Open Identity - getting to know your users
•
2 likes•1,306 views
This talk is about Open Identity and using it to create an amazing user experience. Also it handles topics like secure API communication to protect your service and users from different kind of attacks like CSRF. The difference between Authentication and Authorization are being highlighted and OAuth, OpenID Connect etc. get explained.
Recommended
More Related Content
Viewers also liked
Viewers also liked (17)
Similar to Open Identity - getting to know your users
Similar to Open Identity - getting to know your users (20)
More from PayPal
More from PayPal (20)
Recently uploaded
Recently uploaded (20)
Open Identity - getting to know your users
- 1. OPEN IDENTITY … ge$ng to know your users TIM MESSERSCHMIDT @SeraAndroid & cool stuff you can do with it
- 3. What does PayPal do at JSConf.eu?
- 4. Rebuild Developer Experience: developer.paypal.com
- 6. Do we always use the same idenHty?
- 7. Should we always use the same idenHty?
- 11. OAuth 1.0
- 12. Request Request Token Grant Request Token Direct User to Service Obtain AuthorizaEon Direct to Consumer Request Access Token Grant Access Token Access Resources Consumer Service Provider
- 13. OAuth 1.0a
- 14. OAuth 2.0
- 15. Direct User to Service Obtain AuthorizaEon Request Access Token Greant Access Token Direct to Consumer Access Resources / Profile Consumer Service Provider
- 16. OAuth 2.0 and the Road to Hell hPp://hueniverse.com/2012/07/oauth-‐2-‐0-‐and-‐the-‐road-‐to-‐hell/
- 18. IdenEficaEon
- 19. Name Email Date of Birth Locale Time Zone Address Gender Language Phone Number CreaHon Date
- 20. OpenID
- 22. How to combine both?
- 23. OpenID with OAuth Hybrid Extension
- 24. OpenID Connect
- 25. IdenHty Providers Social vs. Concrete
- 27. Yeah, nice.. but why? People forget passwords… 45% admit to leaving a website instead of re-‐ se$ng their password or answering security quesEons * * Blue Inc. 2011
- 28. Also they hate to register Out of 657 surveyed users 66% think that social sign-‐in is a desirable alternaEve. * * Blue Inc. 2011
- 29. Where else should we use authenHcaHon?
- 30. JSONP Cross-‐domain Request (XDR)
- 31. CORS Cross-‐Origin Request Sharing
- 32. API communicaHon curl -‐v hPps://api.paypal.com/v1/payments/payment -‐H 'Content-‐Type:applicaEon/json' -‐H 'AuthorizaHon:Bearer MyAwesomeToken' -‐d '{ "intent":"sale", "payer":{ "payment_method":"paypal" }, "transacEons":[{ "amount":{ "total":"7.47", "currency":"USD" }, }] }‘
- 33. XMLHpRequest Request: POST /cors HTTP/1.1 Origin: hPp://api.bob.com Host: api.bob.com Response: Access-‐Control-‐Allow-‐Origin: hPp://api.bob.com Access-‐Control-‐Allow-‐CredenEals: true Access-‐Control-‐Expose-‐Headers: FooBar Content-‐Type: text/html; charset=un-‐8 source: hPp://www.html5rocks.com/en/tutorials/cors/
- 34. Wrap up Difference between authen.ca.on and authoriza.on IdenHty does maer Token based authenHcaHon for API communicaHon
- 35. QuesHons? tmesserschmidt@paypal.com @SeraAndroid slideshare.com/paypal