OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

learn more… | top users | synonyms

7
votes
1answer
99 views

What are the implications of publicizing a consumer secret for sharing between developers doing local website development?

In relation to this GitHub issue on the Gittip project (which turned out to be a false alarm), what are the security implications, if any, of hardcoding into the git repo a test app's OAuth consumer ...
1
vote
0answers
27 views

Is indirection with ID federation possible?

At the moment I'm trying to design a system with some services. These services should make use of an ID provider (a) for login (for example using OAUTH) and another ID provider (b) to get user data. ...
1
vote
0answers
326 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
1
vote
0answers
141 views

How do I get the Access-Token and Access-Token-Secret?

Can anyone explain me these terms with respect to OAuth ? Consumer Key Consumer Secret Access Token Access Token Secret Also, when I registered my application with twitter I got the consumer key ...
3
votes
1answer
68 views

When implementing an OAuth provider, what is the right granularity for a “scope”?

If I'm an OAuth provider and I want to empower the user to restrict apps to only a subset of resources (for example, only resources in folder X), what is the right mechanism to do this? Scopes would ...
3
votes
1answer
360 views

Is OAuth always the right choice (and when isn't it)

So I am reluctant to ask too much of a noob question, as this guy aked about a non-standard approach and got down voted a bunch, but here goes. I am creating a mobile application which needs to ...
1
vote
2answers
194 views

Is Tweetdeck authentication really safe?

I have recently installed Tweetdeck, because my previous client stopped working. In my custom client, and in the third party client I have used previously I had to setup authorize the application in ...
5
votes
1answer
921 views

Does it make sense to implement OAuth when no 3rd party is involved

I own a REST API at server side and a distinct web application that would call those APIs. I want to secure my APIs calls. After some reading, I want to implement the OAuth 1.0a mechanism at server ...
1
vote
0answers
549 views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...
2
votes
1answer
304 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
6
votes
1answer
98 views

Design a webapp that uses OAuth, but with tokens that can't be used by the operator?

I'd like to make a webapp that would allow users to OAuth with Stack Exchange, so that they can perform actions like voting through the app. I'm stuck at one point, though: I know how to perform ...
1
vote
1answer
51 views

If a site says its API for login can't be made available for “Security Reasons” should I be worried

Stack Exchange API 2.2 is finally out, (Yay!) Reading through the linked blog post, i notice the line: Login methods that don’t use OAuth can’t be made public for security reasons. Is this ...
4
votes
3answers
899 views

OAuth2 authorization - save token in the cookies or in the session?

I'm a security newbie. I'm implementing oauth on my site and I want to ask where I should save my access token: cookies session (will be fetch from the server via ajax request) I have backend ...
3
votes
1answer
454 views

OAuth2 with client credentials v/s other auth mechanisms

For a REST API against which clients would be writing non-browser based, non-interactive applications, if OAuth2 is the authentication mechanism to be followed, then we would use the client ...
2
votes
2answers
340 views

Ways to authenticate client with a server

I have an app that sends an encrypted message to the server, with the sender and recipient username attached. The usernames are each linked to a unique device ID that allows messages to be sent to ...
3
votes
1answer
214 views

OAuth2 - Is it safe to return the access-token to the user?

I'm new to OAuth (1 & 2), and I'm developing the server side of a mobile app that has a form with a "Fill Details from Google account" button. I don't need any long-range ...
3
votes
1answer
262 views

Google Open ID connect and ID token

I am wondering if it is safe to send "id token", which is one of the items that are result of authenticating a user using Google Open Id Connect, to the client and use it for further authentication. ...
3
votes
1answer
145 views

Why does OAuth2 demand client credentials in an authorization header?

In section 2.3.1 of the the OAuth 2.0 Authorization Framework it states: The authorization server MUST support the HTTP Basic authentication scheme for authenticating clients that were issued a ...
3
votes
1answer
3k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
1
vote
1answer
311 views

Security: Oauth and Mobile apps

This is what I believe are the security implications of integrating Oauth using embedded webview vs browser in mobile application. Embedded Webview * Keep UI for mobile app Security implications ...
1
vote
0answers
256 views

Implementing OAuth flow in JavaScript

I am making a custom auth flow for the application. It is inspired by OAuth 2.0. Dev sends user to an auth page on my domain, passing callback_url and api_id. I redirect user to callback_url, passing ...
2
votes
2answers
309 views

OAuth for Multiparty Authentication/Authorization

I work for a web company that's undergoing a massive rewrite in order to separate our Data out into its own RESTful service application - the goal is to be able to sell access to third parties and ...
7
votes
2answers
308 views

How does an attacker abuse Facebook Connect with a leaked secret key?

I am reading about Facebook Connect and it looks a lot like OpenID Connect. Are these two similar enough that the Facebook Connect secret key is an OAuth Client Secret and therefore the same attacks ...
3
votes
2answers
2k views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User ...
1
vote
1answer
756 views

Securing REST API for mobile use with OAuth

I'm a complete noob about security, so please, forgive me if I say something wrong. I have to develop a social network. The client will be an Android app and (probably) a web page for smartphones ...
12
votes
2answers
7k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
7
votes
2answers
3k views

What is the purpose of OAuth 2.0 redirect_uri checking?

The OAuth 2.0 specification's authorization code mechanism includes redirect URI checking from the site you redirect to. See steps D and E in section 4.1 of the spec. Also, section 4.1.3 describes in ...
4
votes
1answer
643 views

Does returning `Access-Control-Allow-Origin: *` weaken the security of JSON GET responses?

The W3C CORS recommendation states: Certain types of resources should not attempt to specify particular authorized origins, but instead either deny or allow all origins. ... 3. A GET ...
2
votes
1answer
65 views

oauth and passing received toking to other application

An external software provider is hosting a website for us. We supply the login functionality via a restfull api(login/password over ssl). But the website is also the client for OAuth resource that it ...
4
votes
1answer
329 views

Oauth Consumer Secret?

Using OAuth you have a consumer key and consumer secret to identify your application and the user provides an OAuth access token and secret to authenticate your application access to their account, ...
0
votes
2answers
1k views

Google Authenticator - Counter Based [duplicate]

I'm trying to understand How google authenticator - counter based work. I have tried googling around finding a demo or at least how this work. I understand its a one time password but not like TOTP. I ...
0
votes
2answers
550 views

E-Commerce website with REST backend : do I have to secure Backend URLs accessed by Front end public pages?

I have an e-commerce website with a REST backend and a Single page JS as front end. I intend to secure my REST backend with OAuth2. I don't want to oblige the user to authenticate when he first comes ...
0
votes
1answer
384 views

Secure API access over SSL using oauth token

On the project that i'm currently working, we authenticate the clients by username and password. In this system each user has a key which is calculated from his password. However, we want to provide ...
5
votes
1answer
192 views

Are most app OAuth implementations vulnerable because of an obscured URL/origin?

I cringe every time I am prompted with OAuth in an app because of the lack of ability to verify that the page is actually originating from the represented source. Are most app OAuth implementations ...
3
votes
1answer
914 views

Why is OAuth 2.0 being used for mobile devices, and not OpenID?

Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices. Question What ...
2
votes
0answers
197 views

If my users use Google OAuth for authentication, can I allow 3rd party apps to read data on my site?

Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn. When the book club becomes popular, we discover that 3rd party ...
0
votes
1answer
372 views

What mechanism to use for simple and secure HTTP API access?

I am currently working on a service which offers a HTTP API for mobile clients. I want clients to authenticate in order to access my API. The server itself is doing the authentication there will be ...
1
vote
0answers
189 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
0
votes
1answer
83 views

Why oauth use a secret with temporal credentials?

I am trying to understand oauth protocol. I am currently looking at temporal credentials section of the oauth 1.0 sepecification. I can't understand why the secret is needed along with the temporal ...
5
votes
1answer
103 views

If a service that I registered with FB/Twitter/G+ is hacked, what mischief can be done with the oauth token?

Case in point, TrueCaller. I had logged into TC using a proxy twitter account. I am assuming that as part of the authentication process, an access_token must have been saved by TC. If the hackers ...
4
votes
1answer
470 views

Authenticate users through Google using only an OAuth2 access token

I have a question about having users logon to my service using their Google Credentials. I've gone through the Using OAuth 2.0 for Login documentation provided by Google. The documentation mentions ...
2
votes
0answers
185 views

Implementing ACS with REST + many Identity Providers - Problems - Azure

I am trying to integrate ACS to use in my application's authentication system. Currently I have a Javascript client and a WCF so I had to use a REST architecture. I am quite puzzled on how to do ...
2
votes
1answer
419 views

Oauth2 - in traditional enterprise applications

I read about Oauth2, mostly in the context of social media service providers like Google, Facebook, Twitter where they Try to allow access to user data without giving password to third party ...
16
votes
4answers
6k views

Why use OpenID Connect instead of plain OAuth?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...
2
votes
1answer
319 views

API authentication without Oauth2 server

I have an API that needs user authentication. It is the same way Google authenticates when you use their API to access user data. I really don't want to setup an oauth2 server and I want user to login ...
4
votes
1answer
153 views

oauth2 account authentication

imagine you secured your application with oauth2 and several oauth providers. Now imagine someone using provider A with email bob@example.com to log in. Next time, someone uses provider B with the ...
3
votes
2answers
230 views

Does providing OAuth for mobile apps pose a security threat?

Let's take a look at the basic OAuth workflow: The basic idea is that the Consumer (App) asks the user to grant him access to the Service Provider. The service protects the user by asking him each ...
6
votes
3answers
3k views

SAML2 vs. OAuth - What are some reasonable relationships?

I have a service that allows SSO via SAML2. When SAML2 is used, we delegate the entire authentication process to the Identity Provider. We are considering adding OAuth in order to support some ...
6
votes
2answers
506 views

Client authentication vs. user authentication

I am currently looking into authentication protocols which work well with REST API, in java. There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
10
votes
2answers
257 views

Preventing Voter Fraud on a Social Media Contest

I'm creating a contest that will allow users to login using their Facebook & Twitter accounts and submit votes on videos. My clients concern is that users will game the system by logging into ...