OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

learn more… | top users | synonyms

2
votes
2answers
172 views

Does providing OAuth for mobile apps pose a security threat?

Let's take a look at the basic OAuth workflow: The basic idea is that the Consumer (App) asks the user to grant him access to the Service Provider. The service protects the user by asking him each ...
4
votes
2answers
2k views

SAML2 vs. OAuth - What are some reasonable relationships?

I have a service that allows SSO via SAML2. When SAML2 is used, we delegate the entire authentication process to the Identity Provider. We are considering adding OAuth in order to support some ...
6
votes
2answers
304 views

Client authentication vs. user authentication

I am currently looking into authentication protocols which work well with REST API, in java. There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
10
votes
2answers
219 views

Preventing Voter Fraud on a Social Media Contest

I'm creating a contest that will allow users to login using their Facebook & Twitter accounts and submit votes on videos. My clients concern is that users will game the system by logging into ...
3
votes
1answer
306 views

Will using external OAuth providers for authentication protect users better than custom authentication?

On StackExchange we have the ability to choose to use our existing credentials with external OAuth providers such as Facebook or Google. This is convenient for users, but does it also have potential ...
0
votes
1answer
317 views

How can I ensure privacy when outsourcing authentication to an IdP (Identity Provider)

I need to outsource authentication to an IdP (Identity Provider) but I don't want that IdP to know of the calling site. The two major issues are the callback URL and the referer header. Is there any ...
3
votes
3answers
146 views

OAuth in open-source plugin

I'm designing an API server and client pair. Typically, I want the client to be in a WordPress plugin. I'd like to use OAuth or something similar to secure the requests. However, as you know, OAuth ...
2
votes
1answer
337 views

OAuth: client credentials vs tokens

Wouldn't it be much simpler and virtually equally secure to replace tokens by pure client credentials? Client credentials wouldn't expire and resource owners would always be able to modify their ...
2
votes
1answer
118 views

Does OAuth 2.0 provide a way to reliably regenerate a key only when a session is active?

I want to encrypt sensitive data on my app server (facebook app) in such a way that my app may only decrypt this data when the user is in an active session. I need to be able to reliably ...
0
votes
0answers
19 views

Facebook Login security concern with the javascritp JDK [duplicate]

Possible Duplicate: Isn’t OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint? I have some real concerns about how to use facebook login for my wabb-app. I have a ...
3
votes
3answers
565 views

Access Control and Authentication using Facebook access tokens in a webapp

I'm working on a mobile app with a web backend. We'd like to have users authenticate (log in) themselves through Facebook only, so we don't have to store passwords etc. and don't force users to create ...
5
votes
1answer
262 views

API Design Model - Client Side Encryption

I'm currently designing a API Model to use. A user will have a 'secret_api_key' and a 'public_api_key'. They will send a request to my server with the public key, the form data, and then a hash. The ...
7
votes
1answer
1k views

Storing OAuth and other authentication tokens

We all know that when to store passwords, we should store it with one-way hash such as a variant of SHA, bcrypt or scrypt to prevent plain-text password leaks when the database is hacked. But what ...
3
votes
2answers
256 views

Is it possible to find out the oauth 2.0 client id and secret when an app is communicating with a web service?

I'm building an mobile app that needs to communicate with a web service. To make sure that only my app is communicating with the web service, I authenticate using OAuth 2. The fact that I need to ...
4
votes
1answer
775 views

Is it safe to store twitter access tokens client side?

After the Twitter oauth process, once I finally get my access_token_key and access_token_secret is it safe to store these in a javascript variable client side? As far as I can work out nothing can be ...
5
votes
1answer
70 views

What are the security challenges encountered with attribute exchange?

OpenID has Attribute Exchange, Facebook has Facebook Connect, and authorization services such as Oauth enable access to user data distributed across a range of content providers. What are the ...
6
votes
2answers
5k views

OAuth access token vs session key

Is there any advantage to OAuth vs cookie-based sessions (established via username/password) under the following assumptions? There is only one legitimate client to the service The OAuth client ...
7
votes
1answer
2k views

OAuth2 Cross Site Request Forgery, and state parameter

http://tools.ietf.org/html/draft-ietf-oauth-v2-30#section-10.12 says: The client MUST implement CSRF protection [...] typically accomplished by requiring any request sent to the redirection URI ...
6
votes
2answers
452 views

Should I avoid this token-based authentication scheme (that's not OAuth)?

I've dealt with OAuth before but I'm not too sure about the API I'm working with now. My question is basically, is this woefully insecure? As I understand it, oAuth does the following (roughly): ...
12
votes
2answers
4k views

Facebook API : App Secret - possible misuse

I've recently find out that by simple quick look into compiled code of one of our applications, you can get both App ID (API Key) and App Secret for Facebook API I suppose that we should really keep ...
1
vote
4answers
469 views

Security implications of using a OAuth-enabled password manager

I've resisted the idea of password managers for a long time. Bringing together passwords for all your online accounts in one place that is only protected by difficult-to-remember master password ...
7
votes
2answers
722 views

What is the benefit of the scope in OAuth2?

In the question, substitute scope with state. Since there is an answer based on the wrong question, I'll let everything below as is. The answer is useful nonetheless. This question refers to ...
2
votes
2answers
182 views

Are these standard OAuth2 flows? (what are their names?)

I'm developing a B2B platform, where other developers (our customers) will build shop-front style apps that leverage our platform. We expose a REST based API which our customers either call directly ...
5
votes
2answers
2k views

Security drawbacks for using short-lived access token in javascript client side

I intend to build a front end site entirely in javascript (NodeJS) and i would like to do ajax calls to a REST WS which is on another domain on client side. I intend to use oauth2 and SSL to secure ...
1
vote
1answer
398 views

Multiple security layers for SOA REST intranet services

For intranet applications that already leverage Active Directory, is there any point or benefit to adding a second layer of security such as OAuth when accessing SOA REST services? We're new to SOA ...
3
votes
2answers
7k views

How to use OAuth with Active Directory

I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
2
votes
1answer
297 views

Tomcat IP restriction vs Two Legged OAuth

We have a server side API that is completely REST based. We are coding to secure them with two legged oAuth type authentication. We are planning to iPhone and Android apps in the future, but for now, ...
11
votes
1answer
2k views

Best way to secure javascript front end/REST back end architecture web site?

I would like to build the following project: public REST API back end which can be accessed by any authenticated client. front end with static files in HTML/CSS/Javascript with Backbone.js jQuery ...
4
votes
2answers
612 views

Is there any drawback of using OAuth “pseudoauthentication” as opposed to OpenID?

I have seen posts that insist that OAuth is an orthogonally different thing from OpenID, because OpenID is about authenticating users, while OAuth is about giving access to certain services to a third ...
15
votes
2answers
1k views

Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML

It's clear there there is no consistent set of features among any of the popular authentication providers. Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
6
votes
3answers
194 views

Detecting OAuth malicious Implementation

I am wondering how can an end-user detect a maliciously implemented OAuth whether 2-legged or 3-legged. Particularly I am interested in those cases where the consumer requester is maliciously ...
35
votes
5answers
6k views

What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?

Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook. One advantage ...
3
votes
2answers
710 views

OAuth User revoke token

I haven't read it myself but a colleague told me that the end-user can revoke his/her OAuth token. I searched but I couldn't find enough docs on: is this true / is the end-user the one to revoke the ...
35
votes
9answers
2k views

Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
9
votes
4answers
2k views

Is Facebook Connect or Twitter OAuth PCI Compliant?

We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter. Obviously this wouldn't be secure if we were trusting just any old ...