David VanDusen davidvandusen

Auth and WebSec

Today we looked at 3rd party authentication and web security.

We built a simple Express.js web app that uses Passport to allow users to sign in with Google.

After that we used Wireshark to snoop on network trafic to that web app to get an authenticated user's session id to make HTTP requests to the app as them.

	#!/usr/bin/env ruby

	class PoppinBottles

	def self.run
	loop do
	print "\nNumber of dollars to invest: $"
	input = gets.chomp
	begin
	dollars = Float(input)

	$(function () {

	var MAX_BET = 10;
	var MIN_BET = 5;
	var MIN_GUESS = 1;
	var MAX_GUESS = 10;

	var playerMoney = 100;
	var randomNumber;

	function Thing() {}
	//undefined
	var t = new Thing();
	//undefined
	t instanceof Thing
	//true
	t instanceof Object
	//true
	Thing.prototype.__proto__
	//Object {}

	h1 { color: red; }
	p { background: #cdf; border: 5px dashed gold; color: green; margin: 2em; padding: 1em; }
	p span { font-style: italic; }
	span { background: darkslategray; }
	strong { background: yellow; font-weight: normal; }
	ul span { text-decoration: underline; }
	.subpar { background: hotpink; text-decoration: line-through; }

	var something = 'outer';

	var outerSecret = (function () {
	for (var i = 10; i--;) {
	var mysecretthing = 'shhhhh';
	console.log(i + ' ' + something);
	}
	return mysecretthing;
	});

	<!doctype html>
	<html>
	<head>
	<title>Forms Demo!</title>
	</head>
	<body>
	<h1>Forms Demo!</h1>
	<h2>Login</h2>
	<form action="/login" method="post">
	<p>

	header {
	padding-top: 75px;
	}
	img {
	max-width: 100%;
	}
	#front-view-img {
	margin-top: 30px;
	}

	# REST Resources

	## Articles Resrouce

	GET http://example.com/articles
	- Gets all the articles (probably HTML)
	POST http://example.com/articles
	- Creates a new article (the article that was created, e.g. articles/100)
	GET http://example.com/articles/99
	- Gets article 99 (probably HTML)