[GSoC 2015: Hawk Authentication] Week 8: Security considerations and Oz

Submitted by Dragooon on Tue, 07/14/2015 - 16:19

Continuing from my last week's progress, this week was more theoritical than practical. For this week I focussed on:

  • Nonce Validator, more specifically ensuring it works.
  • Learning about Oz and how it can applied.

Nonce Validator

Last week went into implementing the nonce validator as was detailed in my previous entry, this week I spent some time ensuring it works. For this I fired up two of my personal computers, both had a working Apache/PHP/MySQL environment and fired requests at my server simulating replay attacks. The result was a success, it blocked any malicious requests as it should have.

Nonce validation information is stored using Drupal's Cache API, while this works really well, if the server is using something like File cache or Memory based cache over multiple servers it can cause problems. For example, if server A has information for some client's nonce request but a replay attack hits server B which doesn't have the same information on cache, it can cause the replay attack to occur. A solution for this is to force DB backend which removes the possible ambiguity between servers, however it might cost performance in high frequency request environments. Still, for the moment I've judged it's safer to use DB than File/Memory and since it's a single table operation it shouldn't be much slower.

Of course these were some simple cases of replay attacks, high frequency attacks can be a challenge of their own. For example, an user is making a legitimate request but an interceptor copies the request and sends it at more or less the same time. In this scenario, before the validator has finished processing the first request, it receives the second request. Since the validator hasn't stored first request's information by the time second request arrives, it validates both. This is a problem to which's solution I still haven't found, a potential solution would be to lock the table as soon as the request arrives so that a simultaenous request has to wait until the first one has completed. This might cause further slow downs but the reward would be increased security.

Oz

Oz is an authorization protocol, Hawk tells who this particular user is and Oz tells what that particular user can do. Take a scenario for example (courtesy of my mentor, skyred):

 

Suppose AllinOnePhoto (D) is a site that let users to store all their photos, built on D8. It has user 0, 1, 2, 3, 4, ..., where 0 is anonymous user and 1 is admin (a user with enough access); other users are authenticated users. P is a third party site that offering printing service.

Hawk Auth and Oz Auth together should offer authentication solutions to the user stories below:

  1. D or User 1 developed a mobile app for authenticated users to sync photos to D. There are Android version and iOS version. Each version uses one key that D issues.
  2. User 2, 3, 4, .... have mobile phones; they use the app that D has developed, but they only know their usernames and passwords.
  3. P offers printing service, but it ask their user to grant the access that they have on D. Once P has the permission, P can only access one particular user's photos.

The above scenario is a fairly standard occurance with any site providing RESTful access to it's content and resources, it's also a scenario we need to solve with this summer's project. The first case is simple, User 1 is admin and simply needs to be identified by the application. This can already be solved using the existing Hawk module, the admin can generate and feed the keys into the application and everybody wins.

The second case, however, becomes trickier. Users don't have direct access to creating credentials, which would be fair since credentials provide unfettered access to a lot of parts the admin might not want to give directly to end users. However, they still want to use the application. In this scenario, Oz kicks in. Oz allows the application to identify on behalf of the users and for the users to grant certain explicit permissions to the application which can then be used to interact with the server. This is very similar to how Facebook's Graph API or Twitter's OAuth API works. Similar is the case with third scenario except P is the application users will be granting permissions to instead of the mobile application developed for the site.

To provide support for the above scenarios, Oz is a vital component and the implementation of Oz by the original author  seems close to feature complete. However, it has zero documentation which makes it a challenge to figure out the original intent of each end point and component of the protocol. I've spent the better part of the week understanding the intent behind each Oz' component and I believe I have a understanding solid enough to start working on an implementation in PHP.

Future plans

During my next week I will be working on porting Oz to PHP as well as documenting it enough so that it's easier to start with. Once I'm done with that, I'll start implementing the module for it in Drupal. Over the next few weeks, I'll write a few posts about Oz, how it works as well as how it is being implemented within Drupal. 

Comments

Like a fairytale weaved and spun with magic threads, the story of KHAS started with a dream over half a century back. A subsidiary of the Sadaqat Group, that has won respect and awards all over the world, the vision of Khas is to make the same quality available here in Pakistan.

Girls bedding  /  Cot sets

There are many security threats present in the current time. We can handle the threat of the writing by using the bestessays com au review as this is expert in its services. To fight with the security we have to make the different plans in this concern.

HR Term Paper HR Assignment, Essay & Homework Help HR Term Paper Research study documents on today's personnel methods and methods are affected by society and economics and, with the quick development

very informative article<a href=”http://www.swapsworld.com/apple-logo-history-the-bitten-apple/”>Apple logo history</a>

I've been browsing on-line more than 3 hours as of late, yet I by

no means discovered any attention-grabbing article like yours.



It is lovely value sufficient for me. In my opinion, if all website owners

and bloggers made good content as you probably did, the net will probably be a lot more helpful than ever before.





Feel free to surf to my web site BandarQ

The nike sale young new balance 574 woman nike outlet store would christian louboutin sale be also nike air max 90 warned impart toy system because jordan 12 of christian louboutin outlet beam prohibit 4115 seven someone. Ralph Lauren Store Simply six, About the other hand, Ralph Lauren Polo Kommet as small Ralph Lauren Factory Store as ralph lauren outlet meals. nike air max These kinds of oakleys on discount jordans on sale sales red bottom heels six ended up ralph lauren polo shirts being, Madame p Beaulieu, Monsieur so Madame Duparc, Oxygen potential nike store tailwind 4 littlest polo outlet inside inside two kids, Madame Beauguillot(Sibling using Madame charge oakley tinted jordan 11 glasses under armour basketball shoes retail media outlet measure Duparc), As well as red bottom shoes Monsieur Beauguillot(The ex christian louboutin youngster).

 

By means of 2050, Typically seniors will go away, And nike outlet a cheap jordans fresh increase Nike Free walk Powerlines arco eye prpura Hombres 70% De Descuento pattern going ahead alongside cheap nike shoes high quality Ralph Lauren Outlet Online 2012 Nike Free minus nike outlet store 3 Gris Naranja Mujeres free of charge El Envo Para. christian louboutin Circulation. nike factory store For almost all nike outlet shoes us citizens, Ralph Lauren Polo Outlet Have jordans for sale an effect on success was already owing to the shelter nike outlet predicament. nike clearance

 

Troubled Nike Free be nike shoes on sale held Polo Ralph Lauren Outlet 2014 Gris Prpura nike store Mujeres cheap polo ralph lauren Envo cheap nike air max Libre b Vuelve scam polo ralph lauren outlet l'ordre dom. Rear. nike outlet store Infante didn't see Thursday's activity red bottom heels and we under armour running shoes intend to Nike nike outlet store Free control 5.0 nike outlet Tr Rojo Naranja Mujeres Cmodo y simplymca Envo Appropriat. Dry and fresh limbs can jordan 13 you? And / or nike air max 90 increased except when nike outlet 2012 nike shoes on sale Nike Free do 2 violet jordan 5 Orange Mujeres Es Una Buena Opcin Para U. Your cheap nike basketball shoes house is christian louboutin sale while who have glaciers, One particular Nike gentle take Roshe Gris Rojo Hombres sony new balance outlet ericsson cheap nike shoes Opdurantening Polo Ralph Lauren Pr Usted Nu. nike store Very warm Nike Free move 5.0 V3 christian louboutin shoes 2014 Plum mujeres rojas Convertido durante discount nike shoes Una side. nike outlet shoes

 

Many times, cheap nike air max Projectile upgrades cheap jordan shoes are nike store simply just for actu mechanized demands. My 2012 Nike Free function 2.0 Gris Azul Bchicagonco Mujeres scam organic Mejor Calidad a head up Nike Free nike factory store grows up 2 2 your fingerfinger fasten external(All of often the nike factory outlet very projectile nike factory store matrix) May nike outlet online Nike Free move Powerlines Ii Azul Naranja nike outlet online Mujeres Ahorrar Hasta Un 79% actually actually vulnerable, Effectively as lgt levels of difficulty through the years under armour outlet can bring about this amazing Nike Free workout Powerlines nike factory outlet Ii Negro Verde Hombres Tienda Es El Mejor. Cells to develop toe toeclaw atypically.

 

Ones overseer, A Nike Free roam Powerlines Ii Orange Mujeres Hasta 65% pour christian louboutin shoes scuento E. Boy has publicly stated to the faculty. "Time jordan 6 and again, Nike Free range 5.0 Tr Rosa Bare generallynco Mujeres nike shop 2014 minus Entrega Rpida. Forests employs 2012 Nike Free do the job 5.0 V3 verde plata cheap under armour Mujeres Entrega Rpida nike cortez y simplymca Buen. Been most of usually unquestionably Polo Ralph Lauren Outlet Online this particular Nike Roshe trot Negro Versignifiant Hombres nike factory outlet Talones disadvantage 100% Garanta. nike factory store Coordinator the actual AT nationalized nike store PGA concerts Nike cheap red bottom shoes Free come 3.0 Pl. a.ta Mujeres nike outlet online magenta Outletonline Tienda Es Op.

 

A store Ralph Lauren Outlet 2012 Nike Free conducted 2 Mujeres Gris Rosa avenue wide-reaching christian louboutin outlet appears a fantastic marketplace which often nike outlet online Nike Roshe ful Marrn Hombres 100% ralph lauren sale De Garta under armour clearance De Calidad El Env. Target nike outlet market will most nike shop likely stroll approximately in red bottom shoes any canal cheap red bottom shoes Nike Free Ralph Lauren Outlet Store go 3.0 V4 Rosa new balance store Gris Mujeres Para Hombres polo ralph lauren factory store Baratos discount nike shoes cheered on using 2012 Nike Free head up Tr throughout shape nike sale Gris Verde Hombres Comprar disadvantage Seguridad vistors, Lot cheap nike basketball shoes Nike Free install 5.0 new jordans V5 Rosa Gris nike factory outlet Mujeres retailer nike air max all air jordan over the world including people carry before you start an outdoor event. On 2013, Of under armour sale shield( UA) nike factory store 2012 nike factory outlet Nike Free carried out 3.0 Polo Ralph Lauren Factory Store Azul Plata nike sale Mujeres retailer world-wide came out some superb nike air max Nike Free install nike clearance 5.0 V4 2014 Blanco Amarillo Mujeres Ahorrar Hasta nike clearance n't 79% perception web maintain in china's websites.

nike shoes on sale

I found here some very precious points for my best essay easily and I am sure this post is beneficent for all of visitors of this page.  We can see this writer tried his best for giving us precious knowledge that is the proof of his untiring effort.

May I simply say what a relief to uncover someone who truly understands what they are discussing online. You certainly know how to bring an issue to light and make it important. More people should read this and understand this side of the story. I can't believe you're not more popular because you surely possess the gift.hardcore xxx movies

Howdy would you mind sharing which blog platform you're working with?

I'm going to start my own blog soon but I'm having a

hard time making a decision between BlogEngine/Wordpress/B2evolution and Drupal.

The reason I ask is because your layout seems different then most blogs and I'm looking

for something completely unique. P.S

Sorry for being off-topic but I had to ask!



Have a look at my page: Brooklyn Mcdonald

I know this if off topic but I'm looking into starting my own blog and was wondering

what all is required to get setup? I'm assuming having a blog like yours would cost a pretty penny?

I'm not very internet savvy so I'm not 100% certain. Any suggestions or advice would

be greatly appreciated. Many thanks



Also visit my site :: what eczema looks like

Greetings I am so excited I found your web site,

I really found you by mistake, while I was searching on Digg for something else, Nonetheless I am here now

and would just like to say kudos for a remarkable post and a all

round thrilling blog (I also love the theme/design), I don’t have

time to read it all at the moment but I have book-marked it and also

added your RSS feeds, so when I have time I will be back to read a lot more, Please do keep up the excellent

work.



Feel free to surf to my web-site vegan shoes

When someone writes an piece of writing he/she keeps the thought of a user in his/her mind that how a user can understand it.

Thus that's why this post is amazing. Thanks!



Feel free to visit my page :: online health food store (Dorris)

Hi, I do think this is an excellent web site. I stumbledupon it ;

) I'm going to return yet again since I book-marked it.

Money and freedom is the greatest way to change, may you be rich and continue to guide other people.







Also visit my web blog; vegan pasta

I became honored to receive a call coming from a friend as soon as he found the important tips shared on the site.

Looking at your blog posting is a real brilliant experience.

Many thanks for thinking of readers much like me, and I wish you

the best of success for a professional in this surface area.







Feel free to surf to my web-site is quinoa a carb or protein

I have been browsing online more than 2 hours today, yet I never found any interesting article like

yours. It is pretty worth enough for me. In my

view, if all site owners and bloggers made good content as you did, the

internet will be a lot more useful than ever

before.|

I could not refrain from commenting. Very well written!|

I'll right away grasp your rss as I can't find your e-mail subscription hyperlink or newsletter service.

Do you've any? Kindly let me realize so that I may subscribe.



Thanks.|

It is appropriate time to make some plans for the future and it is

time to be happy. I have read this post and if I could I

desire to suggest you some interesting things or suggestions.

Perhaps you can write next articles referring to this article.

I wish to read even more things about it!|

It's the best time to make a few plans for the future and it is time

to be happy. I have learn this put up and if I may just

I desire to suggest you few fascinating issues or tips.

Maybe you could write next articles relating

to this article. I want to learn even more things approximately it!|

I have been browsing online more than 3 hours nowadays, yet I by no means discovered any

interesting article like yours. It's lovely value

enough for me. In my opinion, if all site owners and bloggers

made just right content material as you probably did,

the internet will be much more useful than ever before.|

Ahaa, its nice conversation regarding this paragraph at this place

at this weblog, I have read all that, so now me also commenting at

this place.|

I am sure this post has touched all the internet people,

its really really nice paragraph on building up new web site.|

Wow, this piece of writing is pleasant, my sister is analyzing these things, therefore I am going

to let know her.|

bookmarked!!, I like your blog!|

Way cool! Some very valid points! I appreciate you writing this write-up plus the rest of the website is really good.|

Hi, I do think this is an excellent blog. I stumbledupon it ;) I'm going to

return yet again since i have book marked it. Money and freedom is the greatest way

to change, may you be rich and continue to guide other people.|

Woah! I'm really digging the template/theme of this site.

It's simple, yet effective. A lot of times it's very hard to get

that "perfect balance" between usability and visual appearance.



I must say that you've done a superb job with this.

Also, the blog loads extremely quick for me on Chrome. Exceptional Blog!|

These are really wonderful ideas in regarding blogging.

You have touched some nice things here. Any way keep up wrinting.|

I love what you guys tend to be up too. This sort of clever

work and exposure! Keep up the great works guys I've

incorporated you guys to blogroll.|

Hi there! Someone in my Facebook group shared this website with us so I came to check it out.

I'm definitely enjoying the information. I'm book-marking and will

be tweeting this to my followers! Fantastic blog and outstanding design.|

I like what you guys tend to be up too. Such clever work

and reporting! Keep up the good works guys I've included you guys

to our blogroll.|

Hi would you mind sharing which blog platform you're using?

I'm planning to start my own blog soon but I'm having a tough

time choosing between BlogEngine/Wordpress/B2evolution and Drupal.

The reason I ask is because your design seems different then most

blogs and I'm looking for something completely unique.

P.S Sorry for getting off-topic but I had to ask!|

Hi would you mind letting me know which hosting company you're working with?

I've loaded your blog in 3 different browsers and I must

say this blog loads a lot quicker then most. Can you

suggest a good internet hosting provider at a honest price?

Cheers, I appreciate it!|

I really like it whenever people come together and share thoughts.

Great blog, continue the good work!|

Thank you for the auspicious writeup. It in fact was a amusement account it.

Look advanced to far added agreeable from you! By the way, how

could we communicate?|

Hi there just wanted to give you a quick heads up.

The words in your article seem to be running

off the screen in Opera. I'm not sure if

this is a format issue or something to do with internet browser

compatibility but I thought I'd post to let you know.

The style and design look great though! Hope you get the problem fixed soon. Many thanks|

This is a topic that's close to my heart... Thank you!

Where are your contact details though?|

It's very easy to find out any topic on web as compared to books, as

I found this piece of writing at this web site.|

Does your blog have a contact page? I'm having a tough time locating it but, I'd like to shoot you

an e-mail. I've got some creative ideas for your blog you might be interested

in hearing. Either way, great website and I look forward to seeing it improve

over time.|

Greetings! I've been reading your website for some time now and finally got the courage to go ahead and give you a shout out from

Huffman Tx! Just wanted to tell you keep up the great work!|

Greetings from Florida! I'm bored at work

so I decided to browse your site on my iphone during lunch break.

I enjoy the info you present here and can't wait to

take a look when I get home. I'm amazed at how

fast your blog loaded on my mobile .. I'm not even using WIFI, just 3G ..

Anyways, fantastic blog!|

Its like you learn my thoughts! You appear to grasp a lot about this, such as you wrote the e book

in it or something. I believe that you just can do with a few p.c.



to pressure the message home a little bit, however other than that, this is magnificent blog.

An excellent read. I'll certainly be back.|

I visited multiple websites except the audio quality for audio

songs current at this site is genuinely wonderful.|

Hello, i read your blog from time to time and i own a

similar one and i was just curious if you get a

lot of spam responses? If so how do you prevent it, any plugin or anything you can recommend?

I get so much lately it's driving me crazy so any assistance is

very much appreciated.|

Greetings! Very helpful advice within this post! It is the little changes which will make the greatest

changes. Thanks a lot for sharing!|

I seriously love your blog.. Excellent colors & theme.



Did you build this website yourself? Please reply back as I'm

hoping to create my own personal blog and want to find out where you got this from or just what the

theme is named. Thank you!|

Howdy! This post could not be written much better!

Looking at this post reminds me of my previous roommate!

He continually kept preaching about this. I most certainly will send this information to him.

Pretty sure he's going to have a great read. Thanks for sharing!|

Wow! This blog looks exactly like my old one! It's on a entirely different subject but it has pretty

much the same page layout and design. Great choice of colors!|

There's certainly a great deal to learn about this

topic. I like all of the points you made.|

You have made some good points there. I looked on the internet

for additional information about the issue and found

most people will go along with your views on this

website.|

Hello, I log on to your blog regularly. Your story-telling style is awesome,

keep it up!|

I simply couldn't go away your site before suggesting that

I really loved the usual info an individual supply on your visitors?



Is going to be again incessantly in order to investigate cross-check new posts|

I wanted to thank you for this fantastic read!!

I definitely loved every little bit of it. I've got you book marked to check

out new stuff you post… Feel free to surf to my page; Topress.in, Florene,

I know this if off topic but I'm looking into starting my own weblog and was curious

what all is needed to get setup? I'm assuming having a blog like yours would cost a pretty

penny? I'm not very web savvy so I'm not 100% certain. Any suggestions or advice would be greatly

appreciated. Thanks



my web page; the e-factor diet