News for hackers. Stuff that matters.

A comment on Abusing Entra OAuth for fun and access to internal Microsoft applications. Parent comment

Re:Abusing Entra OAuth for fun and access to internal Micros... by ExoticPearTree on Sunday August 10, 2025 @08:56AM (#44854872)
The big problem with the ZT approach is that smaller shops don't have a lot of developers and testers (some maybe with a security inclination) to be certain to a somewhat high degree that their app is written in a secure manner. Or be able to continuously keep abreast of every new security update Microsoft or other IdP makes to their stack.

It is easy for Google/Microsoft and any other FAANG like company to preach about Zero Trust when they have unlimited (for whatever value of unlimited you want to consider) resources. And even then they get it wrong sometimes.

The simpler alternative is to publish all your internal apps through a load balancer / API gateway with a static IP address, put it behind a VPN and call it a day.

[ Parent | on HN ]
Re:Abusing Entra OAuth for fun and access to internal Micros... by themafia on Sunday August 10, 2025 @05:13PM (#44858336)
> publish all your internal apps through a load balancer / API gateway with a static IP address, put it behind a VPN and call it a day.

Or just use Cognito. It can wrap up all the ugly Microsoft authentication into it's basic OAuth and API Gateway can use and verify Cognito tokens for you transparently. It's as close to the Zero Trust model in a Small Developer Shop we could get.

[ Parent | on HN ]