Systems | Development | Analytics | API | Testing

WSO2

Secure your apps with Proof Key for Code Exchange (PKCE) using WSO2 Identity Server #Identityin15

PKCE is an OAuth 2.0 security extension for public clients to avoid a malicious programme creeping from intercepting the authorisation code. In this episode of #IdentityIn15, we will be demonstrating how PKCE works with OAuth 2.0 Authorization Code Grant using the WSO2 Identity Server in just 15mins.

What I Learned from Building a Cloud-Native Frontend App for Asgardeo

Photo by Pixabay The world is progressing fast, especially when it comes to the tech industry. In the past, JavaScript was child’s play, condemned to lend some semblance of programmability to web pages. Today, it is taking us to space. At the start, WSO2 Identity Server was a fledgling identity solution reposed in your on-prem servers. Today, we are launching it to the cloud. Asgardeo has been a great achievement for our team.

Mock Implementation with Choreo Connect, WSO2 API Manager

In Choreo Connect 1.1.0 release, mock APIs are supported considering the API definition file. Users can define mock responses in Open API Specification 3 (OAS 3) or using Swagger definition. With the latest WSO2 API Manager 4.1.0 release, the relevant endpoint type for this API type is Mock Implementation Endpoint type. These APIs are manipulated under the pre-released API lifecycle state. With Choreo Connect API definition based mock implementations, you can define default responses, HTTP status code based responses, status code based preferred response retrievals.

Validate WSO2 API Manager gateway request with open policy agent

Open policy agent (OPA) enables you to write security and compliance policies as code, or call any external policies using the OPA standard. WSO2 API manager uses this capability to offload policy decisions of API gateway requests to this policy engine. By decoupling the policy enforcement from evaluation, API policymakers now have the opportunity to write dynamic and reusable policies for ever-changing requirements. You can then reuse an OPA policy like any other policy in the API Manager by graphically dragging and dropping it into a policy pipeline. This video explains how it works and gives a demo.

One-Time Authorization Code for REST APIs in WSO2 Identity Server

WSO2 Identity Server provides many identity management workflows and password management workflows out of the box, e.g., self-registration, user invitations, password recovery, etc. However, it is not unusual to come across a situation where the workflow capabilities provided out of the box in the product, is not sufficient to fulfill your business requirement.

Re-issue Existing Password Recovery Confirmation Code in Followed Recovery or Resend Requests

Photo by Micah Williams on Unsplash This article discusses a new feature which will be released for the public distribution of WSO2 Identity Server 5.12.0. This feature was developed to overcome the following scenario: You can refer to the following diagram for a deeper understanding of the above flow. This scenario can be experienced by anyone. As such, we introduced a new way to handle this scenario (as shown below) for the notification based password recovery flow.