Skip to content

Instantly share code, notes, and snippets.

View ritou's full-sized avatar

Ryo Ito ritou

44 followers · 8 following
View GitHub Profile
@ritou
ritou / how_to_use_state_parameter_for_oauth2.md
Last active February 4, 2020 04:16

Application State

{
  "next_url":"/account/settings",
  ...
  "foo":"bar"
}
@ritou
ritou / oidcibademo.md
Last active June 14, 2019 08:55
@ritou
ritou / chrome75_pin.md
Created June 6, 2019 01:47

ChromeのFIDO CTAP2 PIN support動作確認メモ

Chrome 75 Beta: low latency canvas contexts, sharing files, and numeric separators

Web Authentication API: FIDO CTAP2 PIN support
This feature extends Chrome's implementation of the Web Authentication API to support local user authorization of security key operations via a user-defined PIN for keys that implement the FIDO CTAP2 protocol. Web sites using web authentication can request or require such authorization via the API's user verification mechanisms.

Registration

@ritou
ritou / WebAuthnKit_vs_WebAuthnLite.md
Created November 24, 2018 16:19
Interop result with WebAuthnKit and WebAuthnLite

Interop result with WebAuthnKit and WebAuthnLite. parameters is from https://github.com/lyokato/WebAuthnKit/blob/develop/utils/interop/go_koesie10_webauthn/main.go

iex(1)> origin = "https://example.org"
"https://example.org"
iex(2)> challenge = "rtnHiVQ7"
"rtnHiVQ7"
iex(3)> encoded_registration_client_data_json = "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoicnRuSGlWUTciLCJvcmlnaW4iOiJodHRwczpcL1wvZXhhbXBsZS5vcmcifQ"
"eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoicnRuSGlWUTciLCJvcmlnaW4iOiJodHRwczpcL1wvZXhhbXBsZS5vcmcifQ"
@ritou
ritou / client_side.html
Created March 1, 2013 17:02
This is Google+ Sign-In client-side sample.
<html>
<head>
<title>Google+ Sign-in button demo</title>
<style type="text/css">
html, body { margin: 0; padding:0;}
#signin-button {
padding: 5px;
}
#oauth2-results pre { margin: 0; padding:0;}
@ritou
ritou / jose_key_handling.md
Last active February 23, 2018 08:07 
＃ JOSE.JWK を用いて鍵を作成
iex(1)> jwk = JOSE.JWK.generate_key(:secp256r1)
%JOSE.JWK{
  fields: %{},
  keys: :undefined,
  kty: {:jose_jwk_kty_ec,
   {:ECPrivateKey, 1,
    <<37, 161, 110, 23, 211, 111, 64, 142, 98, 207, 153, 90, 139, 91, 212, 33,
@ritou
ritou / gist:7247476
Created October 31, 2013 10:26
$ cat test.pl
use strict;
use warnings;
use Authen::OATH;
use Data::Dumper;
my $oath = Authen::OATH->new();
my $totp = $oath->totp( "1234567890", 1332083784 );
print Dumper($totp);
@ritou
ritou / bad_password_check.pl
Created June 28, 2013 01:39
Test result fot Data::Password module.
#!/usr/bin/env perl
use strict;
use warnings;
use Data::Password qw(:all);
$DICTIONARY = 8;
$FOLLOWING = 0;
$FOLLOWING_KEYBOARD = 0;
@ritou
ritou / medy_openid.md
Created April 29, 2013 22:58

medyはOpenID Providerである

medyでログインしてるサービス

http://med.astrazeneca.co.jp/login/relogin.asp

ボタン押した後に送られるリクエスト

https://medy-id.jp/openid/endpoint.html?

openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&

@ritou
ritou / gist:5053810
Last active December 14, 2015 07:49

DM踏んだだけでアレな件はTwitterのOAuth実装がク○だと思う

これの話です。 http://togetter.com/li/463503

(追記 : この考察ではiframeでTwitterの認可URL指定してもX-Frame-Options設定されてるやんけ問題が未解決と思ったらなにやら更新されてたのでもう様子見)

前提条件

あくまでこれ前提で考えてます。間違ってたらごめんなさいね。