November 2022 Summaries

The AWS re:Invent conference is a major technical event in the cloud space, attracting tens of thousands of attendees in Las Vegas. The FusionAuth team will be present, aiming to exchange knowledge and ideas with developers on the AWS platform, particularly those using solutions like EKS and Fargate. They also look forward to discussing authentication methods and are available for meetings to discuss how FusionAuth can help clients migrate from Auth0 or Cognito. Additionally, the team plans to attend various sessions, including security best practices for Amazon Cognito applications, and participate in networking events such as Corey Quinn's nature walk and parties. The FusionAuth team will be visible at their booth #651 and can also be met through scheduled meetings or by sending a note via contact form or social media.

The article describes the experience of using scaffolded code generated by ASP.NET Core templates to build a simple application, including authentication and authorization features. The author is initially excited about the ease of use and speed provided by the templates, but soon realizes that they may not be suitable for production-ready applications. As the project progresses, the author encounters issues with single sign-on (SSO) and passwordless authentication, which require additional configuration and integration with external services like FusionAuth. The article concludes with a demonstration of how to implement SSO using FusionAuth, showcasing its features and benefits for enterprise applications.

FusionAuth is used instead of plain Passport for authentication in Express applications because it provides a complete system that takes care of all aspects of authentication, including social login providers. FusionAuth can be easily integrated into the application without modifying code or redeploying the app. The application's logic and public information are handled by Node.js + Express, while sensitive information is handled by FusionAuth. This setup allows developers to focus on security efforts on the FusionAuth installation. Additionally, any integrations with other providers, such as Twitter sign-in, can be done once for all applications. To set up FusionAuth, Docker and Docker Compose are used to install and configure it. The application's social login functionality is enabled through a simple setup process. A Node.js + Express app is then built on top of this, with routes for logging in, registering, and accessing a "members only" area. The app uses Passport and the FusionAuth Typescript client to authenticate users via Twitter and retrieve their profile from FusionAuth.

The OAuth 2.0 Authorization Code grant is used to authenticate users with FusionAuth and then exchange the authorization code for an access token that can be used to access resources specific to the user. The React app uses this grant to log in, log out, and display a user's data. The Express server handles the redirect back to the React app after authentication and also stores the access token in session storage.

This comprehensive guide details the implementation of the OAuth Authorization Code Grant in a React application using FusionAuth as the Identity Provider (IdP), emphasizing its security benefits for single-page applications. The process involves setting up a React app with login, logout, and user data management functionalities, integrated with a Node.js backend using Express. The guide walks through configuring FusionAuth, setting up a directory structure, and coding both client and server components to handle OAuth flows securely. It covers key topics such as server-side session management, exchanging authorization codes for access tokens, introspection for user data retrieval, and updating user registration data. The article provides a step-by-step approach to managing user authentication and data in a secure and scalable manner, while also suggesting further enhancements like user registration, customization of login forms, implementing two-factor authentication, and third-party logins.

The Early Access Program (EAP) offered by FusionAuth allows customers to test preview versions of the latest software updates before they are generally available. This program provides users with the opportunity to integrate and evaluate new features within their own environments, giving feedback to the FusionAuth team. While the early-release software is tested, it may not be as thoroughly vetted as the final public release, and it is not recommended for production use. FusionAuth users can access EAP builds through their account portal, and no license is required to access premium features during the EAP period, although documentation may be limited. Users can contribute feedback and report issues via community forums, Slack, or GitHub, and EAP releases are announced through these platforms as well.

Passkeys, as defined by WebAuthn, are an authentication standard that uses asymmetric cryptographic keys to authenticate users instead of passwords. This method is more secure than traditional password-based login systems, as it eliminates the risk of password compromise and phishing attacks. Passkeys require users to authenticate using their devices without having to remember or store passwords, making them easier to use while providing enhanced security benefits. The process involves registering a user's device with a server, creating a unique challenge key for authentication, and then verifying the user's identity through a cryptographic signature. This standard is part of the FIDO2 specification and has become widely adopted in modern web applications, offering a smooth authentication experience for users while preventing cyberattacks.