OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

learn more… | top users | synonyms

4
votes
1answer
127 views

OAuth2 JWT Signing with OAuth2 Application Secret Key

Abstract (sorry, this is a mouthful): I would like to facilitate back end system-to-system Authorization via OAuth2 and JWT by making use of the JWT 'aud' param to specify a resource specific to an ...
7
votes
2answers
289 views

Microservice to Microservice Auth

We're planning a new architecture which will utlize a backend of many different microservices that will need to talk with each other as well as field requests from systems not part of the service. In ...
2
votes
0answers
28 views

OAuth2 client account & data storage [duplicate]

Context I have a REST API where a user can create an account from a web client. The password is saved as a salted hash in a database. When a user is authenticated they can save and retrieve private ...
6
votes
1answer
340 views

How should resource providers validate OAuth2 tokens?

Resource providers often provide read and write access to resources. A resource provider should therefore not only validate the token (is it expired? is it revoked? is it valid? does it contain the ...
1
vote
2answers
98 views

Why are Facebook, etc. considered as typical authorization servers in OpenId?

The OAuth2 specification says: The interaction between the authorization server and resource server is beyond the scope of this specification. The authorization server may be the same server ...
0
votes
1answer
87 views

Why Oauth2 specification considers native desktop application clients less secure than web server application clients?

I assume here that the web server is owned the client as is the desktop. If they aren't, then I have my answer and I misunderstood the differences between desktop Vs web server clients. If they are ...
4
votes
2answers
144 views

Prevent CSRF attack using regular expression, session storage, and auth token?

User login to my Web API Service using his user name and password. Web API Service response auth token to client browser. Client browser save auth token to session storage using JavaScript. Client ...
5
votes
1answer
57 views

Should I enable Google Auth login by default for my users?

I have implemented Google login (OAuth2) login on my website. It matches users by e-mail, i.e. if your e-mail is the same in Google as in our system, and you have Google Auth enabled on my website, ...
0
votes
1answer
108 views

Sharing access-tokens in response header?

What's the best way to share my access tokens, I mean, is it okay to share it in the header as plain-text? - Or do I need to look into e.g.: JWT? Current workflow: -> POST /api/login -d {**creds} ...
3
votes
1answer
194 views

Prove ownership of a GMail account

Is there a way for a person to remotely and irrefutably demonstrate ownership of a Gmail email address? I've considered using DKIM signatures, but this has problems: PGP Key Signing Robot DKIM ...
3
votes
1answer
173 views

Refresh tokens in OAuth2 with JWTs

I'm trying to implement the OAuth2 resource owner flow. My authorization server successfully generates JSON web tokens, so my next step is to implement refresh tokens for my web application. ...
0
votes
1answer
64 views

Authenticating on the client with OpenID Connect using Authorization Code flow?

Our company has a series of software suites that we are tying into a single OpenID Connect Resource Server. All but one of our applications can use Authorization Code flow as normal, redirecting ...
0
votes
0answers
65 views

OAuth 2.0 client redirect endpoint security

This question is about securing the redirect endpoint on the client side at the end of an "authorization code" flow. We have designed a back-end server that handles the OAuth 2.0 authorization ...
0
votes
1answer
117 views

Securing Java REST Api for Saas usecase

I'm building a Java RESTFul API with Jersey2. The API will be consumed by Developers. The developers should gain access to the endpoints via an access_token (preferably non-expiring). I had a look at ...
0
votes
2answers
361 views

multi tenancy and microservices API authentication/authorization

I'm seeking advice on how we may be able to implement authentication and authorization for multitenancy with slightly different number of scenarios. We are building a set of API's which of some are ...
2
votes
1answer
99 views

Handling Authentication without a unique username or password

Working on a project and I have to authenticate a user that does not have a username ( '' ) or a password ( '' ). There are users and guest_users, but a guest_user won't have to explicitly log-in, ...
7
votes
1answer
340 views

Including a OAuth client_secret file in a Java application

A client_secret.json file is used in the OAuth 2.0 authorization flow for the Google Drive API (example). If I include client_secret.json in my Java application, access the JAR contents is extremely ...
5
votes
2answers
122 views

What to use as 'state' in OAuth2 Authorization Code Grant workflow

I'm using csrf protection in my web app. Now I'm planning to trigger a OAuth2 Authorization Code Grant workflow, starting with a static template opened in a new browser window using window.open(...
6
votes
1answer
74 views

Does OAuth effectively mean allowing an app to do everything as me?

Some OAuth providers (like Google or Facebook) only grant limited privileges to the third party apps, and they state so clearly on the authorization page. For example, they say that an app can see who ...
3
votes
1answer
197 views

Using Google Cloud Platform to store credit card data

I have made an iPhone app for users to book hotel rooms. A third party provides the service for booking the hotel rooms and charging the credit cards. At the moment, my app makes no attempt to save ...
2
votes
0answers
32 views

Is it a bad idea to provide a “testing” OAuth ID and secret?

I'm working on a web app, and I may eventually want to bring others onto the project. I have two sets of GitHub credentials: one called Foo that calls back to foo.com/endpoint, and one called Foo -- ...
2
votes
0answers
51 views

What are the most common ways to Architect the verification process of the access tokens between resource and authentication server using OAUTH 2.0?

What are the most common ways to Architect the verification process of the access tokens between resource server and authentication server using OAUTH 2.0? I am trying to build a web application ...
6
votes
2answers
170 views

Mobile API Authentication

I'm trying to design an Android Analytic service where every user's application who register in this service needs to download our SDK. The SDK itself need to communicate with our API server. The ...
8
votes
2answers
253 views

How do high-performance web applications control permission to their content?

So, I believe I understand the logic behind authorization standards like OAuth. The OAuth token contains information about the user (name, role, etc.), which I can use to secure my application. It'...
3
votes
1answer
284 views

Would this work to protect a cookie with an OAuth token?

I'm currently trying to set up an OAuth 2.0 authentication scheme to protect some stateless REST webservices. These services deal with sensitive information, and the OAuth support is a requirement. ...
2
votes
1answer
240 views

OAuth 2.0 client side redirect instead of HTTP redirect

I'm implementing an OAuth 2.0 authorisation server using the Authorization Code flow (i.e. users will authorise client apps to connect to our server). The auth server is the same as the resource ...
4
votes
1answer
127 views

Create a web session from within a 3rd party website using an existing oauth2 token

We're trying to allow a trusted 3rd party web application to automatically authenticate users in our own application. We thought about using oauth2 for that matter. In our scenario we would provide ...
2
votes
2answers
387 views

password grant without client secret?

I'm struggling to decide what to do to get an access token from a mobile app. I'm sure this has been covered before, but I can't find it. I've enabled resource owner credentials grant on my oauth2 ...
2
votes
1answer
235 views

Sending OAuth refresh token in email?

We are building a mobile app that will use OAuth2 to authentication the users via the grant_type "password" (two-legged setup). So basically the user just sends the username and password, receives an ...
1
vote
0answers
30 views

Scope handling in OAuth2 protocol

I have a general question regarding how scopes in the OAuth2 protocol are handled. For easy argumentation lets start with a concrete example: Lets say I have an OAuth server A which I want to use in ...
6
votes
1answer
6k views

Where to store access and refresh tokens on ASP.NET client web app - calling a REST API

I've made a Web API in ASP.NET that acts as the entry point into a SQL Server database for report data. This service has a "token" endpoint that authenticates a user via ASP Identity and return a 20-...
4
votes
3answers
217 views

Can OAuth2 help to authenticate the app?

We have a mobile app that communicates with our server via a RESTful HTTPS API. We also have an attacker pretending to be our app while attempting to communicate with our web services API. We assume ...
0
votes
0answers
60 views

Are Android Facebook OAuth tokens vulnerable to theft?

If I have access to someone's unlocked Android phone, is it possible to get hold of their OAuth token for Facebook and use it on another device?
3
votes
1answer
161 views

OAuth2 Client Credentials & Native Apps

The OAuth2 spec seems to consider native (Android & iOS) apps as "public clients", ultimately meaning that they can't use the "client credentials" flow. That being said, how does one go about ...
1
vote
1answer
46 views

Authorize the access ability to a user in Oauth 2.0?

As far as i known, the protocal OAuth2.0 will bring the access ability from the resources owner(A) to the client. But in the scenario here, I wonder if it is possible to authorize the access ability ...
3
votes
1answer
849 views

Why use a proxy to hide OAuth client credentials in password grant calls?

In a November 2014 article by Alex Bilbie, OAuth users were advised against making the client send its credentials (client_id and client_secret) when performing Resource Owner Password grant calls. ...
0
votes
1answer
1k views

Best way to deal with cross-domain authentication in intranet

Firstly, I'm not sure if this is valid board to ask this question - maybe it should be asked on StackOverflow? Overview on use-case, what we trying to achieve: Two servers, on two different domains; ...
-1
votes
1answer
766 views

OpenID Connect as SSO

I recently research the SSO solution, and I went into the OpenID connect framework; but after several days of research, this makes me confused that the 'OpenID Connect' protocol does not define the ...
2
votes
1answer
292 views

Reasons why there are no web based unified email clients (with OAuth2)?

There are plenty of mobile applications that you sign into with different accounts to retrieve email, contacts, and calendar (such as CloudMagic), and a couple desktop clients (such as Inky). Yet I ...
1
vote
0answers
33 views

OAuth client credential flow and sessions [closed]

When a web server uses client credentials grant to perform OAuth and access APIs in a backend service, should it create one token for every user login to the web server ?
2
votes
1answer
246 views

Is it safe to create a user account using the id_token provided by google's sign in?

I have a chrome extension which allows users to exclusively login with google and no other provider. In my (node + couchdb) backend I need to construct a user account from the auth Response provided ...
2
votes
2answers
552 views

Stealing OAuth2 Tokens from IoT Devices

As I am delving into different forms of session authentication and persistence, I started to question how tokens are stored and the risk of a token being compromised. The scenario I have in mind is as ...
20
votes
2answers
6k views

OAuth 2 vs OpenID Connect to secure API

I am developing a Web API which will back several applications: a website, a companion mobile application(s) and possibly several third-party applications. Every application is expected to get an ...
2
votes
2answers
1k views

How to safely store bearer tokens on server?

Imagine you're running a service that implements an OAuth 2.0 flow to allow your end users to log into 3rd party apps, and authorize those apps to consume your service's data through some API. Upon ...
17
votes
6answers
852 views

Securing web applications with only a reverse proxy

In order to secure its public HTTP API (so called REST), my client is asking me to implement a simple HTTP reverse proxy that will verify (OAuth 2.0) access tokens and forward HTTP requests to ...
-1
votes
1answer
442 views

Authorization/authentication strategy for micro service apps

How can one enforce authorization/authentication for micro service apps? And also, how to achieve SSO (single sign-on) from an end user's perspective? E.g: Assume a shopping site which has many micro ...
3
votes
1answer
160 views

API which does not allow to invalidate session on server side - how to make it more secure?

I'm writing an app around a REST API which does not allow the server to invalidate a session - i.e. there's no endpoint like logout which will make the cookie my app is using be invalid from now on. ...
2
votes
0answers
106 views

OAuth2 Authorization and Resource server certificates

I'm implementing a custom IAuthorizationServerHost using DotNetOpenAuth library. Example implementation uses two certificates for CreateAccessToken (see Listing 6): public AccessTokenResult ...
0
votes
0answers
128 views

Comparing Oauth and JWT auth in my web application

I have created an e-commerce website which has a REST API on the server side and Angular on the client side. I am considering to use OAuth to secure my API, but it seems to overkill because I have no ...
3
votes
0answers
201 views

Is it safe to store bearer tokens in an iframe and/or pass them back to the parent window?

I am not a security expert, so I am hoping that a few of you might be able to tell me if there are any gaping flaws in the security design for my web app. Hopefully I'll be able to explain this ...