Neil Madden
committed
JwtHeaderTokenStore revocation
Neil Madden
committed
Switch back to the JwtTokenStore
Neil Madden
committed
Add types to enforce security properties
Neil Madden
committed
Add the HmacTokenStore
Neil Madden
committed

Commits on Jun 4, 2019

Revert change to database permissions
Neil Madden
committed
Switch back to using the JwtTokenStore
Neil Madden
committed
Implement token whitelisting for JWTs
Neil Madden
committed
Update README with links to chapter branches
Neil Madden
committed
Add support for scoped tokens.
Neil Madden
committed
OAuth2TokenStore
Neil Madden
committed
OAuth2 token revocation
Neil Madden
committed
Updated README
Neil Madden
committed

Commits on Jul 1, 2019

Improve OAuth2TokenStore
Neil Madden
committed

Commits on Jul 2, 2019

Switch to "TLS" SSLContext to avoid blocking TLS1.3
Neil Madden
committed

Commits on Jul 3, 2019

Add SignedJwtAccessTokenStore
Neil Madden
committed
Fix compilation error
Neil Madden
committed

Commits on Jul 5, 2019

Add a minimal OAuth 2 Authorization Server (ROPC only)
Neil Madden
committed
Example filter for validating an ID token based on an access token.
Neil Madden
committed

Commits on Aug 1, 2019

Update .gitignore
Neil Madden
committed

Commits on Aug 5, 2019

Use static import for now()
Neil Madden
committed

Commits on Aug 6, 2019

Commits on Sep 10, 2019

Update dependencies to latest stable versions
Neil Madden
committed
Update dependencies to latest stable versions
Neil Madden
committed
Update dependencies to latest stable versions
Neil Madden
committed
Update dependencies to latest stable versions
Neil Madden
committed
Update dependencies to latest stable versions
Neil Madden
committed
Update dependencies to latest stable versions
Neil Madden
committed
Update default security headers
Neil Madden
committed
Update default security headers
Neil Madden
committed

Commits on Sep 11, 2019

Update default security headers
Neil Madden
committed
Add OAuth2TokenStore
Neil Madden
committed
Secure HTTPS client settings
Neil Madden
committed
Add simple app for revoking access tokens
Neil Madden
committed
Add SignedJwtAccessTokenStore
Neil Madden
committed

Commits on Sep 14, 2019

Add simple group support
Neil Madden
committed
Add LdapUserController that authenticates and looks up groups from LDAP
Neil Madden
committed
Revert to original UserController
Neil Madden
committed
Implement RBAC
Neil Madden
committed
Allow users to specify a role when creating a session
Neil Madden
committed

Commits on Sep 16, 2019

Implement ABAC with Drools
Neil Madden
committed

Commits on Oct 5, 2019

Update README for chapters 8 and 9
Neil Madden
committed
Top-up with changes from chapters 7 and 8
Neil Madden
committed
Update README to point to MEAP
Neil Madden
committed

Commits on Oct 8, 2019

Split out lookup of permissions from enforcement
Neil Madden
committed

Commits on Oct 9, 2019

Initial capability URI implementation
Neil Madden
committed
Fix NPE bug in permission check
Neil Madden
committed
Rearrange authentication in UserController
Neil Madden
committed
Flesh out capabilities for other API methods.
Neil Madden
committed

Commits on Oct 10, 2019

Switch to stateless capability tokens
Neil Madden
committed

Commits on Oct 12, 2019

Add a simple capability-based message browser
Neil Madden
committed
Fix stray quote
Neil Madden
committed
Use Authorization header for capability tokens
Neil Madden
committed
Remove test code
Neil Madden
committed

Commits on Oct 13, 2019

Use cookies for authN, capabilities for authZ
Neil Madden
committed

Commits on Oct 14, 2019

Implement MacaroonTokenStore
Neil Madden
committed

Commits on Oct 17, 2019

Only require authentication when looking up permissions.
Neil Madden
committed

Commits on Nov 4, 2019

Fix schema loading code to also work within Docker
Neil Madden
committed
Build basic Docker image with Google JIB
Neil Madden
committed

Commits on Nov 5, 2019

Remove FK constraint from tokens to users
Neil Madden
committed
Add Dockerfile for H2 database
Neil Madden
committed
Disable TLS and make JDBC URL configurable
Neil Madden
committed
Use older version of H2 to avoid bug
Neil Madden
committed
Remove stray comma
Neil Madden
committed

Commits on Nov 8, 2019

Create Kubernetes microservice deployments
Neil Madden
committed

Commits on Nov 9, 2019

Add network policies
Neil Madden
committed

Commits on Nov 11, 2019

Expose certs as secrets
Neil Madden
committed

Commits on Nov 12, 2019

Enable TLS across the cluster
Neil Madden
committed

Commits on Nov 17, 2019

Disable TLS again and switch to link preview microservice example
Neil Madden
committed

Commits on Nov 21, 2019

Avoid SSRF and DNS rebinding attacks
Neil Madden
committed
Delete network policies
Neil Madden
committed

Commits on Nov 22, 2019

Enable Linkerd service mesh
Neil Madden
committed
Update valid host headers
Neil Madden
committed

Commits on Nov 25, 2019

Add ingress controller
Neil Madden
committed
Add sample private key and certificate PEMs
Neil Madden
committed

Commits on Nov 27, 2019

Merge changes after chapter 10
Neil Madden
committed
Update README for chapter 10
Neil Madden
committed
Use password component for capability token
Neil Madden
committed

Commits on Dec 14, 2019

Increase visibility of sha256 method for reuse
Neil Madden
committed
Top-up from chapter04-end
Neil Madden
committed
Top-up merge from ch4
Neil Madden
committed
Pull out base64 encoder field
Neil Madden
committed
Hash tokens in the DatabaseTokenStore
Neil Madden
committed

Commits on Dec 16, 2019

Top-up merge from chapter05-end
Neil Madden
committed
Top-up merge from chapter05-end
Neil Madden
committed
Extract Base64url utility class
Neil Madden
committed
Top-up merge of chapter04-end to pull in Base64url
Neil Madden
committed
Merge branch 'chapter05' into chapter05-end
Neil Madden
committed
Use Base64url utility class
Neil Madden
committed
Pull in Base64url changes
Neil Madden
committed
Use Base64url utility class
Neil Madden
committed
More Base64url cleanup
Neil Madden
committed

Commits on Jan 9, 2020

Chapter 6 revisions
Neil Madden
committed

Commits on Jan 19, 2020

More chapter 6 revisions
Neil Madden
committed
Top-up merge branch 'chapter06-end' into chapter07
Neil Madden
committed
Top-up merge from ch6
Neil Madden
committed
Top-up merge branch 'chapter08' into chapter08-end
Neil Madden
committed
Correct type error
Neil Madden
committed
Top-up merge from ch8
Neil Madden
committed
Top-up merge from ch9
Neil Madden
committed

Commits on Jan 20, 2020

Fix broken HmacTokenStore usage
Neil Madden
committed
Sample JWT bearer client
Neil Madden
committed

Commits on Jan 27, 2020

Add TLS client certificate authentication
Neil Madden
committed
Allow password authentication to be disabled
Neil Madden
committed

Commits on Feb 3, 2020

Enforce mTLS certificate-bound access tokens
Neil Madden
committed

Commits on Feb 5, 2020

Read database password from Kubernetes secrets
Neil Madden
committed

Commits on Feb 7, 2020

Use HKDF to derive keys without storing them
Neil Madden
committed
Merge changes from chapter11-end
Neil Madden
committed
Update README.md for chapter 11
Neil Madden
committed

Commits on Feb 10, 2020

Ensure client cert auth succeeded
Neil Madden
committed

Commits on Feb 17, 2020

Rationalize use of the term "service" to avoid confusion
Neil Madden
committed
Top-up merge branch 'chapter11' into chapter11-end
Neil Madden
committed
Top-up merge branch 'chapter11-end'
Neil Madden
committed

Commits on Feb 25, 2020

Fix scope of constant
Neil Madden
committed
A simple UDP client and server
Neil Madden
committed

Commits on Feb 26, 2020

Initial DTLS implementation (WiP)
Neil Madden
committed

Commits on Mar 4, 2020

Rename classes
Neil Madden
committed

Commits on Mar 5, 2020

Debugged DTLS implementation
Neil Madden
committed

Commits on Mar 9, 2020

Use ChaCha20-Poly1305 cipher suites
Neil Madden
committed
BouncyCastle TLS PSK example
Neil Madden
committed
Convert BC PSK example to use DTLS
Neil Madden
committed
Send an empty initial packet to kick-start the handshake
Neil Madden
committed
Use raw PSK cipher suites
Neil Madden
committed

Commits on Mar 12, 2020

Add example of COSE encryption with HKDF
Neil Madden
committed

Commits on Mar 13, 2020

Add decryption example
Neil Madden
committed

Commits on Mar 16, 2020

Add NaCl CryptoBox example
Neil Madden
committed

Commits on Mar 23, 2020

Add AES-SIV example
Neil Madden
committed

Commits on Apr 7, 2020

Add example of ratcheting for forward secrecy
Neil Madden
committed

Commits on May 3, 2020

Add device database
Neil Madden
committed
Updated README for chapters 12 and 13
Neil Madden
committed

Commits on May 18, 2020

Add DeviceIdentityManager and method to retrieve deviceId
Neil Madden
committed
Add example of replay protection using ETags
Neil Madden
committed
Tweaks for readability.
Neil Madden
committed

Commits on May 21, 2020

Add OAuth2 device authorization grant example
Neil Madden
committed

Commits on May 22, 2020

Add OSCORE implementation
Neil Madden
committed

Commits on Jun 4, 2020

Merge final code from chapter 13
Neil Madden
committed

Commits on Aug 5, 2020

Remove code from master branch (see per-chapter branches)
Neil Madden
committed

Commits on Nov 20, 2020

Update README for publication
Neil Madden
committed