Security

Implement an OAuth 2.0 Server (Part 05)

Wednesday, June 6, 2018

Welcome to the fifth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Adding Models We can’t do very much without creating some models of our domain objects, both in memory and in the database. At this point in time we only have two main things to worry about, and that’s what our OAuth Client Application looks like, and how are they owned by Users? …

Implement an OAuth 2.0 Server (Part 04)

Wednesday, June 6, 2018

Welcome to the fourth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Public API Barebones Setup We’re going to have a very small public API that will entertain a few GET and PUT methods. At first, these methods will be entirely unauthenticated, but as time goes on we’ll eventually put some of them behind OAuth authentication, then add Scope checks, and finally Rate Limiting. But for now, we’re just going to implement some stub methods. …

Implement an OAuth 2.0 Server (Part 03)

Wednesday, June 6, 2018

Welcome to the third part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. SQLite and Initial Migration If you tried to start the website we just initialized, you’d find that you won’t be able to login or register, receiving error messages instead of a welcome screen. Although an initial migration has been provided for us, it hasn’t been applied, and no database exists yet. And if we’re not careful and rush to apply the migration ourselves we’ll end up with a SQL Server dump file. We’re going to switch our database provider to SQLite, and we’re going to change our default connection string to reflect this. …

Implement an OAuth 2.0 Server (Part 02)

Wednesday, June 6, 2018

Welcome to the second part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Project Setup and Dependency Downloads Create a new ASP.NET Core Web Application named OAuthTutorial. You can use your own name, but make sure to get your namespaces correct if you do. It’s helpful if you have Create directory for solution and Create new Git repository checked. Select Web Application (Model-View-Controller) …

Implement an OAuth 2.0 Server (Part 01)

Wednesday, June 6, 2018

Welcome to the first part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. The creator of the library, Kevin Chalet, has an excellent series of blog posts, that you are encouraged to read for more information, with less of a hands-on approach. The final product is available here on GitHub, and at the end of each step the project as completed up to that point will be available on its respective branch. …

Lyricall Security

Tuesday, May 22, 2018

This is the Security Model for lyricall.net as of May 22nd, 2018. Security Model tl;dr: The servers are secure The services are secure Connections are secure Data is validated Ownership is checked todo: Encrypt db at Rest Automatically rotate dbhost/dbname/dbuer/dbpassword values Spin out authentication server from api server Spin out client server from api server Server Provisioning All machines are provisioned in the standard manner: SSH key only access, no password authentication allowed Standard SSH port is changed to be non-standard below 1024 to stop automated attacks on port 22 Ports below 1024 are privileged and can’t be re-bound by another service. No Root sign-on. Root only available via sudo su from an authenticated user Access is done under an unprivileged user with an entry in sudoers UFW is running with only the necessary service ports open. ssh whichever applications are running Data Boundaries Any time a data-boundary is crossed, that boundary is treated as adversarial, and all data traveling across is verified before committed or consumed. …

Lyricall Architecture

Tuesday, May 22, 2018

This summary of the architecture was correct upon its initial posting (November 2017). Changes have since been made. There is no guarantee that this post remains accurate into the future. Table of Contents Architecture of lyricall.net Technology tl;dr: App Overview Front End TypeScript Why TypeScript Redux React Why React Back End Database - PostgreSQL Why Postgres Database Schema Lyricall Tables Straggler Tables ASP.NET / Entity Framework Tables Server - .NET Core 2.0 / ASP.NET Core 2.0 Why .NET Core Intermission - the DotNetStandardSpotifyWebApi library Intermission - the ASP.NET Security Project API Server Architecture Entity Framework vs Hand Crafted SQL Automatic Timed Services Services Models Validation Scanning Hosting Digital Ocean Security Backups CI/CD Microsoft Azure Backups CI/CD Let’s Encrypt Architecture of lyricall.net …