skills.rest
vaadin-developer
vaadin-developerOFFICIAL
Explore all skills by this author →
GitHub

jsentinel-vaadin-oidc-hardening

Implement JWE ID token decryption, mTLS, back-channel logout, and DPoP for OIDC Vaadin Flow apps.

2|Updated Jul 7, 2019
Search Tags:#mTLS#OIDC#security hardening#DPoP#Vaadin Flow#JWE#back-channel logout
One-click install
npx skills add https://github.com/vaadin-developer/security-for-flow --skill jsentinel-vaadin-oidc-hardening
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: jsentinel-vaadin-oidc-hardening
Source: https://github.com/vaadin-developer/security-for-flow/tree/main/docs/skills/claude/jsentinel-vaadin-oidc-hardening
Command: npx skills add https://github.com/vaadin-developer/security-for-flow --skill jsentinel-vaadin-oidc-hardening

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jSentinel-dpop, jSentinel-oauth2, jSentinel-jwt, jSentinel-identity-oidc, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill addresses the security vulnerabilities and weaknesses in an OIDC Vaadin Flow application by providing enhanced hardening measures for ID tokens, token endpoint authentication, back-channel logout, and access tokens.

Core Features & Use Cases

  • JWE ID Tokens: Decrypts and validates JWE-encrypted ID tokens for additional security.
  • mTLS Token-Endpoint Auth: Adds mutual TLS authentication to the token endpoint for secure communication.
  • Back-Channel Logout: Provides back-channel logout functionality for terminating sessions out-of-band.
  • DPoP: Generates sender-constrained access tokens for secure resource-server calls.
  • PAR/JAR Documentation: Offers documentation on implementing PAR and JAR for a PAR-aware flow.
  • Use Case: For a Vaadin Flow application using OIDC authentication, this Skill strengthens security against attacks by adding multiple layers of protection to the ID token handling, authentication, and access token management.

Quick Start

Enable the jsentinel-vaadin-oidc-hardening skill and configure the required features for your application.

Frequently Asked Questions about jsentinel-vaadin-oidc-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add mTLS authentication and DPoP access tokens to a Vaadin Flow OIDC application?▼

JWE ID token decryption adds an encryption layer to OIDC ID tokens, ensuring that only authorized clients with the correct decryption keys can access token claims, protecting sensitive user data in transit.

What is JWE ID token decryption and how does it secure OIDC authentication?▼

JWE ID token decryption adds an encryption layer to OIDC ID tokens, ensuring that only authorized clients with the correct decryption keys can access token claims, protecting sensitive user data in transit.

How do I implement back-channel logout in a Vaadin Flow app using OIDC?▼

This hardening approach integrates multiple layers of protection including JWE ID token decryption, mTLS token-endpoint auth, and DPoP access tokens, addressing broader security threats than standard OIDC configurations.

Do I need specific OAuth2 dependencies to use JWE and DPoP hardening with Vaadin Flow?▼

Yes, implementing these security measures requires specific OAuth2, JWT, DPoP, and OIDC identity dependencies to handle token decryption, sender-constrained access tokens, and secure authentication flows.

What is the best way to secure the token endpoint for a Vaadin Flow OIDC flow?▼

The best way to secure the token endpoint is by implementing mutual TLS (mTLS) client-auth, which requires both the client and server to present cryptographic certificates, preventing man-in-the-middle attacks.

Can I use PAR and JAR to secure authentication and authorization flows in Vaadin Flow?▼

Yes, you can use Pushed Authorization Requests (PAR) and JWT-Secured Authorization Requests (JAR) to create a PAR-aware flow, preventing request tampering and leaking during the OIDC authorization process.

Related Skills

Explore More Software Engineering Skills→
vaadin-developervaadin-developer
2

jsentinel-vaadin-persistence

Adds Eclipse Store persistence for Vaadin audit logs and sessions with token-based admin bootstrap.

Official
Advanced
Taek-DTaek-D

appintoss-login

Exchange OAuth2 tokens, decrypt user data, and issue session JWTs for AppsInToss login.

Community
Advanced
vaadin-developervaadin-developer
2

jsentinel-rest

Integrate jSentinel authentication and authorization into JDK-HttpServer REST applications.

Official
Intermediate
vaadinvaadin
11

security

Configure Spring Security integration for Vaadin 25 applications.

Official
Advanced