OAuth 2 – Implicit Grant

This is part of a series post about OAuth2. In this post, I go over the implicit grant type and how it relates and differs to the authorization code grant type.

Let’s look at a high-level only flow of the implicit grant flow via an example in which an application recommends a user movies based on the movies the user’s friends like on Facebook.

1. The user submits a request to the Movie app to get movie recommendations.
2. The app redirects the user to Facebook to authenticate.
3. The user authenticates with Facebook and gives consent for the Movie app to access the user’s Facebook data
4. Facebook sends back an access token to the Movie app via a redirect url.
5. The Movie app uses the access token to request the user’s Facebook data on behalf of the user and provide recommendations to the user.

For comparison, here’s the flow using the authorization code grant.

1. The user submits a request to the Movie app to get movie recommendations.
2. The app redirects the user to Facebook to authenticate.
3. The user authenticates with Facebook and gives consent for the Movie app to access the user’s Facebook data.
4. Facebook sends back an authorization code to the Movie app via a redirect url.
5. The Movie app submits another request to Facebook to request an access token,  passing its client credentials ( client id and secret ) as well as the authorization code obtained from step 4.
6. Facebook validates the client’s credentials and authorization code, then issues an access token and optionally a refresh token back to the Movie app.

As you can see at the surface level, the implicit flow is more or less similar to the authorization code flow except it does not have the step of authenticating the client. As we discuss when to choose the implicit grant type vs the authorization grant type , we’ll explore other differences between the two flows and see they are meant for different types of applications.

Continue reading

OAuth2 – Authorization Code Grant

OAuth2 has become the de facto in modern web application security.  If you are a front end, back end or mobile developer, chances are you have had to consume or secure  protected resources with OAuth2. As such, having a good understanding of OAuth2 is invaluable. When implementing or using OAuth2 in your application, you typically face with four different grant types. Knowing the differences between the four grant types and which one to use can be quiet confusing. In this blog post series, I go over the different grant types by providing examples. This post is part of the series about OAuth2. In this post,  I’ll cover the Authorization Code Grant and when it is appropriate to use it.

If you are not familiar with the jargons, this post may help.

Continue reading

Backend API with Spring Boot, Spring Data and Neo4j.

Spring Boot has made it simpler than ever to get setup with Neo4j. Pretty much the only dependency you need to get started is the spring-boot-starter-data-neo4j, which includes a number of other Spring dependencies for all Spring magics, and neo4j ogm dependencies.

Three key players involve in the configurations for connecting to neo4j and doing data access operations utilizing Spring: Transaction Manager, SessionFactory and Configuration.

Continue reading

Building backend API with Spring data, Hibernate, JPA.

In this post, I’ll go over the setup of a sample backend RESTful API which utilizes Spring and Hibernate to simplify database operations and transaction management over a relational database.

Source code is available on GitHub: https://github.com/taithienbo/bookapp

Continue reading

Neo4j slow query caused SSLException: SSL peer shut down incorrectly

Recently I ran into the exception “SSLException: SSL peer shut down incorrectly“. My thoughts when seeing the exception were that the neo4j instance went down, some connection parameters have changed, issues with SSL certificates etc …  I did not think the code had an issue because all the integration tests had passed, and I verified everything worked on my local machine.

After debugging for a few hours, I realized the issue was because of fetching too much data at once. I was using a query Spring Data Neo4j to fetch all nodes of a label with depth 3. Because some of the nodes were dense, the query kept on running and eventually took down the server.

MATCH (n:`NodeCategory`) WITH n ORDER BY n.order MATCH p=(n)-[*0..3]-(m) RETURN p

If you see the message “SSL peer shutdown incorrectly“, besides connection parameters and configurations, be sure to watch out for slow queries or long operations.