Examples

• password security
• 2FA authentication
• PGP encryption
• disk encryption
• ...

Securing plumber APIs?

• many dimensions¹, here: focus on Authorization and Authentication

¹https://www.rplumber.io/docs/security.html

Disclaimer

passport.js

passport.js

Consistent interface

1. specify and configure strategy Object, e.g. FacebookStrategy
   • optionally: write custom code for checking authentication
2. use passport.authenticate(), e.g. passport.authenticate('facebook') to authenticate calls to endpoints

R Memes for Statistical Fiends

frie.codes/rstatsmemes

frie.codes/rstatsmemes

frie.codes/rstatsmemes

Strategy configuration

• not implemented in sealr because unique to use case
• custom code needed
• but examples in /examples folder & in docs!

rstatsmemes: strategy configuration

pr$handle("POST", "/authentication", function (req, res, user = NULL, password = NULL) {
  # check if user provided credentials
  if (is.null(user) || is.null(password)) {
    res$status <- 404
    return(sealr::is_authed_return_list(FALSE, "Failed.", 404, "User or password wrong."))
  }
  # find user in database
  index <- match(user, users$user)
  # check if user exist
  if (is.na(index)) {
    res$status <- 401
    return(sealr::is_authed_return_list(FALSE, "Failed.", 401, "User or password wrong."))
  }
  # check if password is correct
  if (!bcrypt::checkpw(password, users$password[index])){
    res$status <- 401
    return(sealr::is_authed_return_list(FALSE, "Failed.", 401, "User or password wrong."))
  }

  # define jwt payload
  # information about the additional fields can be found at
  # https://tools.ietf.org/html/rfc7519#section-4.1
  payload <- jose::jwt_claim(userID = users$id[index])
  # convert secret to bytes
  secret_raw <- charToRaw(secret)
  # encode token using the secret
  jwt <- jose::jwt_encode_hmac(payload, secret = secret_raw)
  # return jwt as response
  return(jwt = jwt)
}, preempt = c("auth"))

rstatsmemes: sealr authenticate

• goal: protect /meme/<no>/stats, leave /meme unprotected

• filter(s): "[...] “pipeline” for handling incoming requests."¹

pr$filter("auth", function (req, res) {
  sealr::authenticate(req = req, # plumber object: the request from the user
                         res = res,  # plumber object: the response list
                           is_authed_fun = sealr::is_authed_jwt,  # checker fun
                         token_location = "header", secret = secret) 
                         # arguments passed to the checker function
})

• authenticate: small wrapper function.
• is_authed_fun (checker function): check whether authed
  • is_authed_jwt: can the JWT be decrypted, ...?
  • (is_authed_oidc_google: is this JWT a valid Google JWT, ...?)

¹https://www.rplumber.io/docs/routing-and-input.html#filters

rstatsmemes: Protect endpoints

pr$handle("GET", "/meme/<no>/stats", function(req, res, no){ 
  no <- as.integer(no)
  stats <- memes %>% 
    dplyr::filter(meme_number == no) %>% 
    dplyr::slice(1) %>% # make sure only one is returend
    dplyr::select(meme_number, shares_count, likes_count, comments_count)
  return(as.list(stats))
}, serializer = plumber::serializer_unboxed_json())

pr$handle("GET", "/meme", function(req, res){
  # get a random meme
  random_meme <- memes %>% 
    dplyr::sample_n(1) %>% 
    dplyr::select(meme_number, message, full_picture)
  return(as.list(random_meme))
}, serializer = plumber::serializer_unboxed_json(), 
   preempt = c("auth")
)

Plans for sealr

short-term

• finish / polish docs
• extend / another "real world" implementation

mid- / long-term

• develop more strategies
• provide more examples for strategy configuration (/authentication)
• provide tooling (docker image...)

How you can help

Talk to us! 💬

• use cases + real world set-ups

Try sealr!

• keep in mind the disclaimer!
• file issues / feature requests on GitHub

Write/review code

• review code / docs
• write code / docs
• provide examples

All you need to know!

• Slides: https://frie.codes/user2019_slides
• Demo: frie.codes/rstatsmemes/

• plumber website: rplumber.io
• sealr GitHub Repo: https://github.com/jandix/sealr
• Bookdown Docs (WIP): https://jandix.github.io/sealr
• Talk (code + slides): https://github.com/friep/sealr_useR2019