OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

learn more… | top users | synonyms

3
votes
1answer
280 views

Compromised JSON Web Token (JWT) Bearer Token

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
1
vote
1answer
26 views

Using OAuth 2.0 without token storage

I am building a system for a product which requires Authentication and Authorization. Naturally I have chosen using OAuth 2.0 as it is a commonly used protocol and has proven to be useful. I am ...
1
vote
1answer
57 views

Can Facebook login to my app?

This sounds maybe like a stupid question, but I'm wondering myself if this is theoretically possible. Let's say I'm using Facebook login in my app. If the login is successful I get I get back an ...
2
votes
1answer
249 views

how secure is javascript based oauth2.0

Javascript based oauth exposes the client id of the application and it trusts only on the domain requesting the access token. The domain name can be forged with a dns hijack(or a virus affecting ...
2
votes
1answer
485 views

Facebook oAuth2 for Javascript client application

When implementing Facebook login using oAuth2 (the Javascript version), I receive an access token back from the Facebook auth server. So far so good. The problem I have is that I want to implement a ...
0
votes
0answers
152 views

Starting database security for web app that logs in with Facebook/Google JS SDKs

I have been making a web app that uses Facebook and Google JavaScript APIs to login (no email login) on the client side and currently it accesses a localhost MySQL database directly using PHP and ...
4
votes
1answer
53 views

OAuth - Why exchange the authcode for a token

In OAuth, when the user authorizes the client the client gets a authorization code, the client then exchanges this for a token that is used to access the resource. Why do we need to do this extra ...
0
votes
1answer
23 views

Is there an overview over all OAuth2-related specifications?

I recently started to read up on OAuth2, and just now noticed how many extensions exist to this protocol. Is there an overview or some kind of a map of OAuth2 and all of its (official) extensions? I ...
3
votes
1answer
189 views

OAuth2 - Is it safe to return the access-token to the user?

I'm new to OAuth (1 & 2), and I'm developing the server side of a mobile app that has a form with a "Fill Details from Google account" button. I don't need any long-range ...
2
votes
1answer
262 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
1
vote
0answers
42 views

Best practices for OAuth 2.0

I understand that OAUth 2.0 really just relies on SSL to encrypt the contents of the bearer token. However, are there any other best practices one should follow when securing OAuth 2.0? I know you ...
1
vote
1answer
35 views

Securing an OAuth / OpenID Connect identity in a cookie for easy login

I have a website that uses Azure Active Directory or Google+ for logging in. I go through an OAuth2 login flow, and the users email along with their tokens are returned to me by their identity ...
1
vote
1answer
42 views

Is it safe to store important data in an encrypted access token?

Is it safe to store important data in an encrypted access token? For example, instead of storing access tokens in a database, not storing them at all and putting their associated data into them before ...
0
votes
2answers
109 views

Steps to create user authentication system between mobile and server

First time doing a secure login from a mobile app to a server (built in java). I want to understand if I got this right. Login in for the first time: 1. On the mobile device hardcode a security ...
4
votes
3answers
660 views

OAuth2 authorization - save token in the cookies or in the session?

I'm a security newbie. I'm implementing oauth on my site and I want to ask where I should save my access token: cookies session (will be fetch from the server via ajax request) I have backend ...
1
vote
1answer
77 views

advantages of http basic authentication over token-based (e.g. oauth2)?

I am interested in the question if there are any possible advantages to securing a given REST API for web clients and mobile apps with http basic authentication (over https of course) over a ...
4
votes
2answers
152 views

Google+ Sign In - One Time Code Flow vs Pure Server Side flow

I'm reading the documentation about Google+ Sign In, more specifically, its server side flow. It says (https://developers.google.com/+/web/signin/redirect-uri-flow) that one-time code flow has ...
4
votes
1answer
554 views

What are the dangers of allowing “less secure apps” to access my Google account?

According to https://support.google.com/accounts/answer/6010255: Google may block sign in attempts from some apps or devices that do not use modern security standards. Since these apps and devices ...
35
votes
6answers
6k views

Can someone explain the “Covert Redirect” vulnerability in OAuth and OpenID?

CNet is reporting that all OpenID and OAuth sites are vulnerable to an attack called "Covert Redirect". What is this attack, how does it work, and as an end user, how can I mitigate the risk?
3
votes
2answers
303 views

Secure REST API and Single Page App by using external OAuth 2 Authorization Code

I am trying to understand how to implement an OAuth 2 Authorization Code flow when having both a single page JS app and a REST API. The aim is to secure access to the REST API by offloading ...
3
votes
2answers
105 views

Am I understanding correctly how to stop a certain OAuth2 session fixation attack?

Please find here described an OAuth2 session fixation attack. Is the attack possible? And am I understanding correctly how it can be stopped? The attack Mallory starts logging in at ...
1
vote
3answers
450 views

OAuth2 - Resource Owner Password Credentials grant

The OAuth2 spec describes the Resource Owner Password Credentials grant type and authorisation flow here. I understand that only 'trusted' client applications would be allowed to use this grant, for ...
1
vote
1answer
123 views

What's the security impact of tampering with Google OAuth continue parameter?

What's the security issue of this scenario related to tampering with the continue parameter: Go to: https://accounts.google.com/ServiceLogin?service=[service ...
0
votes
0answers
52 views

OAuth2 vs. JSON authentication

1) To what extent is OAuth2 more secure than JSON authentication (both over SSL)? The context is a client (one server) querying another server (via API) within a local network using RESTFul. Prior to ...
2
votes
2answers
73 views

OAuth Authorization flow and redirect

I started looking at OAuth - Google's and Facebook's implementation. Both of the implementations, in the authorisation flow, seem to send the "Authorization code" back to the web browser. I was ...
0
votes
0answers
30 views

OAuth implicit flow and confused deputy problem

I'm reading about Google OAuth and implicit flow. In Google docs it says that the access token received using the implicit flow must be validated otherwise the application might be vulnerable to ...
5
votes
2answers
233 views

Multi sub-domain login for content, spring security for main

Illustration : mainsite.com and contentsite.com both are being developed for same company by two teams. we will have login etc at mainsite.com contentsite.com will have some content that is not ...
0
votes
1answer
116 views

Why can Oauth2 redirect_uri be a non-https URI?

I'm building a small site which I would like to integrate with LinkedIn for authentication. LinkedIn says that redirect_uri's can be either http:// or https:// (not having to pay for a certificate is ...
1
vote
0answers
47 views

suspicious oauth2 implementation detail in facebook API

in RFC 6749 The OAuth 2.0 Authorization Framework 2.3.1. Client Password definitely states that authentication at TokenEndpoint can be done in two alternate ways HTTP basic authentication - ...
3
votes
1answer
62 views

When implementing an OAuth provider, what is the right granularity for a “scope”?

If I'm an OAuth provider and I want to empower the user to restrict apps to only a subset of resources (for example, only resources in folder X), what is the right mechanism to do this? Scopes would ...
1
vote
1answer
287 views

Security: Oauth and Mobile apps

This is what I believe are the security implications of integrating Oauth using embedded webview vs browser in mobile application. Embedded Webview * Keep UI for mobile app Security implications ...
1
vote
1answer
74 views

Auth / Login token schema

According to this answer, a valid login token schema would consist of the username (U) the time of issuance (T) and secret key K owned by the server only The suggestion then is to concatenate the ...
3
votes
1answer
136 views

Why does OAuth2 demand client credentials in an authorization header?

In section 2.3.1 of the the OAuth 2.0 Authorization Framework it states: The authorization server MUST support the HTTP Basic authentication scheme for authenticating clients that were issued a ...
4
votes
1answer
404 views

Authenticate users through Google using only an OAuth2 access token

I have a question about having users logon to my service using their Google Credentials. I've gone through the Using OAuth 2.0 for Login documentation provided by Google. The documentation mentions ...
2
votes
1answer
49 views

Usefulness of bcrypt(UUIDv4())

One of my colleagues is working on securing OAuth 2 client IDs and secrets for our OAuth server and he has come up with this scheme where he would not only use UUID v4 to generate random values, but ...
7
votes
1answer
136 views

Is it possible to implement a nonce without storage?

I am looking at implementing an authentication module using OAuth 2.0 Client and I am trying to avoid having any server state. I was going thorough a few other questions when to use nonce? Is it ...
0
votes
0answers
120 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
0
votes
0answers
79 views

OAuth - Facebook custom authorization grant

I've developed my own custom authorization grant. The steps I am undertaking are the following: I get the facebook authorization code from the mobile device (this is an an API for mobile devices) I ...
6
votes
4answers
1k views

Is 'Bring your own Identity' as the only authentication option a valid practice?

This question is mainly aimed at OpenID Connect, when it is fully realized. I understand the aversion to signing in with a social networking site, but from what I understand about OIDC, its supposed ...
0
votes
2answers
105 views

Securing Public Web Services - What is the best practice? [closed]

There seems to be a number of ways to secure web services. OAuth, API Keys, Tokens, WIF, etc. Since security is not my area of expertise, I am asking what is the best ways to secure public web ...
2
votes
1answer
82 views

Using OAuth as Security For E-Commerce Sites

I need some help in understanding the security risks if I want to use OAuth 2.0 (Facebook, Twitter and G+) as standard login provider for an E-Commerce site. Keeping in mind that I will not be saving ...
1
vote
2answers
178 views

Is Tweetdeck authentication really safe?

I have recently installed Tweetdeck, because my previous client stopped working. In my custom client, and in the third party client I have used previously I had to setup authorize the application in ...
11
votes
2answers
6k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
1
vote
0answers
68 views

using oAuth2 auth dance vs oAuth1 signing

I have been reading about oauth and 'how to create apis'. In oauth2, there is what they call the authentication dance where the client will be requesting a request token using a consumer key and ...
4
votes
3answers
3k views

SAML2 vs. OAuth - What are some reasonable relationships?

I have a service that allows SSO via SAML2. When SAML2 is used, we delegate the entire authentication process to the Identity Provider. We are considering adding OAuth in order to support some ...
9
votes
2answers
4k views

OAuth2 Cross Site Request Forgery, and state parameter

http://tools.ietf.org/html/draft-ietf-oauth-v2-30#section-10.12 says: The client MUST implement CSRF protection [...] typically accomplished by requiring any request sent to the redirection URI ...
1
vote
1answer
145 views

Should I keep all UUIDv4 generated oAuth2 Bearer Tokens in my database to prevent an attack?

I generate oauth2 access and refresh tokens and store them in my database. I generate these tokens using UUID v4 and remove the dashes. I used to delete the tokens after they expire but now I store ...
1
vote
1answer
144 views

OAuth and public keys

I'm trying to wrap my head around the whole concept of public keys and Oauth. I get the basic Oauth and PKI flow and the different actors involved but I'm still unsure how public/private keys play a ...
7
votes
1answer
99 views

What are the implications of publicizing a consumer secret for sharing between developers doing local website development?

In relation to this GitHub issue on the Gittip project (which turned out to be a false alarm), what are the security implications, if any, of hardcoding into the git repo a test app's OAuth consumer ...
3
votes
1answer
833 views

Why is OAuth 2.0 being used for mobile devices, and not OpenID?

Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices. Question What ...