OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

learn more… | top users | synonyms

2
votes
0answers
48 views

What are the most common ways to Architect the verification process of the access tokens between resource and authentication server using OAUTH 2.0?

What are the most common ways to Architect the verification process of the access tokens between resource server and authentication server using OAUTH 2.0? I am trying to build a web application ...
6
votes
2answers
130 views

Mobile API Authentication

I'm trying to design an Android Analytic service where every user's application who register in this service needs to download our SDK. The SDK itself need to communicate with our API server. The ...
8
votes
2answers
243 views

How do high-performance web applications control permission to their content?

So, I believe I understand the logic behind authorization standards like OAuth. The OAuth token contains information about the user (name, role, etc.), which I can use to secure my application. ...
3
votes
1answer
219 views

Would this work to protect a cookie with an OAuth token?

I'm currently trying to set up an OAuth 2.0 authentication scheme to protect some stateless REST webservices. These services deal with sensitive information, and the OAuth support is a requirement. ...
2
votes
1answer
171 views

OAuth 2.0 client side redirect instead of HTTP redirect

I'm implementing an OAuth 2.0 authorisation server using the Authorization Code flow (i.e. users will authorise client apps to connect to our server). The auth server is the same as the resource ...
4
votes
1answer
97 views

Create a web session from within a 3rd party website using an existing oauth2 token

We're trying to allow a trusted 3rd party web application to automatically authenticate users in our own application. We thought about using oauth2 for that matter. In our scenario we would provide ...
2
votes
2answers
282 views

password grant without client secret?

I'm struggling to decide what to do to get an access token from a mobile app. I'm sure this has been covered before, but I can't find it. I've enabled resource owner credentials grant on my oauth2 ...
2
votes
1answer
166 views

Sending OAuth refresh token in email?

We are building a mobile app that will use OAuth2 to authentication the users via the grant_type "password" (two-legged setup). So basically the user just sends the username and password, receives an ...
1
vote
0answers
29 views

Scope handling in OAuth2 protocol

I have a general question regarding how scopes in the OAuth2 protocol are handled. For easy argumentation lets start with a concrete example: Lets say I have an OAuth server A which I want to use in ...
6
votes
1answer
4k views

Where to store access and refresh tokens on ASP.NET client web app - calling a REST API

I've made a Web API in ASP.NET that acts as the entry point into a SQL Server database for report data. This service has a "token" endpoint that authenticates a user via ASP Identity and return a ...
4
votes
3answers
205 views

Can OAuth2 help to authenticate the app?

We have a mobile app that communicates with our server via a RESTful HTTPS API. We also have an attacker pretending to be our app while attempting to communicate with our web services API. We assume ...
0
votes
0answers
55 views

Are Android Facebook OAuth tokens vulnerable to theft?

If I have access to someone's unlocked Android phone, is it possible to get hold of their OAuth token for Facebook and use it on another device?
3
votes
1answer
134 views

OAuth2 Client Credentials & Native Apps

The OAuth2 spec seems to consider native (Android & iOS) apps as "public clients", ultimately meaning that they can't use the "client credentials" flow. That being said, how does one go about ...
1
vote
1answer
45 views

Authorize the access ability to a user in Oauth 2.0?

As far as i known, the protocal OAuth2.0 will bring the access ability from the resources owner(A) to the client. But in the scenario here, I wonder if it is possible to authorize the access ability ...
3
votes
1answer
646 views

Why use a proxy to hide OAuth client credentials in password grant calls?

In a November 2014 article by Alex Bilbie, OAuth users were advised against making the client send its credentials (client_id and client_secret) when performing Resource Owner Password grant calls. ...
0
votes
1answer
999 views

Best way to deal with cross-domain authentication in intranet

Firstly, I'm not sure if this is valid board to ask this question - maybe it should be asked on StackOverflow? Overview on use-case, what we trying to achieve: Two servers, on two different domains; ...
-1
votes
1answer
605 views

OpenID Connect as SSO

I recently research the SSO solution, and I went into the OpenID connect framework; but after several days of research, this makes me confused that the 'OpenID Connect' protocol does not define the ...
2
votes
1answer
250 views

Reasons why there are no web based unified email clients (with OAuth2)?

There are plenty of mobile applications that you sign into with different accounts to retrieve email, contacts, and calendar (such as CloudMagic), and a couple desktop clients (such as Inky). Yet I ...
1
vote
0answers
33 views

OAuth client credential flow and sessions [closed]

When a web server uses client credentials grant to perform OAuth and access APIs in a backend service, should it create one token for every user login to the web server ?
2
votes
1answer
195 views

Is it safe to create a user account using the id_token provided by google's sign in?

I have a chrome extension which allows users to exclusively login with google and no other provider. In my (node + couchdb) backend I need to construct a user account from the auth Response provided ...
2
votes
2answers
437 views

Stealing OAuth2 Tokens from IoT Devices

As I am delving into different forms of session authentication and persistence, I started to question how tokens are stored and the risk of a token being compromised. The scenario I have in mind is as ...
15
votes
2answers
4k views

OAuth 2 vs OpenID Connect to secure API

I am developing a Web API which will back several applications: a website, a companion mobile application(s) and possibly several third-party applications. Every application is expected to get an ...
1
vote
2answers
910 views

How to safely store bearer tokens on server?

Imagine you're running a service that implements an OAuth 2.0 flow to allow your end users to log into 3rd party apps, and authorize those apps to consume your service's data through some API. Upon ...
16
votes
6answers
743 views

Securing web applications with only a reverse proxy

In order to secure its public HTTP API (so called REST), my client is asking me to implement a simple HTTP reverse proxy that will verify (OAuth 2.0) access tokens and forward HTTP requests to ...
-1
votes
1answer
398 views

Authorization/authentication strategy for micro service apps

How can one enforce authorization/authentication for micro service apps? And also, how to achieve SSO (single sign-on) from an end user's perspective? E.g: Assume a shopping site which has many micro ...
3
votes
1answer
137 views

API which does not allow to invalidate session on server side - how to make it more secure?

I'm writing an app around a REST API which does not allow the server to invalidate a session - i.e. there's no endpoint like logout which will make the cookie my app is using be invalid from now on. ...
2
votes
0answers
91 views

OAuth2 Authorization and Resource server certificates

I'm implementing a custom IAuthorizationServerHost using DotNetOpenAuth library. Example implementation uses two certificates for CreateAccessToken (see Listing 6): public AccessTokenResult ...
0
votes
0answers
121 views

Comparing Oauth and JWT auth in my web application

I have created an e-commerce website which has a REST API on the server side and Angular on the client side. I am considering to use OAuth to secure my API, but it seems to overkill because I have no ...
2
votes
0answers
157 views

Is it safe to store bearer tokens in an iframe and/or pass them back to the parent window

I am not a security expert, so I am hoping that a few of you might be able to tell me if there are any gaping flaws in the security design for my web app. Hopefully I'll be able to explain this ...
1
vote
1answer
71 views

Safely sharing session accross sub-domains

So I have a web service that is to be split up over several sub-domains. So app1.xyz.com and app2.xyz.com. Because Safari (last time I checked) does not allow for cookies to be shared across ...
0
votes
0answers
29 views

Is it possible/sensible to split an OpenID Connect endpoint into multiple endpoints?

I just created an OpenID Connect auth* service to see how it works and if we can make use of it at work. I understand some of it; I wrote a couple client apps that use the implicit flow for user login ...
1
vote
0answers
264 views

Why is using implicit grant more secure than just giving out your secret key?

The company I work for has created an API that is used by mobile devices. I've been reading up on using oAuth for mobile applications and from what I understand it is recommended that you use ...
1
vote
1answer
95 views

OAuth & SAML integration or better approach

Could anyone explain what would be the best approach for this scenario?: There are 2 separate Service Providers: System A is a server that works as a rest API for a mobile application. System B is ...
3
votes
1answer
4k views

Is my JWT refresh plan secure?

I plan on using JWT for my login system for mobile devices. There is no real standard workflow for refreshing JWT tokens I could find so I created this one below. The reason I want to use JWT is for ...
4
votes
1answer
277 views

Ouath2 how does it work (Android client)

I have read a lot about Oauth2 but still cannot understand, how does it work. I will explain how do I understand this protocol. There are some main characters in Oauth protocol interaction. User, ...
1
vote
1answer
134 views

creating a TLS encrypted API

I have an HTTP API endpoint on my server that is encrypted (TLS). It is not a public API; users must sign-in and validate their account/identity to access the API. When I connect with my test client ...
8
votes
1answer
2k views

Security of IFTTT

IFTTT looks like a powerful service but I'm also highly sceptical of its security. Could somebody give me a brief rundown of how you think it works and what the security implications are please? I've ...
2
votes
1answer
156 views

How harmful is it to expose access token to the resource owner?

While checking the facebook php sdk implementation I noticed that they expose the access token to the resource owner (user) $params = array( 'next' => $next, 'access_token' => ...
0
votes
0answers
130 views

Do I need my own oauth and/or openid connect provider

I have asked the same question on Server Fault but it possibly fits in better with the IS forum. The system I'm working on will have a mobile application, a web portal and an HTTP-based API. The ...
1
vote
0answers
256 views

In Oauth what is the benefit of the access token being opaque

Why was the decision taken that the Client doesn't need to be able to parse the access token? It seems to me that if the token included, in addition to the current fields, a client_id and a user_id, ...
9
votes
2answers
707 views

How secure are expiring tokens and refresh tokens?

In the comments of a question on StackOverflow, OAuth2 Why do access tokens expire?, people are questioning how secure refresh tokens are. This comment is how I feel: So it provides some ...
1
vote
0answers
164 views

Oauth authentication without state parameter

I have some security concerns about the first step of account authentication in my application. The authentication goes through an OpenID provider. If the response of such provider shows that the ...
1
vote
1answer
152 views

Enterprise Security : Where to Start? [closed]

I am trying to start self studying of Enterprise Security Context, but always feeling kind of lost among all the specs and standards etc. Unlike software development, this really is a challenge as far ...
2
votes
0answers
208 views

cross client (iOS,web,android) + app server + resource (Gmail) - oAuth2, how to authenticate clients [closed]

I am building a Gmail augmentation that works as a browser plugin and it will also have dedicated iOS and android clients. There is an app server that will keep track of users emails and create ...
3
votes
2answers
431 views

Decide to REST API Security

I've developed an API. I got confused and I've been reading articles for days. Actually my question is close to these but not exact (maybe a combination of them); Securing REST API that will ...
2
votes
0answers
166 views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
6
votes
3answers
1k views

How were resources shared before OAuth?

With OAuth 2.0, it is pretty straight forward for a developer to authenticate a user via another service in order to obtain its data, e.g. get tweets from a Twitter user or fitness data via RunKeeper, ...
3
votes
2answers
465 views

Why would you decouple your resource and login servers?

As described on this link, OAuth specifies that a login server and a resource server should be decoupled. The idea is that if one of your resource servers gets hacked, no password data is lost. All ...
0
votes
1answer
226 views

OAuth2 Authorization and Resource Server security check

I'm about to launch a web api using OAuth2 for authentication (authorization code, implicit and client credentials flows). The protocol is implemented using the DotNetOpenAuth v4.3 library. Although a ...
1
vote
1answer
85 views

Why should I include a client_id in an OAUTHv2 password grant request?

Like little red riding hood, you don't know who is knocking on the door... Why even bother accepting a client_id in case of a API <-> Javascript-website or API <-> Android App password grant ...