1
vote
1answer
25 views

Using OAuth 2.0 without token storage

I am building a system for a product which requires Authentication and Authorization. Naturally I have chosen using OAuth 2.0 as it is a commonly used protocol and has proven to be useful. I am ...
1
vote
1answer
57 views

Can Facebook login to my app?

This sounds maybe like a stupid question, but I'm wondering myself if this is theoretically possible. Let's say I'm using Facebook login in my app. If the login is successful I get I get back an ...
1
vote
1answer
42 views

Is it safe to store important data in an encrypted access token?

Is it safe to store important data in an encrypted access token? For example, instead of storing access tokens in a database, not storing them at all and putting their associated data into them before ...
3
votes
2answers
301 views

Secure REST API and Single Page App by using external OAuth 2 Authorization Code

I am trying to understand how to implement an OAuth 2 Authorization Code flow when having both a single page JS app and a REST API. The aim is to secure access to the REST API by offloading ...
0
votes
0answers
52 views

OAuth2 vs. JSON authentication

1) To what extent is OAuth2 more secure than JSON authentication (both over SSL)? The context is a client (one server) querying another server (via API) within a local network using RESTFul. Prior to ...
4
votes
1answer
543 views

What are the dangers of allowing “less secure apps” to access my Google account?

According to https://support.google.com/accounts/answer/6010255: Google may block sign in attempts from some apps or devices that do not use modern security standards. Since these apps and devices ...
3
votes
1answer
279 views

Compromised JSON Web Token (JWT) Bearer Token

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
1
vote
1answer
74 views

Auth / Login token schema

According to this answer, a valid login token schema would consist of the username (U) the time of issuance (T) and secret key K owned by the server only The suggestion then is to concatenate the ...
1
vote
3answers
440 views

OAuth2 - Resource Owner Password Credentials grant

The OAuth2 spec describes the Resource Owner Password Credentials grant type and authorisation flow here. I understand that only 'trusted' client applications would be allowed to use this grant, for ...
0
votes
2answers
108 views

Steps to create user authentication system between mobile and server

First time doing a secure login from a mobile app to a server (built in java). I want to understand if I got this right. Login in for the first time: 1. On the mobile device hardcode a security ...
0
votes
0answers
117 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
6
votes
4answers
1k views

Is 'Bring your own Identity' as the only authentication option a valid practice?

This question is mainly aimed at OpenID Connect, when it is fully realized. I understand the aversion to signing in with a social networking site, but from what I understand about OIDC, its supposed ...
2
votes
1answer
485 views

Facebook oAuth2 for Javascript client application

When implementing Facebook login using oAuth2 (the Javascript version), I receive an access token back from the Facebook auth server. So far so good. The problem I have is that I want to implement a ...
2
votes
1answer
82 views

Using OAuth as Security For E-Commerce Sites

I need some help in understanding the security risks if I want to use OAuth 2.0 (Facebook, Twitter and G+) as standard login provider for an E-Commerce site. Keeping in mind that I will not be saving ...
1
vote
1answer
147 views

Confused about the most relevant way to secure my APIs

I own a Javascript application (Single Page Application) hitting some apis from my own RESTful backend. What I expect for my authentication/(authorization) mechanism is three things: Preventing ...
1
vote
0answers
290 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
3
votes
1answer
285 views

Is OAuth always the right choice (and when isn't it)

So I am reluctant to ask too much of a noob question, as this guy aked about a non-standard approach and got down voted a bunch, but here goes. I am creating a mobile application which needs to ...
4
votes
1answer
725 views

Does it make sense to implement OAuth when no 3rd party is involved

I own a REST API at server side and a distinct web application that would call those APIs. I want to secure my APIs calls. After some reading, I want to implement the OAuth 1.0a mechanism at server ...
1
vote
0answers
487 views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...
2
votes
1answer
262 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
1
vote
1answer
48 views

If a site says its API for login can't be made available for “Security Reasons” should I be worried

Stack Exchange API 2.2 is finally out, (Yay!) Reading through the linked blog post, i notice the line: Login methods that don’t use OAuth can’t be made public for security reasons. Is this ...
3
votes
1answer
303 views

OAuth2 with client credentials v/s other auth mechanisms

For a REST API against which clients would be writing non-browser based, non-interactive applications, if OAuth2 is the authentication mechanism to be followed, then we would use the client ...
2
votes
2answers
277 views

Ways to authenticate client with a server

I have an app that sends an encrypted message to the server, with the sender and recipient username attached. The usernames are each linked to a unique device ID that allows messages to be sent to ...
1
vote
0answers
231 views

Implementing OAuth flow in JavaScript

I am making a custom auth flow for the application. It is inspired by OAuth 2.0. Dev sends user to an auth page on my domain, passing callback_url and api_id. I redirect user to callback_url, passing ...
3
votes
2answers
1k views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User ...
11
votes
2answers
6k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
4
votes
1answer
290 views

Oauth Consumer Secret?

Using OAuth you have a consumer key and consumer secret to identify your application and the user provides an OAuth access token and secret to authenticate your application access to their account, ...
0
votes
2answers
942 views

Google Authenticator - Counter Based [duplicate]

I'm trying to understand How google authenticator - counter based work. I have tried googling around finding a demo or at least how this work. I understand its a one time password but not like TOTP. I ...
0
votes
1answer
339 views

Secure API access over SSL using oauth token

On the project that i'm currently working, we authenticate the clients by username and password. In this system each user has a key which is calculated from his password. However, we want to provide ...
5
votes
1answer
188 views

Are most app OAuth implementations vulnerable because of an obscured URL/origin?

I cringe every time I am prompted with OAuth in an app because of the lack of ability to verify that the page is actually originating from the represented source. Are most app OAuth implementations ...
3
votes
1answer
833 views

Why is OAuth 2.0 being used for mobile devices, and not OpenID?

Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices. Question What ...
2
votes
0answers
184 views

If my users use Google OAuth for authentication, can I allow 3rd party apps to read data on my site?

Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn. When the book club becomes popular, we discover that 3rd party ...
0
votes
1answer
335 views

What mechanism to use for simple and secure HTTP API access?

I am currently working on a service which offers a HTTP API for mobile clients. I want clients to authenticate in order to access my API. The server itself is doing the authentication there will be ...
1
vote
0answers
175 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
0
votes
1answer
79 views

Why oauth use a secret with temporal credentials?

I am trying to understand oauth protocol. I am currently looking at temporal credentials section of the oauth 1.0 sepecification. I can't understand why the secret is needed along with the temporal ...
4
votes
1answer
404 views

Authenticate users through Google using only an OAuth2 access token

I have a question about having users logon to my service using their Google Credentials. I've gone through the Using OAuth 2.0 for Login documentation provided by Google. The documentation mentions ...
2
votes
1answer
270 views

API authentication without Oauth2 server

I have an API that needs user authentication. It is the same way Google authenticates when you use their API to access user data. I really don't want to setup an oauth2 server and I want user to login ...
2
votes
2answers
208 views

Does providing OAuth for mobile apps pose a security threat?

Let's take a look at the basic OAuth workflow: The basic idea is that the Consumer (App) asks the user to grant him access to the Service Provider. The service protects the user by asking him each ...
6
votes
2answers
459 views

Client authentication vs. user authentication

I am currently looking into authentication protocols which work well with REST API, in java. There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
10
votes
2answers
249 views

Preventing Voter Fraud on a Social Media Contest

I'm creating a contest that will allow users to login using their Facebook & Twitter accounts and submit votes on videos. My clients concern is that users will game the system by logging into ...
3
votes
1answer
366 views

Will using external OAuth providers for authentication protect users better than custom authentication?

On StackExchange we have the ability to choose to use our existing credentials with external OAuth providers such as Facebook or Google. This is convenient for users, but does it also have potential ...
0
votes
0answers
21 views

Facebook Login security concern with the javascritp JDK [duplicate]

Possible Duplicate: Isn’t OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint? I have some real concerns about how to use facebook login for my wabb-app. I have a ...
7
votes
2answers
2k views

What is the benefit of the scope in OAuth2?

In the question, substitute scope with state. Since there is an answer based on the wrong question, I'll let everything below as is. The answer is useful nonetheless. This question refers to ...
1
vote
1answer
447 views

Multiple security layers for SOA REST intranet services

For intranet applications that already leverage Active Directory, is there any point or benefit to adding a second layer of security such as OAuth when accessing SOA REST services? We're new to SOA ...
3
votes
2answers
10k views

How to use OAuth with Active Directory

I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
2
votes
1answer
353 views

Tomcat IP restriction vs Two Legged OAuth

We have a server side API that is completely REST based. We are coding to secure them with two legged oAuth type authentication. We are planning to iPhone and Android apps in the future, but for now, ...
4
votes
2answers
705 views

Is there any drawback of using OAuth “pseudoauthentication” as opposed to OpenID?

I have seen posts that insist that OAuth is an orthogonally different thing from OpenID, because OpenID is about authenticating users, while OAuth is about giving access to certain services to a third ...
39
votes
5answers
7k views

What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?

Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook. One advantage ...
3
votes
2answers
794 views

OAuth User revoke token

I haven't read it myself but a colleague told me that the end-user can revoke his/her OAuth token. I searched but I couldn't find enough docs on: is this true / is the end-user the one to revoke the ...
40
votes
9answers
3k views

Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...