Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Authorization is a key theme in computer security practices.

learn more… | top users | synonyms

4
votes
1answer
75 views

Microservice to Microservice Auth

We're planning a new architecture which will utlize a backend of many different microservices that will need to talk with each other as well as field requests from systems not part of the service. In ...
9
votes
1answer
71 views

How does a refresh token help? [duplicate]

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
6
votes
1answer
151 views

Client identification using client certificates

I have the following scenario: Several independent embedded servers (Linux/ARM/lighttpd) Several independent controlling devices (win32/iOS/Android) Each server should have at least one controlling ...
1
vote
1answer
52 views

ABAC policy formulation and RBAC question

I am asked to answer a question that says: One online book-store wants to grand access to clients regarding their subscription. There are 3 types of subscriptions A , B and C. Customers get access ...
0
votes
0answers
23 views

How to authenticate a subscriber GSM? [closed]

How to authenticate a subscriber GSM? Could you give me a hint or link where it is described ? I mean: From what base station of GSM knows that the subscriber is authorized. abonent is user ...
3
votes
1answer
3k views

Looking for approach to implement attribute based access control (ABAC)

We are looking to implement Attribute-Based Access Control. While we are sold on the philosophy, there are two topics that seem to crop up: Will it lead to significant performance issues? Especially ...
6
votes
2answers
623 views

Does enabling EnableLinkedConnections pose a security risk?

As shown Microsoft's TechNet, network shares that are mapped by logon scripts are shared with the standard user access token instead of with the full administrator access token. Here's the gist of it: ...
0
votes
1answer
49 views

Sharing access-tokens in response header?

What's the best way to share my access tokens, I mean, is it okay to share it in the header as plain-text? - Or do I need to look into e.g.: JWT? Current workflow: -> POST /api/login -d {**creds} ...
0
votes
0answers
10 views

Handling assertions in responses statuses 302 in ZAP

After configuring all form Authentication in ZAP, I have faced an issue to assert successful login in ZAP. The response will arrive with the status "302" moved temporary EX: > HTTP/1.1 302 ...
0
votes
1answer
127 views

multi tenancy and microservices API authentication/authorization

I'm seeking advice on how we may be able to implement authentication and authorization for multitenancy with slightly different number of scenarios. We are building a set of API's which of some are ...
1
vote
3answers
2k views

How does DCOM authentication compare to RPC based authentication/auth?

The following paragraph from MSFT Best Practices for 2003 PKI says Windows 2000 authenticated via RPC vs 2003 that authenticates using DCOM A CA running Windows Server 2003, Enterprise Edition, ...
0
votes
1answer
52 views

Mobile apps social Oauth

I need to develop iOS and Android apps that should have to communicate with a server throught RESTfull API. Also I need to register and authorize user throught popular social networks like Facebook, ...
0
votes
0answers
15 views

Receiving third-party credentials on AWS

In my previous question, I was trying to figure out how to store third-party passwords safely. Now it seems that they'll be sent to my AWS instance from another AWS instance. I imagine the transfer ...
33
votes
6answers
18k views

Why use OpenID Connect instead of plain OAuth?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...
34
votes
3answers
3k views

Overarching term for 'authentication' and 'authorization'?

The internet is rife with 'authentication vs. authorization'-type questions. I'm not asking that here. I'm wondering if there is some overarching term that encompasses both of these. I've seen ...
16
votes
4answers
3k views

Role Based Access Control + Data Ownership based permissions

Is there a common system or pattern that combines the permissions given by a role in a RBAC-system with permissions in relation to dataownership? For example: Bob is a doctor and has the role ...
5
votes
1answer
45 views

How should resource providers validate OAuth2 tokens?

Resource providers often provide read and write access to resources. A resource provider should therefore not only validate the token (is it expired? is it revoked? is it valid? does it contain the ...
1
vote
0answers
104 views

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

What exactly is the difference between following two headers: Authorization : Bearer cn389ncoiwuencr vs Authorization : cn389ncoiwuencr All the sources which I have gone through, sets ...
2
votes
0answers
69 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
21
votes
3answers
2k views

Pitfalls of using OAuth for mobile Applications

OAuth is a popular authorization solution for web applications and mobile applications. What the pitfalls of using OAuth are in those two scenarios (as a web application providing OAuth access to my ...
61
votes
10answers
22k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
1
vote
1answer
30 views

SSL/TLS certificates that only certain users can use to talk to my server

are there something like SSL/TLS certificates or other equivalents which could allow only certain trusted users (from the internet) who have my server credentials in their browser to access my web ...
5
votes
2answers
225 views

How to secure a local socket?

I have made a service written in c that runs on the Android operating system as a core service. I have a few Android apps which communicate with this service via a socket connection (Java -> C). My ...
3
votes
1answer
535 views

How to supply HTTP Basic Authentication details in OWASP ZAP proxy?

I am using Basic HTTP Authentication to log into my Web Application. The credentials are Base64 encoded and sent to the Server. OWASP ZAP Proxy is intercepting the request and I can see the ...
5
votes
2answers
72 views

What to use as 'state' in OAuth2 Authorization Code Grant workflow

I'm using csrf protection in my web app. Now I'm planning to trigger a OAuth2 Authorization Code Grant workflow, starting with a static template opened in a new browser window using ...
2
votes
0answers
86 views

Security token in android and embedded system

I have an embedded board with a very limited processing and memory resource. I would like to control the board using an android app. The users are categorized into 3 groups: owner of the board. ...
3
votes
1answer
39 views

Authorizing a device to access user resources

Description: I am building an information display system. The system consists of the following: A Django Rest Framework based backend providing a low-level JSON API A single page application web ...
1
vote
0answers
22 views

Is there a “smart cache” device which provides cache if authorized?

Is there an implementation of a HTTP (or decoded HTTPS) optimization device which would allow for "smart caching" - i.e. the ability to release some cached content (initially transferred by someone ...
8
votes
2answers
219 views

How do high-performance web applications control permission to their content?

So, I believe I understand the logic behind authorization standards like OAuth. The OAuth token contains information about the user (name, role, etc.), which I can use to secure my application. ...
3
votes
1answer
575 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
8
votes
4answers
284 views

School's computers auto-login and can run .exe's

Before this semester, to use any computer across campus, you had to log into Windows with a username and password. This semester, when the computers start up they auto-login to an account (with ...
2
votes
1answer
62 views

Attribute Certificates and Access Management

I recently came across Attribute Certificates (RFC 5755), which can be used as a means for authorisation. I like the idea but I have spent a lot of time searching for information how this works in a ...
0
votes
0answers
59 views

Is authentication/authorisation necessary between a web server and an isolated application server?

If I have a system that consists of an application server which responds to requests made only from the web server. a web server that responds to client requests over the internet. Is it necessary ...
0
votes
6answers
225 views

Authorization before Authentication?

From a conceptual point of view, can authorization occurs without authentication taking place first? I'm thinking about few cases where authorization seems to occur without authentication taking place ...
23
votes
5answers
2k views

ZX Spectrum tape loader: how was copy prevention implemented?

I am curious how copy prevention was implemented for games or other programs loaded from cassette on the micro computers of the early 1980s, such as the ZX Spectrum 48k. If I recall correctly, some ...
4
votes
2answers
72 views

Is it a good practice to use certificates as a mean of client identification in a cloud environment

My software system is running a cloud infrastructure where having Linux machines VPN into OpenVPN gateway is a setup requirement. Also, there may be cases when software on the aforementioned Linux ...
2
votes
1answer
88 views

What are proper security precautions when enabling multiple connected social accounts or login/authorization methods?

It is popular today for frameworks and social sites to enable multiple authorization options when creating websites. For example, allowing a user to login with GitHub, Twitter, Facebook, etc. In ...
7
votes
1answer
435 views

How to protect a Wifi network from Microsoft WiFi Sense

Microsoft is deploying a new feature, WiFi Sense, which provides users a way to easily share passwords to wireless networks with all of their contacts. This introduces a new security failure mode: a ...
0
votes
0answers
460 views

Multiple user type management - token based authentication

I am currently working on an e-commerce application. The application has different users: Customers Merchants Logistics Admin The current db structure has a different table for each of these user ...
1
vote
1answer
93 views

Are there any simpler ABAC implementations available for big data systems? [closed]

Can any one suggest simpler Attribute Based Access Control implementations available for big data systems like Hadoop, Hive etc? I have checked Apache ranger they dont have any support for ABAC yet ...
1
vote
1answer
265 views

Create Public Key using OpenSSL instead of PuTTYgen for PKCS#8

I'm trying to create a public key pair for ssh-rsa authentication. If I'm using puttygen.exe, the "OpenSSH authorized_keys file" string looks like this: "ssh-rsa AAAAB3 ... 6yIK9Nbw== ...
8
votes
2answers
5k views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User ...
5
votes
1answer
196 views

Security protocol for NFC stickers/cards

Lets say I'm using NFC cards for access control. NFC cards/stickers are easily readable and writable, so my worry is that the data on them could easily be cloned onto another card/sticker and bypass ...
1
vote
0answers
177 views

JWT for User Authentication + Client App Authentication + User Claims Holder?

I would like to switch the security layer of my API from Basic Auth over HTTPS + claims-based infrastructure (w/ claims populated in a delegatinghandler) to a more robust mechanism and support client ...
1
vote
2answers
812 views

Table or row level security in ASP.NET MVC 5 and Entity Framework 6

I've already asked this question on Stack Overflow, but no one answered, so maybe it's a more appropriate place to discuss it. Please let me know if I'm wrong and having duplicated question on ...
1
vote
1answer
125 views

Centralized authorization with distributed service providers

I'm thinking about implementing a single sign on service with a centralized permissions management for a distributed network of service providers (so authentication as well as authorization). The ...
0
votes
1answer
70 views

How to manage a custom session in a webapp?

I was reading through the OWASP Cheat Sheet and something mentioned in the "Weak Authentication and Session Management" row did not make sense to me. It is recommended in the Design Column, that ...
3
votes
3answers
340 views

encryption vs access control comparison

I have a very basic and simple question about two security concepts. Both encryption and access control are used for privacy and to prevent unauthorized users from accessing some object (eg. files, ...
4
votes
1answer
93 views

Purpose for “One Time Use Token”

I'm connecting a Salesforce ORG with a third party vender through a custom API (they basically wrote it just for us). The API requires you to retrieve a "token" that you pass into other calls through ...
9
votes
3answers
6k views

How to manage admin rights for helpdesk staff?

My question is about issuing administrative rights to helpdesk staff in a large Active Directory setting. Helpdesk staff commonly require administrative rights to provide support for end users. I ...