API authentication: sessions, tokens, OAuth 2.0
You set up and compare session cookies, API keys, JWTs and OAuth 2.0 and OpenID Connect flows, and learn hands-on how to use each correctly and safely.
Level 401 · 16 lessons · 15 practice labs
Lessons
Foundations
- Authentication versus authorisation
- Server sessions and cookies
- Designing and storing API keys
- Storing passwords properly: argon2 and bcrypt
- Short task: session-based login and logout
Tokens
- JWT structure: header, payload, signature
- Validating a JWT correctly
- Token lifetimes and refresh tokens
- Where to keep tokens in the browser
- Short task: an endpoint protected by JWT
OAuth 2.0 and OpenID Connect
- OAuth 2.0 roles and scopes
- The authorisation code flow and PKCE
- The client credentials flow: service to service
- OpenID Connect and the ID token
- Multi-factor authentication and passkeys
- Capstone: two apps with single sign-on
Practice labs
- Really end the session on logout: Fix an app that only deletes the cookie on logout so it also invalidates the session on the server.
- Rotate the session ID after login: Demonstrate session fixation in an app that keeps the same session ID across login and close it by rotating the ID.
- Harden a dashboard's session cookie: Harden an admin dashboard's session cookie with Secure, HttpOnly, SameSite and a short lifetime and test each setting's effect.
- Tune the password hash cost: Measure bcrypt cost values on the lab server and pick the one that takes about 250 ms per login.
- Store API keys as hashes: Move API keys stored in clear to a scheme of prefix plus hash where each key can be revoked on its own.
- Upgrade legacy hashes at login: Build a migration that upgrades legacy MD5-hashed accounts to bcrypt as users log in.
- Decode a JWT: Decode a token's header and payload to find whom it belongs to, when it expires and which algorithm it uses.
- Fix validation that accepts unsigned tokens: Fix validation code that accepts alg none tokens by pinning the algorithm and adding aud and exp checks.
- Rotate refresh tokens: Write a flow that invalidates every used refresh token and revokes the whole chain when reuse is detected.
- Cut requested scopes to the minimum: Review the scopes a calendar-reading app requests and cut them down to what it really needs.
- Run a code flow with PKCE step by step: Run a single-page app login with PKCE step by step against the lab's authorisation server.
- Get a service token for a nightly job: Make a nightly invoicing job get a token with client credentials, cache it and renew it before it expires.
- Verify an ID token's claims: Check an OpenID Connect ID token's iss, aud, nonce and expiry claims one by one.
- Add a TOTP second step to login: Add a time-based one-time code step to password login and allow a small tolerance for clock drift.
- Set up single logout across two apps: Make logging out of one of two apps tied to a shared identity provider end the session in the other too.
About this course
You set up and compare session cookies, API keys, JWTs and OAuth 2.0 and OpenID Connect flows, and learn hands-on how to use each correctly and safely.
What you will learn
- Foundations
- Tokens
- OAuth 2.0 and OpenID Connect
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.