Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

An external software provider is hosting a website for us. We supply the login functionality via a restfull api(login/password over ssl). But the website is also the client for OAuth resource that it can access. This would imply that the user of the website who is already logging in with it's website credentials should login again to the OAuth resource.

We would like to make it easy for the user. So what are the option to not make a double login?

As i understand OAuth correct, it is not a good idea to store the token. So is it possible with every restfull api login to also do a OAuth login and pass the token to the website?

share|improve this question

A user can login once and use OAuth, and this token can be used to access a 3rd party resource. This design is common, especially for webapps that want to tap into the Facebook API.

As a pentester I find nearly every OAuth implantation is in violation of at least one of OAuth's RFC security requirements. It is as if developers aren't even reading RFCs anymore * gasp *.

RFC-5839 section 4.5 states it acceptable to store the shared secret and OAuth token, as long as they not stored in plain-text. Hashing the credentials is preferred, however this token can be encrypted and retrieved without introducing a significant security threat or violating an RFC security requirement.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.