Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Authorization is a key theme in computer security practices.

learn more… | top users | synonyms

0
votes
2answers
40 views

Is there any added security/vulnerabilities if you allow a “trusted-party” to vouch you are legit, if you were locked out of your account?

I was reading this answer on a question. http://security.stackexchange.com/a/498/106817 Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at ...
3
votes
2answers
637 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
7
votes
2answers
242 views

Microservice to Microservice Auth

We're planning a new architecture which will utlize a backend of many different microservices that will need to talk with each other as well as field requests from systems not part of the service. In ...
0
votes
0answers
23 views

Token-based SSO for multiple domains for backend API requests

I’m in the process of setting up SSO for a service I’m creating. After looking at solutions, I’ve found nothing to fit exactly what we need. I’m looking to make sure from a security standpoint what we ...
3
votes
1answer
32 views

JWT authentication and authorization schema

I was going through Oauth2 docs and thought it was kind of permissive security wise, so i tried to implement JWT tokens with a special scheme like in the picture for a mobile app communicating with a ...
1
vote
0answers
49 views

SAML, OAUTH, XACML oh my (Authorization)!

Unfortunately, after using several SSO/IAM products at a 'lite touch' to 'deep integration' level, I'm still left unsatisfied, so going to ask the most basic question I can: Given multiple ...
0
votes
0answers
62 views

How to do role-based authorization with OAuth2 / OpenID Connect?

I'm trying to use OAuth2 for authentication/authorization, but after much reading around, I am confused... I'm trying to understand how OAuth and OpenIDConnect relate to each other, and how exactly I ...
23
votes
5answers
4k views

Does multiple numbers per button have an effect on security?

I recently came across an electronic deadbolt like this: The keys have multiple numbers per button, 1|2, 3|4, 5|6, 7|8, 9|0 Is there any way that this increases the security of the electronic lock? ...
1
vote
3answers
48 views

Is there an added benefit to authentication within a part of an application, after authenticated into the main application?

Essentially I have a application that is 2 parts. One part is on the user's machine, which will upload files to my server, and the other part is a web application that works with those files. ...
6
votes
2answers
1k views

Does enabling EnableLinkedConnections pose a security risk?

As shown Microsoft's TechNet, network shares that are mapped by logon scripts are shared with the standard user access token instead of with the full administrator access token. Here's the gist of it: ...
0
votes
1answer
96 views

Sharing access-tokens in response header?

What's the best way to share my access tokens, I mean, is it okay to share it in the header as plain-text? - Or do I need to look into e.g.: JWT? Current workflow: -> POST /api/login -d {**creds} ...
0
votes
1answer
166 views

Who's been accessing my computer with TeamViewer? Tracking through UUID [duplicate]

So here I am, sitting at my computer screen on the one day of the week I stayed home from work, checking messages on my phone, when out the corner of my eye I see a browser page being opened. It was ...
3
votes
0answers
85 views

Thoughts on my JWT implementation

So I've been trying to learn as much as I can about JWT tokenisation, and auth0 seems to be the defacto JWT information hub. However, the more I read about refresh tokens, the more I cringe - the ...
5
votes
2answers
110 views

What to use as 'state' in OAuth2 Authorization Code Grant workflow

I'm using csrf protection in my web app. Now I'm planning to trigger a OAuth2 Authorization Code Grant workflow, starting with a static template opened in a new browser window using ...
2
votes
0answers
109 views

Combining id_tokens and access_tokens for new auth spec

A common misuse of OAuth2 is as a strict authentication protocol. OpenID Connect addresses this by extending OAuth2 to include an id_token. Implementing clients for OAuth2 and OpenID Connect is a ...
7
votes
2answers
3k views

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

What exactly is the difference between following two headers: Authorization : Bearer cn389ncoiwuencr vs Authorization : cn389ncoiwuencr All the sources which I have gone through, sets ...
7
votes
2answers
259 views

mobile number authorization strategy using SMS, best pattern and practices

In recent years, mobile number has become an important factor for authentication and hence more and more enterprises employ methods to capture their users' mobile numbers using SMS. In a typical ...
1
vote
1answer
16 views

What are the tools/frameworks/techniques for authorizing a device accessing a web app?

I've a password protected web application (ASP.NET 4.5), and a requirement that when a registered user accesses the site from a device for the first time, I should authorize that access by sending an ...
1
vote
0answers
28 views

Securing ASP.net web api (REST)

I am developing a middle-ware web service app(REST) using asp.net mvc-4 web api. The rest services are consumed by android,ios,angularjs client apps.Same user is able to use multiple platforms at the ...
6
votes
1answer
246 views

Cascaded Sudo for privilege elevation

I intend to use the least privileged user to do a given task. The issue is that it involve a kind of responsibility chain and translate as a sudo chain in my scripts, spreading the overall task in ...
2
votes
1answer
46 views

Partial Man on the End Security

The Situation: I'm developing a script that runs in a popular sandbox game as a paid service for other developers. The problem is that the game does not implement a way to do so. The language is Lua ...
6
votes
2answers
144 views

OAuth2 and Authentication

I see a lot of confusion about OAuth2 and Authentication so I created this question in the hope to clear some of the confusion. So, let's talk about the following points : What is the difference ...
5
votes
1answer
3k views

Looking for approach to implement attribute based access control (ABAC)

We are looking to implement Attribute-Based Access Control. While we are sold on the philosophy, there are two topics that seem to crop up: Will it lead to significant performance issues? Especially ...
1
vote
3answers
81 views

3rd party API access: Is OAuth really required?

Having a web application with a REST API (say, our-app.com), we want to open our API to 3rd party web applications (say, their-app.com). After some research, having read about OAuth, OpenID Connect, ...
1
vote
3answers
45 views

OAuth2 client registration: should redirect_uri be unique across clients?

When operating an OAuth2 Authorization Server: The authorization server MUST require the following clients to register their redirection endpoint: o Public clients. o Confidential ...
0
votes
1answer
172 views

Authorization on complex ownership

I have problem with object ownership in my web application. In my web application. There are object types: 1. Faculty 2. Student 3. Student Group 4. Student Lesson The following user roles are ...
1
vote
1answer
47 views

Trying to build an open authentication controled authorization website for multiple domain users

I'm not sure that this is possible but I figure at worst, I'll be told you cannot do that. Our organization has a report server that sits in a DMZ accessible by multiple units that have their own ...
5
votes
1answer
54 views

Use OpenId Connect for authentication only

OpenId Connect adds authentication to the OAuth2 protocol. OAuth2 is a protocol used for authorization. But what if I'm only interested in authenticating a user? After reading up on OpenId Connect, it ...
2
votes
1answer
133 views

What to do for my Web API authentication scheme

I've been reading a lot lately about WEB API authentication mechanisms and I'm a little bit confused regarding how to implement my Web API authentication mechanism, I'm thinking on using Token based ...
0
votes
2answers
289 views

multi tenancy and microservices API authentication/authorization

I'm seeking advice on how we may be able to implement authentication and authorization for multitenancy with slightly different number of scenarios. We are building a set of API's which of some are ...
10
votes
1answer
217 views

How does a refresh token help? [duplicate]

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
6
votes
1answer
189 views

Client identification using client certificates

I have the following scenario: Several independent embedded servers (Linux/ARM/lighttpd) Several independent controlling devices (win32/iOS/Android) Each server should have at least one controlling ...
1
vote
1answer
113 views

ABAC policy formulation and RBAC question

I am asked to answer a question that says: One online book-store wants to grand access to clients regarding their subscription. There are 3 types of subscriptions A , B and C. Customers get access ...
0
votes
0answers
23 views

Handling assertions in responses statuses 302 in ZAP

After configuring all form Authentication in ZAP, I have faced an issue to assert successful login in ZAP. The response will arrive with the status "302" moved temporary EX: > HTTP/1.1 302 ...
1
vote
3answers
2k views

How does DCOM authentication compare to RPC based authentication/auth?

The following paragraph from MSFT Best Practices for 2003 PKI says Windows 2000 authenticated via RPC vs 2003 that authenticates using DCOM A CA running Windows Server 2003, Enterprise Edition, ...
0
votes
1answer
67 views

Mobile apps social Oauth

I need to develop iOS and Android apps that should have to communicate with a server throught RESTfull API. Also I need to register and authorize user throught popular social networks like Facebook, ...
0
votes
0answers
17 views

Receiving third-party credentials on AWS

In my previous question, I was trying to figure out how to store third-party passwords safely. Now it seems that they'll be sent to my AWS instance from another AWS instance. I imagine the transfer ...
35
votes
6answers
22k views

Why use OpenID Connect instead of plain OAuth?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...
34
votes
3answers
3k views

Overarching term for 'authentication' and 'authorization'?

The internet is rife with 'authentication vs. authorization'-type questions. I'm not asking that here. I'm wondering if there is some overarching term that encompasses both of these. I've seen ...
16
votes
4answers
4k views

Role Based Access Control + Data Ownership based permissions

Is there a common system or pattern that combines the permissions given by a role in a RBAC-system with permissions in relation to dataownership? For example: Bob is a doctor and has the role ...
6
votes
1answer
228 views

How should resource providers validate OAuth2 tokens?

Resource providers often provide read and write access to resources. A resource provider should therefore not only validate the token (is it expired? is it revoked? is it valid? does it contain the ...
2
votes
0answers
70 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
21
votes
3answers
2k views

Pitfalls of using OAuth for mobile Applications

OAuth is a popular authorization solution for web applications and mobile applications. What the pitfalls of using OAuth are in those two scenarios (as a web application providing OAuth access to my ...
63
votes
10answers
24k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
1
vote
1answer
51 views

SSL/TLS certificates that only certain users can use to talk to my server

are there something like SSL/TLS certificates or other equivalents which could allow only certain trusted users (from the internet) who have my server credentials in their browser to access my web ...
5
votes
2answers
366 views

How to secure a local socket?

I have made a service written in c that runs on the Android operating system as a core service. I have a few Android apps which communicate with this service via a socket connection (Java -> C). My ...
3
votes
1answer
2k views

How to supply HTTP Basic Authentication details in OWASP ZAP proxy?

I am using Basic HTTP Authentication to log into my Web Application. The credentials are Base64 encoded and sent to the Server. OWASP ZAP Proxy is intercepting the request and I can see the ...
2
votes
0answers
109 views

Security token in android and embedded system

I have an embedded board with a very limited processing and memory resource. I would like to control the board using an android app. The users are categorized into 3 groups: owner of the board. ...
3
votes
1answer
44 views

Authorizing a device to access user resources

Description: I am building an information display system. The system consists of the following: A Django Rest Framework based backend providing a low-level JSON API A single page application web ...
1
vote
0answers
26 views

Is there a “smart cache” device which provides cache if authorized?

Is there an implementation of a HTTP (or decoded HTTPS) optimization device which would allow for "smart caching" - i.e. the ability to release some cached content (initially transferred by someone ...