Facebook says new bug allowed apps access to private photos of up to 6.8M users

Re:Facebook says new bug allowed apps access to private phot... by jammygit on Friday December 14, 2018 @01:02PM (#18682920)

Canada recently passed a law that adds fines to data breach incidents iirc. A professor mentioned it and its why I'm researching auth on my winter break.

Come to think of it, does anyone know of good auth resources for a mean stack that isn't a copy paste blog? I'm trying the udacity auth course as a starting point (uses oauth2)

[ Parent | on HN ]

Re:Facebook says new bug allowed apps access to private phot... by CuriousSkeptic on Friday December 14, 2018 @02:37PM (#18683878)

I just spent som time going through this.

The relevant rfc and drafts perhaps? https://tools.ietf.org/wg/oauth/

Also checkout OWASP https://www.owasp.org/

If your implementing openid connect, use a certified lib https://openid.net/developers/certified/

[ Parent | on HN ]

Re:Facebook says new bug allowed apps access to private phot... by jammygit on Saturday December 15, 2018 @02:28PM (#18689908)

Thanks (to both replies)

[ Parent | on HN ]

Re:Facebook says new bug allowed apps access to private phot... by verdverm on Friday December 14, 2018 @04:25PM (#18684944)

Look into authorization as well as authentication.

Dex by coreos, Open Policy Agent, Kubernetes docs & code are all good examples, lots of frameworks have docs / code.

[ Parent | on HN ]