April 2021 Summaries

The Implicit grant is a feature of the OAuth 2.0 protocol, but it has been omitted in the OAuth 2.1 specification due to its security risks and lack of secure token handling. This grant provides an access token on redirect without requiring server-side code, making it convenient for use with client-side applications such as those in the JAMstack. However, this convenience comes at a cost: the token is accessible to any JavaScript running in the browser, including third-party libraries, which poses a significant security risk. In contrast, the Authorization Code grant, which involves redirecting the user back to the application backend with an authorization code, provides a more secure way to obtain access tokens and should be used instead of the Implicit grant for single-page web applications.

AdCellerant, a growing adtech company, previously used a homegrown authentication solution that became increasingly difficult to manage as the company grew. The application had scaling issues and multiple user data models stored in a MongoDB database, impacting engineering timelines and making it hard to meet client promises. After migrating over 100,000 user attributes to FusionAuth, AdCellerant was able to seamlessly transfer their data without impact to customers and has since used FusionAuth for new projects to drive innovation and growth, including building an API for external developers. The company has praised FusionAuth's responsive support, which has been instrumental in their migration success.

Open-source authentication providers offer several benefits, including the ability for anyone to review the code, making it easier to evaluate suitability for a specific use case. They also provide source code that can be reviewed and modified by users, which is especially useful in case of issues or changes needed in the future. However, there are downsides, such as limited support options, where users may have to rely on submitting detailed issues via the project's issue tracker without guaranteed response times. Additionally, open-source providers often lack release frequency transparency, and some projects may not be actively maintained. On the other hand, many open-source projects offer paid support tiers with SLAs and guaranteed response times, which can provide peace of mind for users. The maintenance responsibility lies with the community, where customers contribute fixes and feature requests, but this also means they bear more of the burden. Open-source providers may be more secure due to multiple eyes inspecting the code, but security vulnerabilities can remain open for months if not addressed promptly. Overall, while open-source authentication providers offer a cost-effective solution, users must consider the added maintenance and security responsibility that comes with them.

FusionAuth is being used by OGGEH Cloud Computing, a backend as a service provider that helps front-end developers build awesome applications. Ahmed Abbas, CEO of OGGEH Cloud Computing, uses FusionAuth to manage and authenticate users for his platform tools, including Cloud Apps, Cloud CMS, and Cloud Stats. He prefers OpenID Connect and OAuth 2.0 for authentication implementation and has saved around 40% of expenses by switching from Gluu. FusionAuth's footprint is remarkably small and does not require great CPU or memory resources to operate. Ahmed also plans to extend the API services to allow frontend developers to inject custom themes and email templates into their applications.

As the importance of online security grows, multi-factor authentication (MFA) becomes increasingly crucial to protect accounts with valuable data. MFA requires two or more factors of proof, such as something the user knows, has, is, or where they are, to authenticate. It's a superset of two-factor authentication and can be used in various contexts beyond online account access, including banking and sensitive systems. Developers should enable and encourage users to use MFA to prevent compromised accounts from being stolen by bad actors, who may then have unauthorized access to the system and its data. Implementing MFA requires balancing user experience with account security, as requiring it for all system access can be too frictional. Situations where MFA is recommended include administrative accounts, high-value accounts, risky actions, legal or organizational policies, and when actions look suspicious. MFA requirements should be applied in a central location and made available to users who want to protect their account security.

Laravel, a popular PHP framework, is often paired with FusionAuth to handle complex user authentication needs beyond Laravel's basic model. This tutorial demonstrates how to integrate FusionAuth with a new Laravel application for tasks such as user registration, login, and profile management. The process involves setting up a local FusionAuth instance, installing relevant PHP packages, and configuring Laravel's environment files. It guides through creating views and controllers for user registration and login, leveraging FusionAuth's API to manage user data securely. Additional considerations like middleware for route protection, user session management, and logout functionality are also covered, offering a foundational approach to implementing advanced authentication workflows in Laravel applications using FusionAuth. The code examples provided are available on GitHub, and further customization options are suggested for production environments.

FusionAuth has an active online forum where users can discuss various topics related to the platform, including integration with other software packages and troubleshooting issues. The forum is accessible to anyone who wants to participate, either by signing up for a free account or viewing discussions anonymously. Recent posts highlight common challenges faced by developers, such as logging in users through the netcore API, authentication across multiple applications, and configuring SMTP credentials for email sending. These topics demonstrate the range of issues that FusionAuth users encounter, from technical integration problems to more general questions about the platform's functionality and features.

FusionAuth has announced a new technology called SimplePass that helps users remember their passwords by showing them their plain text password after only asking for an email address, and allows users to enter their password if they don't know how to copy and paste. The company's R&D team developed this feature as a solution to the frustrations of remembering complex passwords. While some security experts have criticized the technology, citing potential exploitation by hackers, FusionAuth believes it is secure and has already received positive feedback from users who find it easier to log in with their email address.