June 2019 Summaries

Ory Hydra 1.0 has been released as an open-source, OpenID Connect Certified OAuth 2.0 and OpenID Connect server capable of running on diverse platforms like Kubernetes, virtual machines, bare-metal servers, Windows, and IoT devices. Available through various package managers, this release marks the culmination of a year-long development effort focused on creating a robust and easily integrable server, thanks to feedback from companies such as Segment, Raspberry Pi, Arduino, and Hootsuite. The server is now certified as an OpenID Provider by the OpenID Foundation, covering several certified profiles. Acknowledgments are extended to sponsors such as Raspberry Pi and the German Stock Exchange for their financial support. Future plans include applying to become a Cloud Native Computing Foundation incubating project, enhancing Kubernetes interoperability, and implementing new specifications like the Financial-grade API proposals and OAuth 2.0 Mutual TLS Client Authentication Draft.

The article provides a comprehensive overview of best practices for implementing OAuth2 and OpenID Connect flows specifically tailored for mobile apps and single-page applications (SPAs). It emphasizes the importance of choosing the correct OAuth2 flow, cautioning against using outdated or insecure flows like the OAuth2 Resource Owner Password Credentials Flow due to its susceptibility to phishing attacks. Instead, it advocates for the OAuth2 Authorize Code Flow with Proof Key for Code Exchange (PKCE) for public clients, which enhances security by protecting against interception of authorization codes. The document also highlights the limitations of the OAuth2 Implicit Flow, noting its lack of refresh token capability and recommending the use of external user agents over embedded ones due to security concerns. Additionally, the article encourages developers to rely on established open-source technologies, such as Ory Hydra and AppAuth, to implement these protocols effectively and securely, avoiding the risks associated with developing custom solutions.