OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

learn more… | top users | synonyms

4
votes
2answers
114 views

Decide to REST API Security

I've developed an API. I got confused and I've been reading articles for days. Actually my question is close to these but not exact (maybe a combination of them); Securing REST API that will ...
1
vote
0answers
22 views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
-1
votes
0answers
19 views

OpenID is the successor of Oauth2? [duplicate]

I started to learn the two new protocols Oauth2 and OpenID, but i guess that they do the same thing ! how can i differentiate between OpenID and Oauth2. Thanks
6
votes
3answers
915 views

How were resources shared before OAuth?

With OAuth 2.0, it is pretty straight forward for a developer to authenticate a user via another service in order to obtain its data, e.g. get tweets from a Twitter user or fitness data via RunKeeper, ...
1
vote
0answers
59 views

Authentication and Authorization for a simple Web Site [migrated]

I'm struggling with these concepts and having trouble finding good resources on the web. We are looking for ways to switch out custom implementations tightly integrated into our application for ...
3
votes
2answers
62 views

Why would you decouple your resource and login servers?

As described on this link, OAuth specifies that a login server and a resource server should be decoupled. The idea is that if one of your resource servers gets hacked, no password data is lost. All ...
0
votes
0answers
14 views

Is OpenID Connect (OAuth2) appropriate for standard login + social login + single sign on? [migrated]

I have to implement authentication in a group of websites. The solution will have to support standard login (user & password), social login (facebook, google+, twitter) and single sign on (once ...
0
votes
0answers
19 views

OAuth2 Authorization and Resource Server security check

I'm about to launch a web api using OAuth2 for authentication (authorization code, implicit and client credentials flows). The protocol is implemented using the DotNetOpenAuth v4.3 library. Although a ...
1
vote
1answer
28 views

Why should I include a client_id in an OAUTHv2 password grant request?

Like little red riding hood, you don't know who is knocking on the door... Why even bother accepting a client_id in case of a API <-> Javascript-website or API <-> Android App password grant ...
0
votes
0answers
15 views

Using a website as a middleman for Oauth

I am working with a customer that has started to look at an unusual solution for Oauth. They have a mobile application that they want to authenticate using Oauth. To do this they are setting up a ...
0
votes
0answers
70 views

JSON Web Tokens vs. SAML

I don't know too much about security. Specifically, I don't understand the difference between JSON Web Tokens, SAML and OAuth 2. If you could provide some pointers and high level overview of their ...
1
vote
1answer
33 views

add another layer of protection on top of oauth 2

My Rest API is protected using Oauth2. My main client is a native app. it's working great but there are certain calls to the API that i want to make sure that are performed from my client - meaning ...
2
votes
0answers
25 views

How is an OpenID Authenticated user Identified?

On a system that I'm working on a user signs up by means of an OpenID/Social Media account (Twitter, Google, Facebook), and then subsequently signs in using that path. The System comprises of a ...
0
votes
0answers
7 views

How do I trade an OAuth token for a Fedauth token with Azure AD? [migrated]

I am trying to access a resource that's secured with Azure Active Directory. I can see from the HTTP traffic that my browser uses a Fedauth token when accessing the resource, but I need to access this ...
0
votes
0answers
38 views

How to associate an oAuth token with a particular user. Is this possible?

We have HTTP Rest services and SignalR (aka Web sockets, server send events, etc) for cases in which we need to push data from the server to the Web UI . We are currently using the built in tools that ...
2
votes
0answers
118 views

Social Login + OAuth2-secured REST API

I'm implementing social login with Facebook, Twitter and Google+ on our OAuth2-secured REST API (secured using spring-security-oauth). I'd like to make sure that the following flow is secure and that ...
0
votes
1answer
44 views

OAuth + Confused Deputy + access token verification + state parameter

Google's "Using OAuth 2.0 for Client-side Application" article at https://developers.google.com/accounts/docs/OAuth2UserAgent states that the client MUST validate all access tokens to verify that it ...
0
votes
0answers
24 views

What are the consequences of revealing OAuth2 client secret?

Basing on this post I understand that client secret is used in "Authorization code" flow to: Create authorization request for registered domain Exchange returned code for actual auth token ...
1
vote
2answers
170 views

Best place to store authentication tokens client side

When my users are authenticated they receive an authentication token, I need to use this authentication token to authorize some asp.net WebAPI calls. To do this I need to add the token to the head of ...
0
votes
0answers
26 views

Is it a better security measurement to generate new refresh token on every access token request?

I far as I know refresh token is a long-lived token to generate new access tokens based on that. Can we consider refresh token generation as a better security measurement on every access token ...
1
vote
1answer
88 views

Risk of keeping OAuth2 client_secret in application

As an exercise, I'm developing a desktop application with which users need to log in to a web service. A logical use-case for OAuth2 one would say, but I'm beginning to doubt its usefulness. I am ...
1
vote
0answers
29 views

Correct approach to secure the back end service - oAuth

I'm developing a oAuth service (I'm thinking so. It might not be exactly the same.) to open one of our back end API to a Merchants. basically users can purchase goods from Merchant's E-Commerce ...
2
votes
0answers
35 views

Using multiple oAuth identity services simultaneously

This question is somewhat acedemic in nature. While educating myself about the topic of Security via a Bearer Tokens for a back-end service that I am working on, and specifically about oAuth2, a few ...
0
votes
1answer
288 views

ADFS 2012 R2 (3.0) JSON web token validation

Our client would like for us to utilize ADFS 2012 R2 (aka 3.0) as the primary means for two security features in internal apps that we are building: The web app (there are two .NET & Angular) ...
0
votes
0answers
23 views

Authentication API that just returns ID with right email / password combination a security problem?

Two companies. MegaSocialPlatform CorporateCompany. CorporateCompany wants that their employees can reuse their current login credentials of CorporateCompany.com on MegaSocialPlatform, so ...
3
votes
2answers
217 views

Securing a multi-tenant, multi-database REST API

I am looking to improve the security of an existing REST API accessed over SSL. The web service is multi-tenant, such that each tenant has an assigned TenantId. The problem I facing can be summarized ...
1
vote
2answers
164 views

How does a user get authorized wihtout authentication

I have a back-end (API) and a front-end, eg a web server, and I have users and ID-providers. The web server is provided by a third aprty and it may just as well be a mobile app, but whatever the case ...
0
votes
1answer
60 views

Why not oAuth for Authentication - AKA what is bad about OpenID Connect [duplicate]

I read many questions and answers on this forum stating that oAuth is for authorization, OpenID is for authentication and more than a few of them goes on to say that OpenID Connect provides ...
2
votes
0answers
31 views

Does changing my password after OAuth login in mobile app help reduce risk?

When you use a mobile app that needs Google OAuth login, you can't fully trust the third party app because you can't tell what url the webview is using. Who knows if they aren't storing my login and ...
1
vote
1answer
62 views

Correct auth method using oAuth 2.0?

Been trying to wrap my head around oAuth 2.0, but I'm struggling figure out the correct way to implement it for our system, as there are so many different approaches. Our specifications are: Secure ...
0
votes
1answer
77 views

How to incorporate the man-in-the-middle

I am designing a web-based back-end for an online service. The service could support web based portals and mobile apps as front end. But I am stuck on how to support third-party, i.e untrusted, web ...
0
votes
1answer
112 views

Why isn't Google oauth2 giving a refresh token for Client-side applications?

I've been reading Google's oauth2 documentation for Client-side applications. I was surprised that nowhere does it mention refresh tokens. Also, their examples hint that the access_token has a default ...
1
vote
2answers
57 views

Is it normal if user gets logged in Facebook or Twitter after they use Like or Tweet button? [closed]

Personally I don't use social networks, so I'm not sure about their behaviour. Currently I must code website which heavily depends on "Likes" and "Tweets" about articles. Each article has Like and ...
3
votes
2answers
60 views

What's the point of the client secret in OAuth2 if it doesn't need to be used?

Simple as that! Clients that can't maintain the secrecy of the client_secret in OAuth2 don't have to use it. So what's the point of having it at all, if it's not necessary? What am I missing here?
2
votes
0answers
29 views

What are proper security precautions when enabling multiple connected social accounts or login/authorization methods?

It is popular today for frameworks and social sites to enable multiple authorization options when creating websites. For example, allowing a user to login with GitHub, Twitter, Facebook, etc. In ...
2
votes
2answers
123 views

Why do we trust session info over the wire but not an OAuth access token?

I've been spending a lot of time looking into building an API that needs to be accessible by a single page JavaScript application and how to make it as secure as possible. A lot of what I'm reading ...
1
vote
0answers
75 views

Facebook Login and OpenID Connect [closed]

Can someone confirm whether Facebook Login API (https://developers.facebook.com/docs/facebook-login/v2.2) is based on OpenID Connect (http://openid.net/connect/) specification? Thanks, Sameer
1
vote
1answer
103 views

storage of client credential on OAuth2 server

I'm developing an API and used a recommended implementation of OAuth2 protocol: PHP OAuth2 Server. This library stores client ID and client secret as plain text in a database table. Note that I ...
2
votes
1answer
50 views

Clarification on OAuth Client Secret

I have a little trouble understanding, how to use OAuth to secure an API. So I developed a RESTful service, which I would like to secure to authenticated access. I first opted for HTTP Basic + TLS, ...
10
votes
3answers
2k views

Should we store accesstoken in our database for oauth2?

I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list. I have gone through the complete OAuth2 documentation of ...
3
votes
1answer
121 views

How to store client secret securely on application base in Windows?

I would like to store valuable client data (ex. passwords, OAuth tokens) in a way that they will be accessible only from one application (separation on application base). The mechanism must be ...
6
votes
1answer
374 views

Why should I persist OAuth 2 access tokens along with refresh token

That's something I've came across in a couple articles about OAuth 2: when it comes to persisting refresh tokens to database some authors prefer to store access token as well, or at least mention it ...
1
vote
2answers
128 views

Using OAuth 2.0 without token storage

I am building a system for a product which requires Authentication and Authorization. Naturally I have chosen using OAuth 2.0 as it is a commonly used protocol and has proven to be useful. I am ...
1
vote
1answer
87 views

Can Facebook login to my app?

This sounds maybe like a stupid question, but I'm wondering myself if this is theoretically possible. Let's say I'm using Facebook login in my app. If the login is successful I get I get back an ...
1
vote
0answers
72 views

Best practices for OAuth 2.0

I understand that OAUth 2.0 really just relies on SSL to encrypt the contents of the bearer token. However, are there any other best practices one should follow when securing OAuth 2.0? I know you ...
1
vote
1answer
84 views

Is it safe to store important data in an encrypted access token?

Is it safe to store important data in an encrypted access token? For example, instead of storing access tokens in a database, not storing them at all and putting their associated data into them before ...
1
vote
1answer
119 views

Securing an OAuth / OpenID Connect identity in a cookie for easy login

I have a website that uses Azure Active Directory or Google+ for logging in. I go through an OAuth2 login flow, and the users email along with their tokens are returned to me by their identity ...
1
vote
1answer
383 views

advantages of http basic authentication over token-based (e.g. oauth2)?

I am interested in the question if there are any possible advantages to securing a given REST API for web clients and mobile apps with http basic authentication (over https of course) over a ...
0
votes
1answer
36 views

Is there an overview over all OAuth2-related specifications?

I recently started to read up on OAuth2, and just now noticed how many extensions exist to this protocol. Is there an overview or some kind of a map of OAuth2 and all of its (official) extensions? I ...
4
votes
2answers
300 views

Google+ Sign In - One Time Code Flow vs Pure Server Side flow

I'm reading the documentation about Google+ Sign In, more specifically, its server side flow. It says (https://developers.google.com/+/web/signin/redirect-uri-flow) that one-time code flow has ...