20.500.12556/DKUM-70842 Comparison of JWT and OAuth 2.0 for authorisation and authentication in rest services Primerjava tehnik JWT in OAuth 2.0 za avtorizacijo in avtentikacijo pri uporabi storitev rest The thesis addresses the area of using token authentication and authorisation for software products that, for synchronization and communication purposes, take advantage of underlying REST services. Given that REST service focuses on the use of HTTP protocols, and that REST in its own principle requires being stateless, developers need to address issues regarding user identification, authentication, and authorisation in a stateless manner. In the thesis, we will also show the proper use of security protocols that are part of the HTTP specification, and how to transmit and encrypt sensitive data properly between two endpoints. We will do so by implementing a server and client and, furthermore, present the communication flow needed for ensuring a strong security policy that prevents system vulnerabilities and security flaws by implementing REST service that is stateless and, for the purpose of user identification, uses two of the most common token authentication implementations, OAuth 2.0 and JWT. Furthermore, we will compare the basic principles and concepts of the two user identification frameworks and analyse the benefits of both structurally and what to use in which given situation. Magistrsko delo se navezuje na področje žetonske avtentikacije in avtorizacije uporabnika pri uporabi programske opreme, ki za svoje delovanje uporablja spletne storitve razvite na podlagi arhitekturnega vzorca REST. V samem delu predstavljamo najboljše prakse razvoja spletnih storitev in raznih odjemalcev, hrambe občutljivih podatkov in vpeljavo učinkovito varnostne politike tako na transportni oziroma komunikacijski strani kot aplikacijski strani. V samem delu teoretično opišemo celotno infrastrukturo in protokole potrebne za delovanje takšnih sistemov ter se poglobimo v samo strukturo žetonske avtentikacije in avtorizacije uporabnika na trenutno dveh najbolj uporabljenih tehnologijah oAuth 2.0 in JWT. V samem praktičnem delu smo s pomočjo implementacije prikazali različne načine uporabe, tok komunikacije in hrambo med samim odjemalcem in ponudnikom REST services OAuth 2.0 JWT token authentication communication security authorisation authentication REST storitve OAuth 2.0 JWT žetonska avtentikacija komunikacijska varnost avtorizacija avtentikacija true true false [V. Visočnik] Angleški jezik Slovenski jezik Magistrsko delo/naloga 2018-06-15 09:09:18 2018-07-17 14:08:46 2022-08-01 19:53:46 2019-07-11 18:21:40 2018 0 Maribor 0 0000-00-00 NiDoloceno NiDoloceno NiDoloceno 0000-00-00 0000-00-00 0000-00-00 004.056.523(043.2) 21588246 URN:SI:UM:DK:V0CEWDDX MAG_Visocnik_Vid_2018.pdf MAG_Visocnik_Vid_2018.pdf 1 6B08652D73871DF4FB6A5F95E3613334 aa1643c49d59d8c9b1620fd002c5d796dbd7612cf544e12536c160dd214a4d62 09dcd23c-7c10-11eb-bb7a-00155d0001ca 20.500.12556/dkum/bad19664-5b3b-41df-a077-448fa381aed6 https://dk.um.si/Dokument.php?lang=slv&id=125729 Fakulteta za elektrotehniko, računalništvo in informatiko 0 0 0