Download the full version of the textbook now at textbookfull.

com

OAuth 2 0 Cookbook Protect Your Web

Applications Using Spring Security Nascimento

https://textbookfull.com/product/oauth-2-0-
cookbook-protect-your-web-applications-using-
spring-security-nascimento/

Explore and download more textbook at https://textbookfull.com

 Recommended digital products (PDF, EPUB, MOBI) that
you can download immediately if you are interested.

Web API Cookbook Level Up Your JavaScript Applications Joe

Attardi

https://textbookfull.com/product/web-api-cookbook-level-up-your-
javascript-applications-joe-attardi/

textbookfull.com

Spring Boot 2 0 Projects Build production grade reactive

applications and microservices with Spring Boot English
Edition Mohamed Shazin Sadakath
https://textbookfull.com/product/spring-boot-2-0-projects-build-
production-grade-reactive-applications-and-microservices-with-spring-
boot-english-edition-mohamed-shazin-sadakath/
textbookfull.com

Pro Spring Security: Securing Spring Framework 5 and Boot

2-based Java Applications 2nd Edition Carlo Scarioni

https://textbookfull.com/product/pro-spring-security-securing-spring-
framework-5-and-boot-2-based-java-applications-2nd-edition-carlo-
scarioni/
textbookfull.com

Unmanned Aircraft System Traffic Management (UTM) 1st

Edition Michael Scott Baum

https://textbookfull.com/product/unmanned-aircraft-system-traffic-
management-utm-1st-edition-michael-scott-baum/

textbookfull.com
Rediscovering Travel A Guide for the Globally Curious 1st
Edition Seth Kugel

https://textbookfull.com/product/rediscovering-travel-a-guide-for-the-
globally-curious-1st-edition-seth-kugel/

textbookfull.com

Jewish Exiles’ Psychological Interpretations of Nazism

Avihu Zakai

https://textbookfull.com/product/jewish-exiles-psychological-
interpretations-of-nazism-avihu-zakai/

textbookfull.com

Energy Minimization Methods in Computer Vision and Pattern

Recognition 10th International Conference EMMCVPR 2015
Hong Kong China January 13 16 2015 Proceedings 1st Edition
Xue-Cheng Tai
https://textbookfull.com/product/energy-minimization-methods-in-
computer-vision-and-pattern-recognition-10th-international-conference-
emmcvpr-2015-hong-kong-china-january-13-16-2015-proceedings-1st-
edition-xue-cheng-tai/
textbookfull.com

Machine Learning Engineering in Action MEAP V04 Ben T

Wilson

https://textbookfull.com/product/machine-learning-engineering-in-
action-meap-v04-ben-t-wilson/

textbookfull.com

Positive Psychology and Change How Leadership

Collaboration and Appreciative Inquiry Create
Transformational Results 1st Edition Lewis
https://textbookfull.com/product/positive-psychology-and-change-how-
leadership-collaboration-and-appreciative-inquiry-create-
transformational-results-1st-edition-lewis/
textbookfull.com
Sustainable Biofuels Development in India 1st Edition Anuj
K. Chandel

https://textbookfull.com/product/sustainable-biofuels-development-in-
india-1st-edition-anuj-k-chandel/

textbookfull.com
OAuth 2.0 Cookbook

Protect your web applications using Spring Security

Adolfo Eloy Nascimento

BIRMINGHAM - MUMBAI
OAuth 2.0 Cookbook

Copyright © 2017 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted
in any form or by any means, without the prior written permission of the publisher, except in the case of
brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information
presented. However, the information contained in this book is sold without warranty, either express or
implied. Neither the author, nor Packt Publishing, and its dealers and distributors will be held liable for
any damages caused or alleged to be caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and
products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot
guarantee the accuracy of this information.

First published: October 2017

Production reference: 1161017

Published by Packt Publishing Ltd.

Livery Place
35 Livery Street
Birmingham
B3 2PB, UK.

ISBN 978-1-78829-596-3

www.packtpub.com
Credits
Copy Editors
Author
Juliana Nair
Adolfo Eloy Nascimento
Stuti Srivastava

Reviewer Project Coordinator

Rafael Monteiro e Pereira Judie Jose

Commissioning Editor Proofreader

Vijin Boricha Safis Editing

Acquisition Editor Indexer

Rahul Nair Francy Puthiry

Content Development Editor Graphics

Nikita Pawar Kirk D'Penha

Technical Editor Production Coordinator

Prachi Sawant Nilesh Mohite

About the Author

Adolfo Eloy Nascimento is a software engineer at Elo7, he has a Bachelors degree in Computer
Science, and has been working with software development since 1999. In around 2003, he started
working with web development implementing applications using ASP, PHP4/5, JavaScript, and Java
(sometimes he still does some maintenance for a Ruby on Rails application). He started using OAuth
2.0 two years ago, when designing applications using microservice architectures, as well as modeling
and interacting with public APIs.

As a tech enthusiast, Adolfo also likes to read and learn about programming languages and new
technologies. He also believes that besides creating new applications, it is also important to share the
knowledge he has acquired, which is what he does by writing for his personal blog, writing articles for
Java Magazine in Brazil, and also writing tech books.

I would like to thank Janine for all her support and understanding during the writing of this book.
Without her support it wouldn't have been possible. In addition, I would like to thank my parents who
gave me great support in education. I would also like to thank Rafael Monteiro for accepting the
reviewing of this book and improving the quality of each chapter. Finally, I would like to thank the Packt
team, especially Rahul and Nikita, for helping me during the whole process of writing this book.
Visit https://textbookfull.com
now to explore a rich
collection of eBooks, textbook
and enjoy exciting offers!
About the Reviewer
Rafael Monteiro e Pereira is a graduate in Computer Science from Mackenzie University in São
Paulo, Brazil. He has always liked developing mission-critical and high-performance software. He also
likes software security, especially playing with Kali Linux and its amazing set of tools. There is always
a new vulnerability out there waiting to be discovered; this is what he believes.

He worked for the startup Elo7 as a big data/search software engineer and for companies in the
finance/banking sector, such as BM&F Bovespa, developing their trading platform, and for Itaú-
Unibanco as a lead software engineer on their new big data platform.
www.PacktPub.com
For support files and downloads related to your book, please visit www.PacktPub.com.

Did you know that Packt offers eBook versions of every book published, with PDF and ePub files
available? You can upgrade to the eBook version at www.PacktPub.com and as a print book customer, you
are entitled to a discount on the eBook copy. Get in touch with us at service@packtpub.com for more details.

At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a range of free
newsletters and receive exclusive discounts and offers on Packt books and eBooks.

https://www.packtpub.com/mapt

Get the most in-demand software skills with Mapt. Mapt gives you full access to all Packt books and
video courses, as well as industry-leading tools to help you plan your personal development and
advance your career.
Why subscribe?
Fully searchable across every book published by Packt
Copy and paste, print, and bookmark content
On demand and accessible via a web browser
Customer Feedback
Thanks for purchasing this Packt book. At Packt, quality is at the heart of our editorial process. To help
us improve, please leave us an honest review on this book's Amazon page at https://www.amazon.com/dp/17882
9596X.

If you'd like to join our team of regular reviewers, you can e-mail us at customerreviews@packtpub.com. We
award our regular reviewers with free eBooks and videos in exchange for their valuable feedback. Help
us be relentless in improving our products!
Table of Contents
Preface
What this book covers
What you need for this book
Who this book is for
Sections
Getting ready
How to do it…
How it works…
There's more…
See also
Conventions
Reader feedback
Customer support
Downloading the example code
Downloading the color images of this book
Errata
Piracy
Questions
1. OAuth 2.0 Foundations
Introduction
Preparing the environment
Getting ready
How to do it...
See also
How it works...
There's more...
See also
Reading the user's contacts from Facebook on the client side
Getting ready
How to do it...
How it works...
There's more...
See also
Reading the user's contacts from Facebook on the server side
Getting ready
How to do it...
How it works...
There's more...
See also
Accessing OAuth 2.0 LinkedIn protected resources
Getting ready
How to do it...
How it works...
There's more...
 See also
Accessing OAuth 2.0 Google protected resources bound to the user's session
Getting ready
How to do it...
How it works...
There's more...
See also
2. Implementing Your Own OAuth 2.0 Provider
Introduction
Protecting resources using the Authorization Code grant type
Getting ready
How to do it...
How it works...
There's more...
Supporting the Implicit grant type
Getting ready
How to do it...
How it works...
There's more...
See also
Using the Resource Owner Password Credentials grant type as an approach for OAuth 2.0 migration
Getting ready
How to do it...
How it works...
There's more...
See also
Configuring the Client Credentials grant type
Getting ready
How to do it...
How it works...
There's more...
See also
Adding support for refresh tokens
Getting ready
How to do it...
How it works...
There's more...
See also
Using a relational database to store tokens and client details
Getting ready
How to do it...
How it works...
There's more...
See also
Using Redis as a token store
Getting ready
How to do it...
Visit https://textbookfull.com
now to explore a rich
collection of eBooks, textbook
and enjoy exciting offers!
 How it works...
See also
Implementing client registration
Getting ready
How to do it...
How it works...
See also
Breaking the OAuth 2.0 Provider in the middle
Getting ready
How to do it...
How it works...
See also
Using Gatling to load test the token validation process using shared databases
Getting ready
How to do it...
How it works...
See also
3. Using OAuth 2.0 Protected APIs
Introduction
Creating an OAuth 2.0 client using the Authorization Code grant type
Getting ready
How to do it...
How it works...
Creating an OAuth 2.0 client using the Implicit grant type
Getting ready
How to do it...
How it works...
There's more...
See also
Creating an OAuth 2.0 client using the Resource Owner Password Credentials grant type
Getting ready
How to do it...
How it works...
There's more...
See also
Creating an OAuth 2.0 client using the Client Credentials grant type
Getting ready
How to do it...
How it works...
See also
Managing refresh tokens on the client side
Getting ready
How to do it...
How it works...
See also
Accessing an OAuth 2.0 protected API with RestTemplate
Getting ready
 How to do it...
How it works...
See also
4. OAuth 2.0 Profiles
Introduction
Revoking issued tokens
Getting ready
How to do it...
How it works...
Remote validation using token introspection
Getting ready
How to do it...
How it works...
There's more...
Improving performance using cache for remote validation
Getting ready
How to do it...
How it works...
See also
Using Gatling to load test remote token validation
Getting ready
How to do it...
There's more...
See also
Dynamic client registration
Getting ready
How to do it...
How it works...
There's more...
See also
5. Self Contained Tokens with JWT
Introduction
Generating access tokens as JWT
Getting ready
How to do it...
How it works...
See also
Validating JWT tokens at the Resource Server side
Getting ready
How to do it...
How it works...
There's more...
See also
Adding custom claims on JWT
Getting ready
How to do it...
How it works...
 See also
Asymmetric signing of a JWT token
Getting ready
How to do it...
How it works...
See also
Validating asymmetric signed JWT token
Getting ready
How to do it...
How it works...
See also
Using JWE to cryptographically protect JWT tokens
Getting ready
How to do it...
How it works...
See also
Using JWE at the Resource Server side
Getting ready
How to do it...
How it works...
See also
Using proof-of-possession key semantics on OAuth 2.0 Provider
Getting ready
How to do it...
How it works...
There's more...
See also
Using proof-of-possession key on the client side
Getting ready
How to do it...
How it works...
See also
6. OpenID Connect for Authentication
Introduction
Authenticating Google's users through Google OpenID Connect
Getting ready
How to do it...
How it works...
See also
Obtaining user information from Identity Provider
Getting ready
How to do it...
How it works...
There's more...
See also
Using Facebook to authenticate users
Getting ready
 How to do it...
How it works...
See also
Using Google OpenID Connect with Spring Security 5
Getting ready
How to do it...
How it works...
See also
Using Microsoft and Google OpenID providers together with Spring Security 5
Getting ready
How to do it...
How it works...
See also
7. Implementing Mobile Clients
Introduction
Preparing an Android development environment
Getting ready
How to do it...
How it works...
Creating an Android OAuth 2.0 client using an Authorization Code with the system browser
Getting ready
How to do it...
How it works...
There's more...
See also
Creating an Android OAuth 2.0 client using the Implicit grant type with the system browser
Getting ready
How to do it...
How it works...
See also
Creating an Android OAuth 2.0 client using the embedded browser
Getting ready
How to do it...
How it works...
See also
Using the Password grant type for client apps provided by the OAuth 2 server
Getting ready
How to do it...
How it works...
There's more...
See also
Protecting an Android client with PKCE
Getting ready
How to do it...
How it works...
See also
Using dynamic client registration with mobile applications
 Getting ready
How to do it...
How it works...
See also
8. Avoiding Common Vulnerabilities
Introduction
Validating the Resource Server audience
Getting ready
How to do it...
How it works...
Protecting Resource Server with scope validation
Getting ready
How to do it...
How it works...
Binding scopes with user roles to protect user's resources
Getting ready
How to do it...
How it works...
See also
Protecting the client against Authorization Code injection
Getting ready
How to do it...
How it works...
Protecting the Authorization Server from invalid redirection
Getting ready
How to do it...
How it works...
Random documents with unrelated
content Scribd suggests to you:
350.
Michael Glycas, Βίβλος χρονική, ed. Labbe; Paris, 1660, p.
135.

351.
Georgius Cedrenus, Σύνοψις ἱστοριῶν, ed. Goar; Paris, 1647,
t. i. p. 27.

352.
Josephus Ben-Gorion, lib. vi. c. 35, apud Fabricium, i. p. 326.

353.
S. Epiphanius Hæresi, lv. c. 2.

354.
Talmud, Tract. Bava Bathra.

355.
Tabari, i. c. liii.

356.
Tabari; Weil, Abulfeda, pp. 25-27, &c.

357.
Or El Khoudr; he is identified in Arab legend with S. George
and Elias.

358.
Weil, pp. 94-6.

359.
Tabari, i. p. 181.

360.
Maschmia Jeschua, fol. 19, col. 4.

361.
Nezach Israel, fol. 25, col. 3.
362.
Eisenmenger, ii. pp. 260, 304.

363.
Gen. xxv. 22.

364.
Jer. i. 5.

365.
Bereschith Rabba, fol. 56, col. 2.

366.
Eisenmenger, i. 646.

367.
Ibid.

368.
Ibid., pp. 650-1.

369.
Targums. ed. Etheridge, i. p. 240.

370.
Ibid., p. 241.

371.
Ibid., also R. Bechai’s Comment. on the Five Books of Moses,
fol. 35, col. i.

372.
Targum of Palestine and Jerusalem; Etheridge, i. 241, 242. The
book Yaschar says the deed of transfer was written by Jacob
on a leaf, and that he and Esau sealed it, p. 1151.

373.
Eisenmenger, i. p. 651.
374.
Gen. iii. 21.

375.
Yaschar, p. 1150, where is the story of the assassination of
Nimrod by Esau.

376.
Ibid.

377.
Eisenmenger, ii. p. 879.

378.
Eisenmenger, ii. p. 262.

379.
Targums, i. p. 250.

380.
Targums, i. p. 252.

381.
Pirke R. Eliezer, c. 35.

382.
William Sanderson, Vita Mariæ, reg. Scot., et Jacobi, reg.
Anglorum; also Beckmann, Notitiar. dignit. Dissert. 3, c. i. § 7.

383.
The whole of the above is from the Targumim.

384.
Jalkut Cadasch, fol. 81, col. 1; Yaschar, p. 1161 et seq.

385.
Eisenmenger, i. p. 486.
386.
Jalkut Rubeni, fol. 61, col. 3.

387.
Jalkut Cadasch, fol. 91, col. 4.

388.
Targum of Palestine, i. p. 272.

389.
Jacob prepared three things against Esau—War, Gifts, and
Prayer—as a token to all men that they must overcome evil by
Resistance, by Alms, and by Supplication. (R. Bechai, Comm.
on the Five Books of Moses, fol. 42, col. 4.)

390.
Jalkut Rubeni, fol. 62, col. 2.

391.
Bereschith rabba, fol. 71, col. 1 (70th Parascha).

392.
Bereschith rabba, fol. 67, col. 1.

393.
Jalkut Cadasch, fol. 90, col. 3.

394.
Eisenmenger, i. p. 325.

395.
Tabari, i. p. 206.

396.
Gen. xxxiii. 20.

397.
Jalkut Cadasch, fol. 91, col. 3.
398.
Yaschar, pp. 1167, 1168.

399.
D’Herbelot, Bibliothèque Orientale, s. v. Ais, i. p. 142.

400.
This was Sammael, and he complained to God that Jacob had
neglected the duty of hospitality, therefore he was suffered to
afflict him for a season.

401.
Tabari, i. p. 210.

402.
Targums, i. p. 287.

403.
Tabari, i. p. 211.

404.
Targums, i. p. 288. The account of the sale in Yaschar is very
long, and full of details too numerous for insertion here (pp.
1185-8.)

405.
Tabari, i. p. 212.

406.
Targums, i. 289.

407.
Weil, p. 102.

408.
Yaschar, tr. Drachs, p. 1192.

409.
Tabari, i. pp. 213, 214.
410.
Targums, i. 288.

411. Yaschar, pp. 1188-9; Parrascha Wajescheb. This touching

incident is common to Rabbinic and Mussulman traditions. It
has been gracefully versified by Dr. Le Heris, “Sagen aus der
Orient;” Mannheim, 1852.

412.
His name in Arabic is Aziz.

413.
Zuleika is the name in Yaschar; it is that also given her by the
Arabs.

414.
Tract. Sota., fol. 36, col. 2. The original account of this final
detail is too absurd and monstrous to be narrated more
particularly.

415.
Tabari, i. p. 217.

416.
Yaschar, p. 1197. Nearly all these incidents in the life of Joseph
are common to Jewish and Mussulman traditions.

417.
Tabari, p. 220; Weil, p. 112; both taken from the Rabbinic story
in Yaschar, p. 1195.

418.
Weil, p. 113.

419.
Targums, i. pp. 296-9; Midrash, fol. 45; Yaschar, p. 1200.
420.
Midrash, fol. 45.

421.
Weil, p. 116; Tabari, i. c. 44; Gen. xli.; Yaschar, pp. 1202-8.

422.
This conclusion of the loves of Zuleika and Joseph completes
the romance, and makes it a most popular subject for poets in
the East. Both Jewish and Mussulman traditions give Zuleika a
very different character from that which Holy Scripture leads
one to attribute to her.

423.
Midrash, Jalkut, fol. 46.

424.
Ibid.

425.
Weil, p. 122.

426.
Tabari, i. p. 247; taken from the Rabbinic Yaschar (Sepher
Hajaschar), p. 1226.

427.
Midrash, Jalkut, fol. 47; Yaschar, p. 1225; Berescheth Rabba,
fol. 84, col. 4.

428.
Yaschar, p. 1226.

429.
This was the shirt given Abraham by Gabriel, to preserve him
from the fire into which Nimrod cast him; it was fragrant with
the odours of Paradise.
430.
Koran, Sura xii.; Tabari, i. pp. 250, 251.

431.
Yaschar, p. 1227.

432.
Vita Asseneth, filiæ Potipharis; a Greek apocryphal book, in
Fabricius, iii. p. 85.

433.
Lib. de Mensuris et Ponderibus, § 10.

434.
Ephes. v. 14.

435.
Thess. ii. 16.

436.
Commen. in Eph. loc. cit.

437.
Prolog. in fin. Duarum Hom. in Cant. Canticorum.

438.
Matt. Paris, Chronicle, ed. Bohn, vol. i. pp. 437, 438.

439.
T. i., pp. 496-759.

440.
Koran, Sura xxxviii. v. 43-4. Job in Arabic is Aïub.

441.
Eisenmenger, ii. p. 439.

442.
Tabari, i. p. 256.
443.
Maï (Angelus), Test. Job; Romæ, 1839.

444.
Maï (Angelus), Test. Job; Romæ, 1839.

445.
In the “Testament of Job” she is called Sitis.

446.
Tabari, i. c. lxvi; Abulfeda, pp. 27-29.

447.
Testament of Job.

448.
Koran, Sura xxi. v. 83.

449.
Koran, Sura xxxviii. v. 41.

450.
Tabari, i. p. 263.

451.
Koran, Sura xxxviii. v. 43.
452.
Tabari, i. c. lxvii; Abulfeda, p. 31.

453.
The early portion of the life of Moses has been elaborated from
Rabbinic sources by Dr. B. Beer. Unfortunately he died before
the work was completed, and it has been published as a
fragment by his friend, G. Wolf. It extends only as far as his
marriage with Zipporah. (Leben Moses nach Auffassung der
Jüdischen Sage, von Dr. B. Beer; ein Fragment. Leipzig, 1863.)
It is, for the most part, compiled from the Sepher Hajasher, or
Book of Jasher.

454.
Yaschar, pp. 1241-53. The history of Zepho is quite a romance,
too long for insertion here.

455.
Yaschar, pp. 1248, 1249; 1253, 1254.

456.
Ibid., p. 1255.

457.
Midrash, fol. 51; Yaschar, p. 1157.

458.
Midrash Jalkut, fol. 52; Yaschar, pp. 1257-9.

459.
The curious passages, Isaiah vii. 15, 22, may allude to this
tradition.

460.
Moses’s life was shortened because he brought water out of
the rock contrary to God’s command (Numb. xxvii. 14), striking
the rock instead of speaking to it.
461.
Beer, pp. 112-6.

462.
Some authorities say that Jochebed, when thrust away,
married Eliphazan, the son of Parnach (Numb. xxxiv. 25), and
bare him two sons, Eldad and Medad (Numb. xi. 25); but
others, with more probability, assert that she married Eliphazan
after the death of Amram. (Yaschar, p. 1259.)

463.
Yaschar, p. 1260.

464.
Targum of Palestine, i. p. 446.

465.
Rabboth, fol. 118a.

466.
Exod. xv. 1.

467.
The Arabic name for her is Asia; Yaschar, p. 1261.

468.
Targum of Palestine, i. p. 446; Yaschar, p. 1261.

469.
Midrash, fol. 51.

470.
Midrash, fol. 51; Yaschar, p. 1262.

471.
Midrash, fol. 52; Yaschar, p. 1263.
472.
According to another version, it was Jethro who advised that
the child should be proved with the basins of rubies and coals.
(Rabboth, fol. 118 b; Yaschar, pp. 1263, 1264.)

473.
Exod. iv. 10.

474.
Beer, pp. 26-42. Abulfaraj says that Jannes and Jambres were
the tutors of Moses in his youth (Hist. Dynast., p. 17).

475.
Yaschar, p. 1265.

476.
Yaschar, p. 1265.

477.
Yaschar, p. 1263.

478.
Parascha of R. Solomon Jaschi, on Exod. ii. 12; also Targums
of Palestine and Jerusalem, i. p. 447; Yaschar, pp. 1265, 1266.

479.
Pirke R. Eliezer, c. 40; Rabboth, fol. 119a; Yaschar, p. 1266.

480.
This illustrates the passage 2 Kings ix. 13.

481.
Midrash, fol. 52; Yaschar, pp. 1265-1274.

482.
These were two of his seven names.
483.
It may be noticed in this as in several other instances, such as
those of Rebekah and Rachel, the Rabbis have invented
stories to explain the circumstance of the damsels watering the
flock, which they supposed derogated from their dignity. This
indicates the late date of these traditions, when the old pastoral
simplicity was lost.

484.
Pirke R. Eliezer, c. 40; Yaschar, p. 1274.

485.
The Targum of Palestine, “ten years;” i. p. 448.

486.
Beer, pp. 42-62; Pirke R. Eliezer. The Targum of Palestine says
the rod was in the chamber of Jethro, not in the garden; i. p.
448. Yaschar, pp. 1277, 1278.

487.
Rabbot., fol. 120 a. It is possible that our Blessed Lord’s
parable of the Good Shepherd may contain an allusion to this
popular and beautiful tradition.

488.
Gen. iii. 4. It was the angel Zagnugael who appeared and
spoke to him from the bush. (Targum of Palestine, i. p. 449;
Abulfeda, p. 31.)

489.
Exod. iv. 14.

490.
Tabari, i. c. lxxiii. p. 24.

491.
Midrash, fol. 54.
492.
Targum of Palestine, i. p. 460.

493.
Yaschar, p. 1280.

494.
Tabari, p. 326.

495.
Some say that Pharaoh entreated Moses to spare him for the
sake of Asia (Bithia), and that at the mention of his name
Moses was softened. (Weil, p. 159.)

496.
In Arabic, Risam and Rijam; and Shabun and Gabun, in
Persian.

497.
Midrash, fol. 56. The Targums say that the enchanters turned
the water of Goshen into blood, so that there was no water to
the Israelites as to the Egyptians; i. p. 462.

498.
Midrash, fol. 55.

499.
Targum of Palestine, i. p. 463.

500.
Venomous insects (Kalma), gnats (Kinnim). See Wisdom xvi. 1,
3.

501.
Targums, i. 464.

502.
Targums, i. p. 467.
503.
Ibid., i. p. 471.

504.
Yaschar, p. 1283.

505.
Tabari, i. p. 338.

506.
Weil, p. 165.

507.
Talmud, Sota. fol. 13.

508.
Targum of Palestine, i. p. 478.

509.
Targums, i. p. 475.

510.
Ibid., i. p. 485.

511. Targum of Jerusalem, i. p. 488; Yaschar, p. 1287.

512.
Exod. xiv. 13, 14.

513.
Koran, Sura xxvi. v. 63.

514.
Weil, p. 168; see also Midrash, fol. 176.

515.
Exod. xv. 21.
516.
Tabari, p. 350.

517.
Ibid. i. p. 355.

518.
Both the Rabbis and the Mussulmans lay the blame, not on
Aaron, but on another. The Rabbis say it was Micah who made
the calf; the Mussulmans call him Samiri. (Weil, p. 170.)

519.
Targum of Palestine, i. p. 552.

520.
Tabari, i. p. 362.

521.
Targum of Palestine, ii. p. 685.

522.
Pirke R. Eliezer, c. 45.

523.
Weil, pp. 172, 173.

524.
Koran, Sura vii. v. 139.

525.
Tabari, i. p. 364.

526.
Ibid., i. c. lxxv.

527.
Targum of Palestine, i. p. 561.
528.
Jalkut Rubeni, fol. 117, col. 1.

529.
Jalkut Rubeni, fol. 107, cols. 2, 3.

530.
Ibid., fol. 107, col. 3.

531.
Tabari, i. p. 371; also Midrash, fol. 30.

532.
Parascha R. Bechai, fol. 116.

533.
Talmud, Tract. Hajada, fol. 12, col. 2.

534.
Talmud, Tract. Joma, fol. 75, col. 1.

535.
This is sanctioned by Scripture: “Thou feddest Thine own
people with angels’ food, and didst send them from heaven
bread prepared without their labour, able to content every
man’s delight, and agreeing to every taste.” (Wisdom, xvi. 20.)

536.
Talmud, Tract. Joma, fol. 75, col. 1; Schemoth Rabba, fol. 115,
col. 4.

537.
To this tradition perhaps David refers, Ps. xxiii. 5, lxxviii. 19.

538.
Targum of Palestine, i. pp. 499, 500.

539.
Jalkut Shimoni, fol. 73, col. 4.
540.
Targum of Palestine, i. pp. 501, 502.

541.
Tabari, i. p. 393.

542.
Koran, Sura ii. v. 54.

543.
Tabari, i. p. 394; but also Deut. viii. 4, Nehemiah ix. 21.

544.
1 Cor. x. 4.

545.
Tabari, i. p. 373.

546.
See my “Curious Myths of the Middle Ages,” article on S.
George. I have no doubt whatever that El Khoudr, identified by
the Jews with Elias, is the original of the Wandering Jew. I did
not know this when I wrote on the “Wandering Jew” in my
“Curious Myths,” but I believe this to be the key to the whole
story.

547.
Weil, pp. 176-81; Tabari, i. c. lxxvi.; Koran, Sura xviii.

548.
Voltaire has taken this legend as the basis of his story of
“Zadig.”

549.
Targums, ii. pp. 380, 381.

550.
Weil, p. 175.
551.
Targums, ii. p. 382.

552.
Weil, p. 176.

553.
Targums, ii. p. 386.

554.
Tract. Kethuvoth, fol. 111, col. 2.

555.
Targum of Palestine, ii. p. 390.

556.
Targums, ii. p. 391.

557.
Tabari, i. c. lxxvii.; Weil, pp. 182, 183; Abulfeda, p. 33.

558.
Eisenmenger, ii. p. 305. Possibly the passage Zech. ix. 11, 12,
may contain an allusion to this tradition.

559.
Ibid., p. 342.

560.
Pirke R. Eliezer, c. 45.

561.
Perhaps the passage Isai. xl. 4 may be an allusion to this
tradition.

562.
Talmud, Tract. Beracoth, fol. 54, col. 2; Targum of Palestine, ii.
pp. 411-13.
563.
Talmud, Tract. Beracoth, fol. 54, col. 2; Targums, ii. p. 416;
Yaschar, p. 1296.

564.
Talmud, Tract. Sopherim, fol. 14, col. 4.

565.
Ibid., Tract. Nida, fol. 24, col. 2.

566.
Jalkut Cadasch, fol. 16, col. 2.

567.
Eisenmenger, i. p. 389.

568.
Talmud, Tract. Sopherim, fol. 14, col. 4.

569.
Tabari, i. p. 398.

570.
Gen. xxxi. 51.

571.
Targums, ii. pp. 419-21.

572.
Targums, ii. pp. 432-3.

573.
Ibid., pp. 434-5.

574.
Jalkut, fol. 240; Rabboth, fol. 275, col. 1; Midrash, fol. 285.

575.
Weil, p. 185.