OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

learn more… | top users | synonyms

3
votes
2answers
328 views

Is it possible to find out the oauth 2.0 client id and secret when an app is communicating with a web service?

I'm building an mobile app that needs to communicate with a web service. To make sure that only my app is communicating with the web service, I authenticate using OAuth 2. The fact that I need to ...
5
votes
1answer
989 views

Is it safe to store twitter access tokens client side?

After the Twitter oauth process, once I finally get my access_token_key and access_token_secret is it safe to store these in a javascript variable client side? As far as I can work out nothing can be ...
5
votes
1answer
74 views

What are the security challenges encountered with attribute exchange?

OpenID has Attribute Exchange, Facebook has Facebook Connect, and authorization services such as Oauth enable access to user data distributed across a range of content providers. What are the ...
8
votes
2answers
8k views

OAuth access token vs session key

Is there any advantage to OAuth vs cookie-based sessions (established via username/password) under the following assumptions? There is only one legitimate client to the service The OAuth client ...
9
votes
2answers
4k views

OAuth2 Cross Site Request Forgery, and state parameter

http://tools.ietf.org/html/draft-ietf-oauth-v2-30#section-10.12 says: The client MUST implement CSRF protection [...] typically accomplished by requiring any request sent to the redirection URI ...
6
votes
2answers
562 views

Should I avoid this token-based authentication scheme (that's not OAuth)?

I've dealt with OAuth before but I'm not too sure about the API I'm working with now. My question is basically, is this woefully insecure? As I understand it, oAuth does the following (roughly): ...
12
votes
2answers
6k views

Facebook API : App Secret - possible misuse

I've recently find out that by simple quick look into compiled code of one of our applications, you can get both App ID (API Key) and App Secret for Facebook API I suppose that we should really keep ...
1
vote
4answers
552 views

Security implications of using a OAuth-enabled password manager

I've resisted the idea of password managers for a long time. Bringing together passwords for all your online accounts in one place that is only protected by difficult-to-remember master password ...
7
votes
2answers
2k views

What is the benefit of the scope in OAuth2?

In the question, substitute scope with state. Since there is an answer based on the wrong question, I'll let everything below as is. The answer is useful nonetheless. This question refers to ...
3
votes
2answers
263 views

Are these standard OAuth2 flows? (what are their names?)

I'm developing a B2B platform, where other developers (our customers) will build shop-front style apps that leverage our platform. We expose a REST based API which our customers either call directly ...
6
votes
2answers
2k views

Security drawbacks for using short-lived access token in javascript client side

I intend to build a front end site entirely in javascript (NodeJS) and i would like to do ajax calls to a REST WS which is on another domain on client side. I intend to use oauth2 and SSL to secure ...
1
vote
1answer
452 views

Multiple security layers for SOA REST intranet services

For intranet applications that already leverage Active Directory, is there any point or benefit to adding a second layer of security such as OAuth when accessing SOA REST services? We're new to SOA ...
3
votes
2answers
10k views

How to use OAuth with Active Directory

I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
2
votes
1answer
353 views

Tomcat IP restriction vs Two Legged OAuth

We have a server side API that is completely REST based. We are coding to secure them with two legged oAuth type authentication. We are planning to iPhone and Android apps in the future, but for now, ...
11
votes
1answer
2k views

Best way to secure javascript front end/REST back end architecture web site?

I would like to build the following project: public REST API back end which can be accessed by any authenticated client. front end with static files in HTML/CSS/Javascript with Backbone.js jQuery ...
4
votes
2answers
706 views

Is there any drawback of using OAuth “pseudoauthentication” as opposed to OpenID?

I have seen posts that insist that OAuth is an orthogonally different thing from OpenID, because OpenID is about authenticating users, while OAuth is about giving access to certain services to a third ...
16
votes
2answers
1k views

Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML

It's clear there there is no consistent set of features among any of the popular authentication providers. Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
6
votes
3answers
206 views

Detecting OAuth malicious Implementation

I am wondering how can an end-user detect a maliciously implemented OAuth whether 2-legged or 3-legged. Particularly I am interested in those cases where the consumer requester is maliciously ...
39
votes
5answers
7k views

What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?

Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook. One advantage ...
3
votes
2answers
795 views

OAuth User revoke token

I haven't read it myself but a colleague told me that the end-user can revoke his/her OAuth token. I searched but I couldn't find enough docs on: is this true / is the end-user the one to revoke the ...
40
votes
9answers
3k views

Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
9
votes
4answers
2k views

Is Facebook Connect or Twitter OAuth PCI Compliant?

We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter. Obviously this wouldn't be secure if we were trusting just any old ...