# web-authentication Published articles for web-authentication. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How Passwordless Works DevFeed: [How Passwordless Works]() Original publisher: [Read original article]() Author: alan.parra@goteleport.com (Alan Parra) Published: 2022-08-04T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [WebAuthn](), [Authentication](), [passwords](), [Protocol (disambiguation)](), [client](), [Security](), [browser](), [Server]() Tags: [authentication](), [browser](), [password](), [security](), [server](), [specifications](), [web-authentication]() ### AI overview This tutorial explains passwordless and usernameless authentication, focusing on how WebAuthn uses a challenge-response protocol involving an authenticator, a web browser, and a server. It also introduces related FIDO2 specifications and discusses the approach's user-experience and security trade-offs. ### Source excerpt Learn how passwordless authentication works and how it's built using WebAuthn. ## Web Authentication at Headspace using Auth0 DevFeed: [Web Authentication at Headspace using Auth0]() Original publisher: [Read original article]() Author: Headspace Published: 2021-04-26T20:43:56Z Content type: tutorial Language: en Sources: [Stories by Headspace on Medium]() Topics: [Authentication](), [Auth0](), [Web](), [Cookies](), [browser]() Tags: [auth0](), [authentication](), [browser](), [cookies](), [login](), [password](), [server](), [web](), [web-authentication]() ### AI overview This article explains modern web authentication using usernames, passwords, session tokens, and browser cookies. It describes Headspace's authentication requirements across web, backend, iOS, and Android applications and explains why the company chose Auth0 as its authentication provider. ### Source excerpt Author: Jesse Bond, Senior Software Engineer, Web Introduction: How does modern authentication work? Authentication allows users to securely log into a system and verify that they are who they say they are in subsequent requests. On today's web, this usually involves creating an account using a combination of username and password. Let's start with a quick refresher on how modern web authentication works. The first step is always a user submitting their login credentials into a form. Once the form is submitted, the server will determine whether or not the username and password match that of a previously registered user. If they do match, the server will return what is known as a session token. A session token is a unique identifier that authenticates requests as coming from the same user that just logged in. It's important to note that session tokens usually are temporary and have an expiration, which is determined by the server. Now that the user has a session token, each request will need to submit the session token to ensure authentication. It might sound tedious to have to submit the session token on each request, but have no fear, the cookie is here! Cookies are small bits of information that the browser stores for a domain. Cookies are also automatically submitted when a request is sent by the browser. Does this sound like a great way to handle the session token or what? Correct! Session tokens are almost always stored in a browser cookie to make authenticating requests a breeze. Authentication requirements Headspace has a large number of Single Page Apps, backend services, websites, and iOS and Android applications. We needed a robust solution for authentication that met the following requirements: Multiple platform and language support Scalable to millions of users Reliable with high uptime Ability to separate our users into different groups with varying permissions (i.e., admins vs. standard users) Ability to restrict user access to certain applications. Fo ## Keycloak Community Newsletter #1 DevFeed: [Keycloak Community Newsletter #1]() Original publisher: [Read original article]() Author: Sébastien Blanc Published: 2019-04-01T00:00:00Z Content type: news Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Authentication](), [WebAuthn](), [W3C](), [GitHub](), [Kubernetes]() Tags: [announcement](), [authentication](), [github](), [github-issues](), [idm](), [jwt](), [kerberos](), [keycloak](), [kubernetes](), [ldap](), [new-feature](), [news](), [openid-connect](), [pull-requests](), [saml](), [sso](), [w3c](), [web-authentication]() ### AI overview The first Keycloak Community Newsletter reviews community articles on JWT authentication with React, NodeJS, Kong, Kibana, and Kubernetes. It also covers Keycloak releases, planned feature design discussions, WebAuthn becoming a W3C Standard, conference talks, and opportunities to contribute. ### Source excerpt This is the very first "Keycloak Community Newsletter." The goal of this newsletter is to share news about the Keycloak project. News from the community Since the beginning of the year, the community has been really active. Each week several blog posts about Keycloak are published. Here is a short selection. Let's start with Philip Riecks who explains in this article how you can use Microprofile JWT Authentication with Keycloak and React. Ramandeep Singh has been blogging about Keycloak and NodeJS. Joshua Alfred Erney explains in this blog series how to integrate Keycloak and Kong, a popular API management platform. With Mohamed Aboullaite's blog post, you will learn how to secure your Kibana dashboards using Keycloak. Finally in this three-part article, the process of installing Keycloak on Kubernetes will become very clear. News from the project Keycloak 5.0.0 has been released and 6.0.0 is around the corner. From now on, new larger Keycloak's features will be openly discussed. For each new feature, a design document will be created and pushed to our Github repository as a simple MarkDown file. This strategy makes it easy for everyone to comment as well as contribute to the designs by opening Github issues and providing pull requests. We have already three documents open for discussion: W3C Web Authentication - Two-Factor Application-Initiated Actions Observerability News from the Identity Management World The big announcement, two weeks ago, was that WebAuthn became an official W3C Standard. This event is a milestone in the world of authentication and Identity Management. The goal of WebAuthn, according to Wikipedia is to: standardize an interface for public-key authentication of users to web-based applications and services. The Keycloak community is naturally really interested in this new standard. A design document is available and the community has even started to work on a prototype. Conferences / Webinars In March, the Javaland conference was held in Germany ## W3C Web Authentication (WebAuthn) DevFeed: [W3C Web Authentication (WebAuthn)]() Original publisher: [Read original article]() Author: Stian Thorgersen Published: 2019-03-06T00:00:00Z Content type: article Language: en Sources: [Keycloak Blog]() Topics: [WebAuthn](), [Authentication](), [public key](), [Keycloak](), [browser](), [Java]() Tags: [authentication](), [idm](), [java](), [kerberos](), [keycloak](), [ldap](), [openid-connect](), [public-key](), [saml](), [security](), [sso](), [w3c](), [web-authentication]() ### AI overview The article explains that WebAuthn became an official W3C web standard and describes its use of public-key credentials instead of shared secrets. It covers phishing resistance, browser and device support, two-factor and passwordless authentication, and planned WebAuthn integration in Keycloak. ### Source excerpt W3C Web Authentication (WebAuthn) was recently made an official web standard. This is a great step towards making a safer and simpler authentication experience for users. Where traditional authentication, such as password and OTP, rely on having shared secrets between the user and the web application, this is not the case with WebAuthn. WebAuthn uses public key-based credentials resulting in the web application not having access to the users secrets anymore. The keys are also unique per web application which eliminates the risk of phishing attacks. WebAuthn provides a standard protocol for web applications to authenticate via a number of devices through a relatively simple challenge/response. All major browser vendors now have support for WebAuthn and FIDO2, where FIDO2 is the specification that enables the browser to communicate with different hardware devices. WebAuthn can be used both as a two factor mechanism as well as enable passwordless authentication. There are already an healthy amount of devices that can be used together with WebAuthn. There are a number of security keys like YubiKey, ThinC and Titan. A lot of new laptops also come with built-in fingerprint scanners, and it Android also recently made it possible to use the fingerprint scanners on Android 7+ devices with WebAuthn. We are of course planning on bringing WebAuthn support to Keycloak in the near future. The team behind webauthn4j has been hard at work greating a quality Java library for WebAuthn and will hopefully soon have an extension to Keycloak ready. We will first focus on two-factor authentication with WebAuth and as part of this we will bring a number of improvements to Keycloak around two-factor authentication. For more details check the design document. Later, we will also bring the passwordless experience to Keycloak. This will also introduce Keycloak to the identity first login flows. By asking for the users identity first Keycloak can provide smarter decisions on how to authenticate