Ones and Zeros

 JSON Web Tokens (JWT)   A JSON Web Token (JWT) is commonly used for authentication and authorization in web applications and APIs. Essentially, JWTs encode info about a user or entity into a JSON object, which is then digitally signed and/or encrypted.  A JWT consists of three parts, separated by dots (.):  1. Header: Contains metadata about the token, such as the signing algorithm (e.g., HMAC SHA256, RSA SHA256) and the token type (JWT).  2. Payload: Contains the claims, which are statements about an entity (e.g., user ID, role, expiration time).   3. Signature: Verify that the JWT sender is who they claim to be and that the message hasn't been tampered with.  How it works:   Authentication: A user logs in, and the server creates a JWT containing user info and other relevant claims.    Token Transmission: The server sends the JWT to the client (e.g., browser).    Subsequent Requests: The client includes the JWT in the au...

 Apigee  (Google's Cloud API tool)   I was surprised how many policies Google offered in Apigee:  Standard Policies:     1) Traffic management policies: SpikeArrest policy     2)  Mediation policies: CORS, GraphQL, HTTPModifier, JSONtoXML, OASValidation, PublishMessage, RaiseFault, ReadPropertySet, SOAPMessageValidation, XMLtoJSON policies    3) Security policies: AccessControl, HMAC, DecodeJWT, VerifyJWT policies    4) Extension policies: AssertCondition, ExternalCallout policies Extensible policies:    1) Traffic management policies: InvalidateCache, LookupCache, PopulateCache, ResponseCache, Quota, ResetQuota policies    2) Mediation policies: AccessEntity, AssignMessage, ExtractVariables, KeyValueMapOperations, MonetizationLimitsCheck, ParseDialogflowRequest, SetDialogflowResponse, XSLTransform policies    3) Security policies: BasicAuthentication, JSONThreatProtection, DecodeJWS...

 JWT vs OAuth 2.0 vs SAML vs SSO    The main differences between JSON web tokens (JWT) and OAuth 2.0 and Security Assertions Markup Language (SAML) tokens are :     JWTs could be used internally in SPAs, stateless situations, or authorizations for APIs. JWTs are JSON of course.     OAuth is always external and authorization server is the server that grants it. OAuth is based on HTTP request parameters and JSON response message.     SAML is always external and identity provider is the server that grants it. SAML is thought of as more enterprise. SAML has challenges of coding XML parsing, encryption, signing, and validation on the client. SAML 2.0 introduced many new protocols, including the assertion query and request, authentication request, artifact resolution, name identifier management, name identifier mapping, and single logout protocols. SAML 2.0 separated bindings from underlying profiles such as reverse SOAP, SAML...