OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

learn more… | top users | synonyms

2
votes
1answer
169 views

Using OAuth as Security For E-Commerce Sites

I need some help in understanding the security risks if I want to use OAuth 2.0 (Facebook, Twitter and G+) as standard login provider for an E-Commerce site. Keeping in mind that I will not be saving ...
1
vote
0answers
197 views

using oAuth2 auth dance vs oAuth1 signing

I have been reading about oauth and 'how to create apis'. In oauth2, there is what they call the authentication dance where the client will be requesting a request token using a consumer key and ...
1
vote
1answer
245 views

Should I keep all UUIDv4 generated oAuth2 Bearer Tokens in my database to prevent an attack?

I generate oauth2 access and refresh tokens and store them in my database. I generate these tokens using UUID v4 and remove the dashes. I used to delete the tokens after they expire but now I store ...
1
vote
1answer
151 views

What's the security impact of tampering with Google OAuth continue parameter?

What's the security issue of this scenario related to tampering with the continue parameter: Go to: https://accounts.google.com/ServiceLogin?service=[service ...
1
vote
1answer
679 views

OAuth and public keys

I'm trying to wrap my head around the whole concept of public keys and Oauth. I get the basic Oauth and PKI flow and the different actors involved but I'm still unsure how public/private keys play a ...
37
votes
6answers
9k views

Can someone explain the “Covert Redirect” vulnerability in OAuth and OpenID?

CNet is reporting that all OpenID and OAuth sites are vulnerable to an attack called "Covert Redirect". What is this attack, how does it work, and as an end user, how can I mitigate the risk?
4
votes
1answer
390 views

How secure is JavaScript based OAuth 2.0

JavaScript based OAuth exposes the client ID of the application and it trusts only on the domain requesting the access token. The domain name can be forged with a DNS hijack (or a virus affecting ...
1
vote
1answer
235 views

Confused about the most relevant way to secure my APIs

I own a Javascript application (Single Page Application) hitting some apis from my own RESTful backend. What I expect for my authentication/(authorization) mechanism is three things: Preventing ...
1
vote
0answers
71 views

Purpose of Secure Key in Facebook(and other provider) in OAUTH?

I see lot of OAUTH provider give us a secure key. What is the purpose of secure key in Facebook(and other provider) in OAUTH?
9
votes
1answer
627 views

Is logging in using OAuth/OpenID also vulnerable to heartbleed?

If one has logged into a "heartbleed-vulnerable" site using OpenID, for example, using Google to log into StackExchange, does that mean that the Google password is now at risk as well?
7
votes
1answer
109 views

What are the implications of publicizing a consumer secret for sharing between developers doing local website development?

In relation to this GitHub issue on the Gittip project (which turned out to be a false alarm), what are the security implications, if any, of hardcoding into the git repo a test app's OAuth consumer ...
1
vote
0answers
481 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
1
vote
0answers
173 views

How do I get the Access-Token and Access-Token-Secret?

Can anyone explain me these terms with respect to OAuth ? Consumer Key Consumer Secret Access Token Access Token Secret Also, when I registered my application with twitter I got the consumer key ...
3
votes
1answer
83 views

When implementing an OAuth provider, what is the right granularity for a “scope”?

If I'm an OAuth provider and I want to empower the user to restrict apps to only a subset of resources (for example, only resources in folder X), what is the right mechanism to do this? Scopes would ...
4
votes
1answer
767 views

Is OAuth always the right choice (and when isn't it)

So I am reluctant to ask too much of a noob question, as this guy aked about a non-standard approach and got down voted a bunch, but here goes. I am creating a mobile application which needs to ...
1
vote
2answers
265 views

Is Tweetdeck authentication really safe?

I have recently installed Tweetdeck, because my previous client stopped working. In my custom client, and in the third party client I have used previously I had to setup authorize the application in ...
6
votes
1answer
2k views

Does it make sense to implement OAuth when no 3rd party is involved

I own a REST API at server side and a distinct web application that would call those APIs. I want to secure my APIs calls. After some reading, I want to implement the OAuth 1.0a mechanism at server ...
1
vote
0answers
798 views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...
2
votes
1answer
504 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
6
votes
1answer
114 views

Design a webapp that uses OAuth, but with tokens that can't be used by the operator?

I'd like to make a webapp that would allow users to OAuth with Stack Exchange, so that they can perform actions like voting through the app. I'm stuck at one point, though: I know how to perform ...
1
vote
1answer
56 views

If a site says its API for login can't be made available for “Security Reasons” should I be worried

Stack Exchange API 2.2 is finally out, (Yay!) Reading through the linked blog post, i notice the line: Login methods that don’t use OAuth can’t be made public for security reasons. Is this ...
4
votes
3answers
2k views

OAuth2 authorization - save token in the cookies or in the session?

I'm a security newbie. I'm implementing oauth on my site and I want to ask where I should save my access token: cookies session (will be fetch from the server via ajax request) I have backend ...
3
votes
1answer
2k views

OAuth2 with client credentials v/s other auth mechanisms

For a REST API against which clients would be writing non-browser based, non-interactive applications, if OAuth2 is the authentication mechanism to be followed, then we would use the client ...
2
votes
2answers
558 views

Ways to authenticate client with a server

I have an app that sends an encrypted message to the server, with the sender and recipient username attached. The usernames are each linked to a unique device ID that allows messages to be sent to ...
4
votes
1answer
306 views

OAuth2 - Is it safe to return the access-token to the user?

I'm new to OAuth (1 & 2), and I'm developing the server side of a mobile app that has a form with a "Fill Details from Google account" button. I don't need any long-range ...
3
votes
1answer
376 views

Google Open ID connect and ID token

I am wondering if it is safe to send "id token", which is one of the items that are result of authenticating a user using Google Open Id Connect, to the client and use it for further authentication. ...
3
votes
1answer
191 views

Why does OAuth2 demand client credentials in an authorization header?

In section 2.3.1 of the the OAuth 2.0 Authorization Framework it states: The authorization server MUST support the HTTP Basic authentication scheme for authenticating clients that were issued a ...
4
votes
1answer
5k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
2
votes
1answer
381 views

Security: Oauth and Mobile apps

This is what I believe are the security implications of integrating Oauth using embedded webview vs browser in mobile application. Embedded Webview * Keep UI for mobile app Security implications ...
1
vote
0answers
376 views

Implementing OAuth flow in JavaScript

I am making a custom auth flow for the application. It is inspired by OAuth 2.0. Dev sends user to an auth page on my domain, passing callback_url and api_id. I redirect user to callback_url, passing ...
3
votes
2answers
468 views

OAuth for Multiparty Authentication/Authorization

I work for a web company that's undergoing a massive rewrite in order to separate our Data out into its own RESTful service application - the goal is to be able to sell access to third parties and ...
8
votes
2answers
396 views

How does an attacker abuse Facebook Connect with a leaked secret key?

I am reading about Facebook Connect and it looks a lot like OpenID Connect. Are these two similar enough that the Facebook Connect secret key is an OAuth Client Secret and therefore the same attacks ...
7
votes
2answers
4k views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User ...
1
vote
1answer
948 views

Securing REST API for mobile use with OAuth

I'm a complete noob about security, so please, forgive me if I say something wrong. I have to develop a social network. The client will be an Android app and (probably) a web page for smartphones ...
20
votes
2answers
14k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
7
votes
3answers
5k views

What is the purpose of OAuth 2.0 redirect_uri checking?

The OAuth 2.0 specification's authorization code mechanism includes redirect URI checking from the site you redirect to. See steps D and E in section 4.1 of the spec. Also, section 4.1.3 describes in ...
4
votes
1answer
848 views

Does returning `Access-Control-Allow-Origin: *` weaken the security of JSON GET responses?

The W3C CORS recommendation states: Certain types of resources should not attempt to specify particular authorized origins, but instead either deny or allow all origins. ... 3. A GET ...
2
votes
1answer
82 views

oauth and passing received toking to other application

An external software provider is hosting a website for us. We supply the login functionality via a restfull api(login/password over ssl). But the website is also the client for OAuth resource that it ...
5
votes
1answer
617 views

Oauth Consumer Secret?

Using OAuth you have a consumer key and consumer secret to identify your application and the user provides an OAuth access token and secret to authenticate your application access to their account, ...
0
votes
2answers
2k views

Google Authenticator - Counter Based [duplicate]

I'm trying to understand How google authenticator - counter based work. I have tried googling around finding a demo or at least how this work. I understand its a one time password but not like TOTP. I ...
0
votes
2answers
654 views

E-Commerce website with REST backend : do I have to secure Backend URLs accessed by Front end public pages?

I have an e-commerce website with a REST backend and a Single page JS as front end. I intend to secure my REST backend with OAuth2. I don't want to oblige the user to authenticate when he first comes ...
0
votes
1answer
641 views

Secure API access over SSL using oauth token

On the project that i'm currently working, we authenticate the clients by username and password. In this system each user has a key which is calculated from his password. However, we want to provide ...
7
votes
1answer
228 views

Are most app OAuth implementations vulnerable because of an obscured URL/origin?

I cringe every time I am prompted with OAuth in an app because of the lack of ability to verify that the page is actually originating from the represented source. Are most app OAuth implementations ...
3
votes
1answer
1k views

Why is OAuth 2.0 being used for mobile devices, and not OpenID?

Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices. Question What ...
1
vote
0answers
231 views

If my users use Google OAuth for authentication, can I allow 3rd party apps to read data on my site?

Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn. When the book club becomes popular, we discover that 3rd party ...
0
votes
1answer
475 views

What mechanism to use for simple and secure HTTP API access?

I am currently working on a service which offers a HTTP API for mobile clients. I want clients to authenticate in order to access my API. The server itself is doing the authentication there will be ...
1
vote
0answers
296 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
0
votes
1answer
102 views

Why oauth use a secret with temporal credentials?

I am trying to understand oauth protocol. I am currently looking at temporal credentials section of the oauth 1.0 sepecification. I can't understand why the secret is needed along with the temporal ...
5
votes
1answer
117 views

If a service that I registered with FB/Twitter/G+ is hacked, what mischief can be done with the oauth token?

Case in point, TrueCaller. I had logged into TC using a proxy twitter account. I am assuming that as part of the authentication process, an access_token must have been saved by TC. If the hackers ...
4
votes
1answer
868 views

Authenticate users through Google using only an OAuth2 access token

I have a question about having users logon to my service using their Google Credentials. I've gone through the Using OAuth 2.0 for Login documentation provided by Google. The documentation mentions ...