Software Security

Secure coding standards

OWASP – Open Web Application Security Project
- OWASP provides a secure coding practices checklist that includes 14 areas to consider in your software development life cycle. Of those secure coding practices,
- https://owasp.org/www-project-top-ten/
- https://www.securecoding.com/blog/owasp-secure-coding-checklist/
- https://www.imperva.com/learn/application-security/owasp-top-10/#:~:text=The%20Open%20Web%20Application%20Security,perform%20security%20assessments%20and%20research.
CWE – Common Weakness Enumeration
SEI CERT –

Tool Used – Fortify (HP- security vulnerability code analyser )

OAuth is an open protocol that enables secure authorization from web, mobile, or desktop applications. It’s used to grant access to services such as APIs and websites without needing to exchange passwords.

🔐 𝗪𝗵𝗮𝘁 𝗶𝘀 𝗢𝗔𝘂𝘁𝗵?
OAuth stands for Open Authorization. It’s an open protocol that enables secure authorization from web, mobile, or desktop applications. It allows users to share their private resources stored on one site with another site without having to give away their credentials such as username and password.

✍ 𝘍𝘰𝘳 𝘦𝘹𝘢𝘮𝘱𝘭𝘦, 𝘪𝘧 𝘺𝘰𝘶 𝘩𝘢𝘷𝘦 𝘢 𝘎𝘰𝘰𝘨𝘭𝘦 𝘢𝘤𝘤𝘰𝘶𝘯𝘵 𝘢𝘯𝘥 𝘸𝘢𝘯𝘵 𝘵𝘰 𝘢𝘤𝘤𝘦𝘴𝘴 𝘠𝘰𝘶𝘛𝘶𝘣𝘦 𝘰𝘳 𝘎𝘮𝘢𝘪𝘭 𝘴𝘦𝘳𝘷𝘪𝘤𝘦𝘴, 𝘺𝘰𝘶 𝘤𝘢𝘯 𝘶𝘴𝘦 𝘖𝘈𝘶𝘵𝘩 𝘪𝘯𝘴𝘵𝘦𝘢𝘥 𝘰𝘧 𝘱𝘳𝘰𝘷𝘪𝘥𝘪𝘯𝘨 𝘺𝘰𝘶𝘳 𝘎𝘰𝘰𝘨𝘭𝘦 𝘢𝘤𝘤𝘰𝘶𝘯𝘵 𝘤𝘳𝘦𝘥𝘦𝘯𝘵𝘪𝘢𝘭𝘴.

🔐 𝗛𝗼𝘄 𝗗𝗼𝗲𝘀 𝗢𝗔𝘂𝘁𝗵 𝗪𝗼𝗿𝗸?
OAuth works by authenticating the user’s identity without them having to provide their login details directly. The process involves the user being redirected to the service provider where they are asked to approve the application that requests access. Once approved, the service provider sends back an access token which can then be used by the application to make authorized requests on behalf of the user.

Security Intro

Objective –

meaning /structure of security mechanism
where used? use case
Implementation

Index

Introduction
Basic username-pwd
JWT
Oauth ( micro-services)
Digital Signature (NPCI)

Introduction

Session, Cookie, JWT, Token, SSO, and OAuth 2.0 – here’s what you need to know

These terms are essential for identifying, authenticating, and authorizing users online. Let’s dive in👇

𝗪𝗪𝗪-𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗲
🔹 Oldest & most basic method
🔹 Browser asks for username & password
🔹 Lacks control over login life cycle
🔹 Rarely used today

𝗦𝗲𝘀𝘀𝗶𝗼𝗻-𝗖𝗼𝗼𝗸𝗶𝗲
🔹 Server maintains session storage
🔹 Browser keeps session ID
🔹 Works mainly with browsers, not mobile app friendly

𝗧𝗼𝗸𝗲𝗻
🔹 Compatible with mobile apps
🔹 Client sends token to server for validation

𝗝𝗪𝗧 (𝗝𝗦𝗢𝗡 𝗪𝗲𝗯 𝗧𝗼𝗸𝗲𝗻)
🔹 Standard representation of tokens
🔹 Digitally signed & verifiable
🔹 No need to save session info server-side

𝗦𝗦𝗢 (𝗦𝗶𝗻𝗴𝗹𝗲 𝗦𝗶𝗴𝗻-𝗢𝗻) & 𝗢𝗔𝘂𝘁𝗵 𝟮.𝟬
🔹 SSO: Log in once, access multiple sites
🔹 Uses CAS (central authentication service)
🔹 OAuth 2.0: Authorize one site to access info on another

JWT

Index

What is JWT?
When to use and why?
Application

𝗪𝗵𝗮𝘁 𝗶𝘀 𝗝𝗪𝗧?

Securing the API is one of the most important things to do to prevent its abuse. It is done via the authentication and authorisation process and the most used is the 𝗝𝗪𝗧 token-based mechanism.

JSON Web Token is a standard that is used to share information between client and server as a JSON object.

Official Introduction- https://jwt.io/introduction

It is represented as a string that consists of 3 parts: (Memory map JWT[3words 3 parts – H.P.S. – Header Payload Signature])

𝗛𝗲𝗮𝗱𝗲𝗿: It consists of token type(typ) and signing algorithm that is used(alg). The type will always be JWT, and the signing algorithm can be HMAC SHA256 or RSA.
𝗣𝗮𝘆𝗹𝗼𝗮𝗱: This part contains related data(mostly for users) known as claims. There are three types of claims:
- 𝗥𝗲𝗴𝗶𝘀𝘁𝗲𝗿𝗲𝗱 – claims that are recommended to use for interoperability like issuer(iss), subject(sub), expiration time(exp), etc.
- 𝗣𝘂𝗯𝗹𝗶𝗰 – contains generic information like email, name, or role. It’s recommended to use collision-resistant names to avoid collision with private claims.
- 𝗣𝗿𝗶𝘃𝗮𝘁𝗲 – custom claims
𝗦𝗶𝗴𝗻𝗮𝘁𝘂𝗿𝗲: It ensures that the token hasn’t been altered. JWT is signed with the algorithm from a header, and the signature consists of an encoded header and payload, and secret.

A string is always encoded like a Base64 string where every part is separated by dots and like that is easily passed in HTTP environments through HTTP headers.

Note:

the claim names are only three characters long as JWT is meant to be compact.
though signed tokens are protected against tampering, is readable by anyone(base-64 decry-pt). Do not put secret information in the payload or header elements of a JWT unless it is encrypted. (Note – the token is encoded not encrypted)

Relevant articles on encryption vs encoding

Where JWT Is used? (refer official link above for description)