January 2021 Summaries

Modern web applications, particularly single-page applications, often utilize APIs for data transmission, eschewing traditional web forms for authentication in favor of API routes that process JSON payloads containing user credentials. After successful authentication, servers return an authorization token, which is then used for subsequent requests to protected routes. StackHawk's HawkScan supports this authentication method by enabling users to define username and password fields, extract tokens from JSON responses, and use these tokens in further API calls. The text provides a detailed walkthrough of setting up HawkScan for testing API authentication, including the necessary prerequisites such as familiarity with tools like Git, Curl, and Docker, and the installation steps for running the hawkling-api application. Users are guided through configuring the stackhawk.yml file to simulate authenticated scanning, defining logged-in and logged-out indicators, and setting up token extraction and authorization processes. The document emphasizes the importance of integrating security testing into development processes to identify vulnerabilities before they reach production, and offers guidance on moving HawkScan from local environments to build pipelines using tools like Travis CI and Docker-Compose.

In an effort to integrate specific alerting capabilities into their build process using a third-party product, a team needed to execute their Kotlin code as a standalone application. The third-party system only supported execution through a single jar file, which necessitated the creation of a "fat" jar that included all third-party dependencies. Using Gradle as their build tool, the team employed the application plugin to define the main class in Kotlin, set up the `build.gradle.kts` file to accommodate the main class, and configured the jar task to include all necessary dependencies by modifying the manifest's `Main-Class` attribute. This setup allowed them to build the jar file and run it as expected in the third-party system, facilitating not only this integration but also supporting other use cases such as one-off and scheduled jobs.

This detailed guide explains how to configure HawkScan to work with access tokens from Auth0 for secure API testing in Single-Page Web Applications. It outlines the process of cloning an Auth0 sample React application, generating a JWT token, and integrating it into HawkScan's runtime configuration. Key prerequisites include accounts with StackHawk, Auth0, and GitHub, as well as software like Docker, npm, and jq. The guide walks through setting up Auth0 applications and APIs, obtaining and validating access tokens, and modifying configuration files to support external token authorization. It emphasizes the importance of understanding authentication flows and provides step-by-step instructions to request tokens, call APIs with tokens, and configure HawkScan via Docker using a script. The guide concludes by highlighting StackHawk's approach to simplifying security testing through reproducible configurations and encouraging users to sign up for an account to enhance their security practices.