The same thought had occurred to me.... At the moment I'm only using it for a proof of concept where the auth isn't that important so I haven't looked into/thought about it too much, at least not yet, and I know I should!, so I'd be happy to hear any thoughts on this.
I guess there's (very) limited protection in the service url pattern matching and by having a short token expiration time (although need to balance that with the overhead of refreshing the token) Not sure if it would be better with oidc than oauth, something else I should probably look into... On Wednesday, 13 March 2019 21:02:44 UTC, Trenton D. Adams wrote: > > It sounds very much like it's open to an easy exploit, where an attacker > just says "I'm person X, give me access", by overriding the javascript on > the client side. Anything done in the browser cannot be trusted, > especially when it comes to authentication. > On 3/13/19 3:28 AM, Ian Wright wrote: > > > Yes it is browser client side and does authenticate the client side app > against CAS without any server side interactions. > > What it also allows is, once you've auth'ed the client app, that you can > use the bearer token to auth against a server side app as well. > > On Tuesday, 12 March 2019 22:39:46 UTC, Trenton D. Adams wrote: >> >> So, I mean, as in browser client side. >> >> So are you saying that this module is passing cas validation to the >> server side for the server to do the ticket validation? >> On 3/12/19 10:21 AM, Ian Wright wrote: >> >> I'm not quite sure what you mean but yes it's client only. >> >> For context I have an openapi based application using the generator for >> typescript-angular on the client side. >> >> The angular-oauth2-oidc component allows a bearer token to be passed >> through to the server side >> >> My server side is also generated from the openapi spec - I'm using >> python-flask for development and AWS lambda elsewhere - the python-flask >> generated code works out of the box and it's a little more effort for the >> lambdas but not much. >> >> The openapi 3 spec is as follows: >> >> securitySchemes: >> OAuthSecurity: >> type: oauth2 >> x-tokenInfoUrl: .../oauth2.0/profile >> flows: >> authorizationCode: >> authorizationUrl: .../oauth2.0/authorize >> tokenUrl: .../oauth2.0/accessToken >> scopes: >> myscope: Access all areas >> >> >> On Tuesday, 12 March 2019 16:08:34 UTC, Trenton D. Adams wrote: >>> >>> Do you know if this is a client side library only Ian? >>> On 3/12/19 2:54 AM, Ian Wright wrote: >>> >>> Short answer is yes. >>> >>> I'm currently using >>> "angular-oauth2-oidc": "^4.0.3", >>> with CAS 5.3.7 >>> I'm using oauth rather than oidc, mainly because I wanted to bypass the >>> approval prompt which, at least when I tried it, could be configured for >>> oauth but not oidc but IIRC oidc worked fine. >>> >>> On Monday, 11 March 2019 18:03:54 UTC, maxwell_g wrote: >>>> >>>> Has anyone been successful at setting up “angular-oauth2-oidc” library >>>> to interface with CAS? We are currently using version CAS 5.2.2 and would >>>> like to authenticate Angular 7 applications using Oauth and OpenId >>>> connect. >>>> Would the “angular-oauth2-oidc” component be compatible or is there >>>> alternative? >>>> >>>> >>>> >>>> Thanks Gary >>>> >>>> -- >>> - Website: https://apereo.github.io/cas >>> - Gitter Chatroom: https://gitter.im/apereo/cas >>> - List Guidelines: https://goo.gl/1VRrw7 >>> - Contributions: https://goo.gl/mh7qDG >>> --- >>> You received this message because you are subscribed to the Google >>> Groups "CAS Community" group. >>> To unsubscribe from this group and stop receiving emails from it, send >>> an email to [email protected]. >>> To view this discussion on the web visit >>> https://groups.google.com/a/apereo.org/d/msgid/cas-user/f38bc4f7-59e8-4441-acf5-af490c8adcfe%40apereo.org >>> >>> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/f38bc4f7-59e8-4441-acf5-af490c8adcfe%40apereo.org?utm_medium=email&utm_source=footer> >>> . >>> >>> -- >>> Trenton D. Adams >>> Senior Systems Analyst/Web Software Developer >>> Applications Unit - ITS >>> Athabasca University >>> (780) 675-6195 >>> >>> It is only when you are surrounded by a supportive team, that you can >>> achieve >>> your best. Instead of tearing people down, try building them up! >>> >>> -- >>> >>> This communication is intended for the use of the recipient to whom it >>> is addressed, and may contain confidential, personal, and or privileged >>> information. Please contact us immediately if you are not the intended >>> recipient of this communication, and do not copy, distribute, or take >>> action relying on it. Any communications received in error, or subsequent >>> reply, should be deleted or destroyed. >>> >>> --- >>> >> -- >> Trenton D. Adams >> Senior Systems Analyst/Web Software Developer >> Applications Unit - ITS >> Athabasca University >> (780) 675-6195 >> >> It is only when you are surrounded by a supportive team, that you can >> achieve >> your best. Instead of tearing people down, try building them up! >> >> -- >> >> This communication is intended for the use of the recipient to whom it is >> addressed, and may contain confidential, personal, and or privileged >> information. Please contact us immediately if you are not the intended >> recipient of this communication, and do not copy, distribute, or take >> action relying on it. Any communications received in error, or subsequent >> reply, should be deleted or destroyed. >> >> --- >> > -- > Trenton D. Adams > Senior Systems Analyst/Web Software Developer > Applications Unit - ITS > Athabasca University > (780) 675-6195 > > It is only when you are surrounded by a supportive team, that you can achieve > your best. Instead of tearing people down, try building them up! > > -- > > This communication is intended for the use of the recipient to whom it is > addressed, and may contain confidential, personal, and or privileged > information. Please contact us immediately if you are not the intended > recipient of this communication, and do not copy, distribute, or take > action relying on it. Any communications received in error, or subsequent > reply, should be deleted or destroyed. > > --- > -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/c185b965-b0ed-42c7-a694-ace7883467f1%40apereo.org.
