TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Ask HN: Any comprehensive courses on Auth?

242 点作者 bojangleslover超过 1 年前
I would like cover basic username/password auth, OAuth and Active Directory, security keys and everything in between. Would like to do this in a linear fashion, ie like a coursera course with practice problems.

33 条评论

SushiHippie超过 1 年前
What made me understand these things the most, was setting this up just for myself.<p>For example host your own instance of Zitadel, Authentik or whatever you find most appealing. Tinker a bit around with it. Then use that instance to authenticate yourself somewhere, i.e. another service where you can set up your own oauth provider. Take a look at the API requests, take a look the code of some OAuth implementation, for example in projects like Gitea, Nextcloud.<p>May not be it for everyone, though I really like learning by doing.
评论 #38337272 未加载
评论 #38335251 未加载
评论 #38336761 未加载
评论 #38334918 未加载
krantic超过 1 年前
I have not seen a course that covers all of the things you are asking for.<p>The best courses on the oidc&#x2F;oauth and saml I have seen were the paid ones here: <a href="https:&#x2F;&#x2F;www.hackmanit.de&#x2F;en&#x2F;training&#x2F;portfolio" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.hackmanit.de&#x2F;en&#x2F;training&#x2F;portfolio</a><p>On linkedinlearning this one was quite ok: <a href="https:&#x2F;&#x2F;www.linkedin.com&#x2F;learning&#x2F;web-security-oauth-and-openid-connect-2" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.linkedin.com&#x2F;learning&#x2F;web-security-oauth-and-ope...</a><p>Free ressources check: -<a href="https:&#x2F;&#x2F;aaronparecki.com&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;aaronparecki.com&#x2F;</a><p>-OAuth 2.0 and OpenID Connect (in plain English): <a href="https:&#x2F;&#x2F;m.youtube.com&#x2F;watch?v=996OiexHze0">https:&#x2F;&#x2F;m.youtube.com&#x2F;watch?v=996OiexHze0</a><p><a href="https:&#x2F;&#x2F;speakerdeck.com&#x2F;nbarbettini&#x2F;oauth-and-openid-connect-in-plain-english" rel="nofollow noreferrer">https:&#x2F;&#x2F;speakerdeck.com&#x2F;nbarbettini&#x2F;oauth-and-openid-connect...</a><p>-OAuth&#x2F;OpenID by Nat Sakimura(chairman openid foundation) <a href="https:&#x2F;&#x2F;m.youtube.com&#x2F;playlist?list=PLRUD_uiAYejRvQWkS2xjgFW20lRLp4snN">https:&#x2F;&#x2F;m.youtube.com&#x2F;playlist?list=PLRUD_uiAYejRvQWkS2xjgFW...</a><p>For the active directory topic I don&#x27;t know good ressources
评论 #38332523 未加载
评论 #38333352 未加载
评论 #38332002 未加载
评论 #38333220 未加载
bjt超过 1 年前
I think the most important place to start is appreciating the distinction between authentication (&quot;is the person trying to use my application really the person they say they are?&quot;, abbreviated &quot;authn&quot;) and authorization (&quot;is this person allowed to perform the action they&#x27;re trying to perform?&quot;, abbreviated &quot;authz&quot;).<p>Most of the comments on this page are referring to authentication. It&#x27;s important to know, but also the piece you&#x27;re likely to spend far less time on. It&#x27;s where most of the heavy lifting will be done by some vendor or tool you set up instead of by your own code.<p>Authorization is far less likely to be something you get off the shelf and far more likely to be where you spend significant time. It can be very intimately connected to your business logic. Active Directory roles and groups are one authorization solution for a particular class of problems but I have only seen them used for controlling business internal assets (mostly file servers); not public-facing applications.<p>I really like Oso Academy as a resource for authorization topics. It&#x27;s structured like a progressive course, though I don&#x27;t know if they have the kind of exercises you mentioned.<p><a href="https:&#x2F;&#x2F;www.osohq.com&#x2F;academy" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.osohq.com&#x2F;academy</a>
评论 #38336441 未加载
评论 #38336857 未加载
treffer超过 1 年前
One thing that might be interesting is SASL has evolved over the years. Most things are RFCs, so well written, short and open specifications. This gives you one larger thing to learn. Should be rather linear if you sort by RFC number.<p>It would head well into advanced user&#x2F;password schemes.<p>The problem is that even advanced mechanism like a SCRAM based authentication with additional 2fa are rather simple to grasp &amp; implement, but really hard to get right &#x2F; secure.<p>A lot of the evolution is rather an evolution of attacks and issues, leading to new schemes. OWASP is thus pretty relevant, too.
nevon超过 1 年前
I&#x27;m also interested in this, but specifically something that covers authentication between services and in particular situations where a user authenticates against service a and now service a needs to ask service b to do something on behalf of the user. Not just a handwavy &quot;use OAuth&quot; but more concrete and thorough.
评论 #38331983 未加载
评论 #38331792 未加载
评论 #38332980 未加载
评论 #38335994 未加载
arun-mani-j超过 1 年前
FastAPI&#x27;s tutorial on how to implement a basic OAuth server helped me a lot in understanding the basic concepts.<p><a href="https:&#x2F;&#x2F;fastapi.tiangolo.com&#x2F;tutorial&#x2F;security&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;fastapi.tiangolo.com&#x2F;tutorial&#x2F;security&#x2F;</a><p>After getting familiar, I self hosted Keycloak and integrated it with my FastAPI server.<p><a href="https:&#x2F;&#x2F;www.keycloak.org&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.keycloak.org&#x2F;</a><p>Though not exactly a course, learning by doing helped me :)
davedx超过 1 年前
I’ve learned a lot about these things by working on a project using Ory Kratos. The documentation is a bit patchy but it’s open source so you can dive into the gritty details of how a fairly large id provider implements the various aspects of OAuth and so on. (One nice thing about Azure Active Directory is that it supports OAuth2 integrations so if you understand and can implement OAuth2 then you can also implement AD).<p>I know it’s not a linear learning answer but hope it helps you perhaps later. Good luck!
评论 #38337627 未加载
评论 #38341583 未加载
sshb超过 1 年前
You might want to check out <a href="https:&#x2F;&#x2F;dchest.com&#x2F;authbook&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;dchest.com&#x2F;authbook&#x2F;</a>
langur超过 1 年前
I found Nate Barbettini&#x27;s video on OAuth and OpenID Connect incredibly insightful for understanding these topics. He explains everything so well- <a href="https:&#x2F;&#x2F;youtu.be&#x2F;996OiexHze0" rel="nofollow noreferrer">https:&#x2F;&#x2F;youtu.be&#x2F;996OiexHze0</a>.<p>Additionally, I&#x27;m part of the ZITADEL team, an open-source project that&#x27;s free to download or use in our cloud offering. So, you can always tinker around with it as some others have already suggested. Our blog dives into various security topics, ranging from OAuth, OpenID Connect, and Single Sign-On, Authentication, Federation to emerging issues like Passkeys. We also discuss real-world Identity Management problems and solutions seen by ZITADEL users— <a href="https:&#x2F;&#x2F;zitadel.com&#x2F;blog" rel="nofollow noreferrer">https:&#x2F;&#x2F;zitadel.com&#x2F;blog</a>.<p>For any specific security-related queries, feel free to join the conversation on our Discord chat: <a href="https:&#x2F;&#x2F;zitadel.com&#x2F;chat" rel="nofollow noreferrer">https:&#x2F;&#x2F;zitadel.com&#x2F;chat</a>. We&#x27;re always discussing and sharing insights on these topics.
jdsleppy超过 1 年前
I recently had to learn OIDC which is the standard for auth that most people really mean when they say OAuth now, I think. I learned by implementing (using Keycloak) and most importantly by reading the OIDC specs. It may seem intimidating, but the real core of it is not that large.<p>It&#x27;s a topic I&#x27;d be interested in writing more about, and I&#x27;m happy to start here if you would find it useful.
snowstormsun超过 1 年前
For fido2 and passkeys, I&#x27;d recommend Adam Langley&#x27;s blog: <a href="https:&#x2F;&#x2F;www.imperialviolet.org&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.imperialviolet.org&#x2F;</a>
sgt超过 1 年前
There&#x27;s also the RFC on OAuth2:<p><a href="https:&#x2F;&#x2F;datatracker.ietf.org&#x2F;doc&#x2F;html&#x2F;rfc6749" rel="nofollow noreferrer">https:&#x2F;&#x2F;datatracker.ietf.org&#x2F;doc&#x2F;html&#x2F;rfc6749</a><p>The introduction will give you a bit of a background. The most important to read (for now) is just the introduction up to chapter 2.
评论 #38332953 未加载
评论 #38333932 未加载
vindex10超过 1 年前
Generally, check yourself with OWASP cheatsheet:<p><a href="https:&#x2F;&#x2F;cheatsheetseries.owasp.org&#x2F;cheatsheets&#x2F;Authentication_Cheat_Sheet.html" rel="nofollow noreferrer">https:&#x2F;&#x2F;cheatsheetseries.owasp.org&#x2F;cheatsheets&#x2F;Authenticatio...</a>
woodylondon超过 1 年前
I think auth0 has some, which are free but maybe based too much around there product, which I use and think very good.<p><a href="https:&#x2F;&#x2F;auth0.com&#x2F;learn" rel="nofollow noreferrer">https:&#x2F;&#x2F;auth0.com&#x2F;learn</a>
d4mi3n超过 1 年前
A bit salse-y, but Oso has a pretty nice overview on the problems that led to their product and how they reason about AuthN&#x2F;AuthZ: <a href="https:&#x2F;&#x2F;www.osohq.com&#x2F;academy" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.osohq.com&#x2F;academy</a><p>It&#x27;s more focused on application level architecture rather than the whole domain of AuthN&#x2F;AuthZ, but I&#x27;ve found it&#x27;s a decent reference for folks unfamiliar with a lot of the common issues one encounters in implementation.
FuriouslyAdrift超过 1 年前
For Kerberos, here:<p><a href="https:&#x2F;&#x2F;kerberos.org&#x2F;software&#x2F;tutorial.html" rel="nofollow noreferrer">https:&#x2F;&#x2F;kerberos.org&#x2F;software&#x2F;tutorial.html</a>
评论 #38340078 未加载
Lacerda69超过 1 年前
Far from a comprehensive course, but I found this blogpost really good for understanding OAuth2 and usecases&#x2F;limitations&#x2F;footguns: <a href="https:&#x2F;&#x2F;www.ory.sh&#x2F;oauth2-openid-connect-do-you-need-use-cases-examples&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.ory.sh&#x2F;oauth2-openid-connect-do-you-need-use-cas...</a>
YawningAngel超过 1 年前
<a href="https:&#x2F;&#x2F;www.oreilly.com&#x2F;library&#x2F;view&#x2F;api-security-in&#x2F;9781617296024&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.oreilly.com&#x2F;library&#x2F;view&#x2F;api-security-in&#x2F;9781617...</a>
mooreds超过 1 年前
I don&#x27;t know of any, but here&#x27;s the resources I&#x27;ve found useful as I&#x27;ve worked in the space (disclosure: I work for an auth vendor, FusionAuth).<p>* Solving Identity Management In Modern Applications is a great book offering an overview of the entire identity process, including provisioning (adding users), authentication and more. I read and reference the 2019 edition; don&#x27;t have the 2023 edition but expect it is just as good: <a href="https:&#x2F;&#x2F;link.springer.com&#x2F;book&#x2F;10.1007&#x2F;978-1-4842-8261-8" rel="nofollow noreferrer">https:&#x2F;&#x2F;link.springer.com&#x2F;book&#x2F;10.1007&#x2F;978-1-4842-8261-8</a><p>* OAuth2 In Action walks you through building an OAuth2 server from scratch (in JavaScript). You&#x27;ll learn about the fundamentals of tokens, clients, registration, and more. Very accessible. <a href="https:&#x2F;&#x2F;www.manning.com&#x2F;books&#x2F;oauth-2-in-action" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.manning.com&#x2F;books&#x2F;oauth-2-in-action</a><p>* The Security Engineering Handbook is great for foundational security knowledge, like &#x27;What does a hash look like, and what makes a good hashing algorithm&#x27; as well as a lot of broader security topics: <a href="https:&#x2F;&#x2F;www.cl.cam.ac.uk&#x2F;~rja14&#x2F;book.html" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.cl.cam.ac.uk&#x2F;~rja14&#x2F;book.html</a><p>* FusionAuth&#x27;s vendor neutral articles: <a href="https:&#x2F;&#x2F;fusionauth.io&#x2F;articles&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;fusionauth.io&#x2F;articles&#x2F;</a> . I&#x27;d especially call out these two: The Modern Guide to OAuth, which walks through the multiple different ways the OAuth 2 authorization framework can be used: <a href="https:&#x2F;&#x2F;fusionauth.io&#x2F;learn&#x2F;expert-advice&#x2F;oauth&#x2F;modern-guide-to-oauth" rel="nofollow noreferrer">https:&#x2F;&#x2F;fusionauth.io&#x2F;learn&#x2F;expert-advice&#x2F;oauth&#x2F;modern-guide...</a> (previous HN discussion: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29752918">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29752918</a> ), and the Math of Password Hashing: <a href="https:&#x2F;&#x2F;fusionauth.io&#x2F;learn&#x2F;expert-advice&#x2F;security&#x2F;math-of-password-hashing-algorithms-entropy" rel="nofollow noreferrer">https:&#x2F;&#x2F;fusionauth.io&#x2F;learn&#x2F;expert-advice&#x2F;security&#x2F;math-of-p...</a><p>* The Beer Drinkers Guide to SAML is a great resource for understanding this (still) critical standard, plus just a fun read: <a href="https:&#x2F;&#x2F;duo.com&#x2F;blog&#x2F;the-beer-drinkers-guide-to-saml" rel="nofollow noreferrer">https:&#x2F;&#x2F;duo.com&#x2F;blog&#x2F;the-beer-drinkers-guide-to-saml</a><p>* The RFCs and BCPs (as mentioned). I&#x27;ve also learned a lot by lurking on the OAuth mailing list, which is freely available: <a href="https:&#x2F;&#x2F;mailarchive.ietf.org&#x2F;arch&#x2F;browse&#x2F;oauth&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;mailarchive.ietf.org&#x2F;arch&#x2F;browse&#x2F;oauth&#x2F;</a><p>* The Identity Unlocked podcast with Vittorio Bertocci (RIP). This is not about the basics at all, but is a deeper dive into the dev focused side of authentication, and will give you great pointers for more reading: <a href="https:&#x2F;&#x2F;identityunlocked.auth0.com&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;identityunlocked.auth0.com&#x2F;</a><p>* The OWASP guides are good but specialized. See for example: <a href="https:&#x2F;&#x2F;owasp.org&#x2F;API-Security&#x2F;editions&#x2F;2023&#x2F;en&#x2F;0xa2-broken-authentication&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;owasp.org&#x2F;API-Security&#x2F;editions&#x2F;2023&#x2F;en&#x2F;0xa2-broken-...</a><p>* I have a substack where I talk about aspects of customer identity and access management that I think is pretty good :) : <a href="https:&#x2F;&#x2F;ciamweekly.substack.com&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;ciamweekly.substack.com&#x2F;</a><p>I think this would be a great linkedin learning, udacity or coursera course, but didn&#x27;t see anything when I searched there. I&#x27;ve put together courses before and it&#x27;s a ton of work, but hmmm, maybe it&#x27;d be fun to do for this topic.<p>Edit: corrected spelling of Vittorio Bertocci&#x27;s name.
评论 #38333032 未加载
andrewstuart2超过 1 年前
One thing I did early on, that I would highly recommend, is picking up a Security+ study guide book and reading it. I recommend a digital copy, since it&#x27;s easier to ignore the fact that the book is quite large. Even if you never do the certification (I haven&#x27;t), the Security+ curriculum gives a really nice broad overview of a ton of the concepts involved and how they&#x27;re used practically. From there, as a few others have mentioned ,it&#x27;s hard to beat reading some of the specs for Oauth2, OIDC, SAML, etc, to understand how the primitives are woven together and what the different terms mean.
s-xyz超过 1 年前
Perhaps the higher level architecture reference guides can provide a good overview of all these items? Written from a GCP perspective, but nevertheless the concepts can be shared cross cloud:<p>Security &amp; IAM - <a href="https:&#x2F;&#x2F;cloud.google.com&#x2F;architecture&#x2F;security-iam" rel="nofollow noreferrer">https:&#x2F;&#x2F;cloud.google.com&#x2F;architecture&#x2F;security-iam</a><p>Other - <a href="https:&#x2F;&#x2F;cloud.google.com&#x2F;architecture?_ga=2.121060044.-593897664.1666120897" rel="nofollow noreferrer">https:&#x2F;&#x2F;cloud.google.com&#x2F;architecture?_ga=2.121060044.-59389...</a>
alexgf0超过 1 年前
I made the simplest Rust server I could to learn the basic workflow of OAuth2, it gets the user gmail after you log in with Google. I also included some instructions of how to set up the Google account. Feel free to check it out! <a href="https:&#x2F;&#x2F;github.com&#x2F;alexgf0&#x2F;oauth">https:&#x2F;&#x2F;github.com&#x2F;alexgf0&#x2F;oauth</a>
dickhardt超过 1 年前
Learning Digital Identity by Phil Windley is a great resource as long as you skip over the SSI parts<p><a href="https:&#x2F;&#x2F;www.oreilly.com&#x2F;library&#x2F;view&#x2F;learning-digital-identity&#x2F;9781098117689&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.oreilly.com&#x2F;library&#x2F;view&#x2F;learning-digital-identi...</a>
评论 #38334353 未加载
zinclozenge超过 1 年前
I&#x27;m currently in the boat where I need to set up authentication (and eventually authorization) for a startup catering to big enterprises almost exclusively. I&#x27;d love to be recommended resources for setting up something like Keycloak or Auth0 (or anything else) for that use case.
gabrielsroka超过 1 年前
<a href="https:&#x2F;&#x2F;www.oauth.com" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.oauth.com</a>
EtienneK超过 1 年前
Not a course, but the IDPro Body of Knowledge is a great resource for any aspiring Identity professional: <a href="https:&#x2F;&#x2F;idpro.org&#x2F;body-of-knowledge&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;idpro.org&#x2F;body-of-knowledge&#x2F;</a>
quangv超过 1 年前
Two I found react&#x2F;remix<p>- <a href="https:&#x2F;&#x2F;reactsecurity.io&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;reactsecurity.io&#x2F;</a> - <a href="https:&#x2F;&#x2F;EpicWeb.dev" rel="nofollow noreferrer">https:&#x2F;&#x2F;EpicWeb.dev</a>
__g667f超过 1 年前
This is a deep, starting from zero course -&gt; <a href="https:&#x2F;&#x2F;www.thecyberhut.com&#x2F;auth-design&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.thecyberhut.com&#x2F;auth-design&#x2F;</a>
tndata超过 1 年前
I do provide company training in OAuth, OpenID-Connect, ASP.NET Core authenticaiton and web security at <a href="https:&#x2F;&#x2F;tn-data.se&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;tn-data.se&#x2F;</a>
withinboredom超过 1 年前
Huh, I always forget a lot of programmers weren&#x27;t around when this stuff was invented. It&#x27;s all actually pretty simple, and very little complexity. However, there are so many &quot;gotchas&quot; (that can result in zero security) that anyone writing a guide like this would probably have you sign a waiver, then any company you work for sign a waiver, and include your firstborn child.<p>For example, user&#x2F;pass is pretty simple on the surface:<p>1. app sends server user&#x2F;password.<p>2. check if it matches the password in the database.<p>3. if so, respond with a token the app can send back that is associated with the user. if not, return with a 401.<p>The number of gotchas in this simple 3-step process is insane... here&#x27;s some off the top of my head (not exhaustive):<p>- make sure the login form includes a CSRF token.<p>- do not store the password in plaintext in the db. or encrypted, probably. Since an attacker can possibly get the encryption key and then decrypt all your passwords. Use strong, slow hashes.<p>- rate limit your logins to prevent brute-forcing (slow hashes work great here)<p>- use constant-time comparisons to check if the password matches (e.g., hash_equals() in PHP), RTFM for whatever constant time check you are using or you will open yourself up to timing attacks.<p>That&#x27;s the issue with security stuff, there are so many gotchas that anyone writing a course would open themselves up to getting sued (at least in the US) just for missing a gotcha or someone with Dunning-Kruger thinking they know everything and getting hacked ... it&#x27;s too risky. You have to just get into the industry and learn it the hard way. At least that&#x27;s how I learned everything I learned.
评论 #38331839 未加载
评论 #38331830 未加载
评论 #38336026 未加载
lofaszvanitt超过 1 年前
How much are you willing to pay for it so you would get a knowledge base that is not superficial, but thorough and you&#x27;ll really know the ins and outs of it?
joshxyz超过 1 年前
none.<p>but useful stuff:<p>certified ethical hacker course can give you a perpetrator&#x27;s pov on how people get hacked.<p>owasp cheatsheet and latacora blog are useful reference also.<p>understanding how companies offer these services also helps, e.g. clerk.com, ory.sh, auth0, okta, supertokens, etc.<p>understanding how authentication coincides with authorization helps too.
oooyay超过 1 年前
imo, the best way to learn these is to implement them on a small scale yourself. When I wanted to learn about JOSE, I implemented a JOSE library and read the RFCs alongside my implementation. It taught me a lot.