OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

learn more… | top users | synonyms

2
votes
1answer
180 views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
0
votes
1answer
111 views

Sharing access-tokens in response header?

What's the best way to share my access tokens, I mean, is it okay to share it in the header as plain-text? - Or do I need to look into e.g.: JWT? Current workflow: -> POST /api/login -d {**creds} ...
5
votes
3answers
286 views

Authentication Middleware

We run a large distributed system consisting of a number (>10) of Django-based web services and web applications with a consumer base of about 10000 university students. Currently, we use a single ...
43
votes
5answers
8k views

What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?

Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook. One advantage ...
1
vote
0answers
15 views

JWT vs. Client Certificates

We have a transaction server that is connected to by different client applications. The requirement is to have a secure means of authentication for client applications to communicate with the ...
1
vote
0answers
49 views

Security of GMail API full-access scope

Recently more and more online services are popping up to help manage the mail of Gmail, such as Boomerang, Gmelius and many others. To work correctly they require a full access scope to the gmail api,...
41
votes
7answers
24k views

Why use OpenID Connect instead of plain OAuth?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...
2
votes
0answers
16 views

How do we get a JWT bearer grant with required audience?

According to the OAuth JWT Bearer grant spec, a valid JWT should have some sort of identifier (token endpoint may be used) of the token issuing authorization server within the audience claim. The ...
3
votes
3answers
65 views

Why is it required in OAuth 2.0 that refresh token cannot be guessed?

From RFC 6749 (section 10.4): The authorization server MUST ensure that refresh tokens cannot be generated, modified, or guessed to produce valid refresh tokens by unauthorized parties. I don't ...
4
votes
1answer
59 views

Any scenario for using both, OpenID Connect and OAuth 2.0?

Since OpenID Connect builds on OAuth 2.0, I am assuming that everything that is possible with OAuth 2.0 is also possible with OpenID Connect. In particular, say that my website stores some ...
6
votes
2answers
170 views

Mobile API Authentication

I'm trying to design an Android Analytic service where every user's application who register in this service needs to download our SDK. The SDK itself need to communicate with our API server. The ...
4
votes
2answers
660 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
7
votes
2answers
297 views

Microservice to Microservice Auth

We're planning a new architecture which will utlize a backend of many different microservices that will need to talk with each other as well as field requests from systems not part of the service. In ...
1
vote
1answer
27 views

How to cycle OAuth2 client secrets without downtime

I have an app that relies on several OAuth2 providers to poll for background data on behalf of users, as a background process. As a matter of best-practice, I'd like to periodically cycle my client ...
0
votes
1answer
87 views

Why Oauth2 specification considers native desktop application clients less secure than web server application clients?

I assume here that the web server is owned the client as is the desktop. If they aren't, then I have my answer and I misunderstood the differences between desktop Vs web server clients. If they are ...
3
votes
1answer
31 views

How is an authorization server supposed to require client auth for confidential clients?

The OAuth2 password grant_type states, If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate ...
1
vote
0answers
18 views

Odd history of OAuth 2 device flow

OAuth 2 device flow has an odd history. It's found in early versions of the RFC, but was then taken out seemingly without an explanation I could find. Recently, a new draft was proposed specifically ...
3
votes
0answers
203 views

Is it safe to store bearer tokens in an iframe and/or pass them back to the parent window?

I am not a security expert, so I am hoping that a few of you might be able to tell me if there are any gaping flaws in the security design for my web app. Hopefully I'll be able to explain this ...
2
votes
1answer
1k views

OAuth and public keys

I get the basic OAuth and PKI flow and the different actors involved but I'm still unsure how public/private keys play a role. When a client identifies itself upon registration with a certified ...
7
votes
1answer
6k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
6
votes
1answer
146 views

If I misuse OAuth 2.0 to do authentication, am I at risk?

I understand that OAuth is not an authentication protocol, not authorization one (even if the first paragraph on Google's OAuth 2.0 page disagrees), as well as that: [...] authorization can be ...
1
vote
1answer
238 views

OAuth + Confused Deputy + access token verification + state parameter

Google's "Using OAuth 2.0 for Client-side Application" article at https://developers.google.com/accounts/docs/OAuth2UserAgent states that the client MUST validate all access tokens to verify that it ...
4
votes
2answers
97 views

Google OAuth 2.0 and Java. Is it safe to locally store access tokens?

I Installed this Java app: https://github.com/andresoviedo/google-drive-ftp-adapter The program asks permission to see my Google-Drive files and then stores an access-token on my local harddisk. ...
40
votes
6answers
12k views

Can someone explain the “Covert Redirect” vulnerability in OAuth and OpenID?

CNet is reporting that all OpenID and OAuth sites are vulnerable to an attack called "Covert Redirect". What is this attack, how does it work, and as an end user, how can I mitigate the risk?
1
vote
1answer
60 views

How does JTI prevent a JWT from being replayed?

According the JWT RFC a JWT token can optionally have a jti which I interpret to be an a unique ID for a JWT Token. Seems like a UUID is a good value for a jti. The RFC claims that the jti can be used ...
-1
votes
0answers
64 views

HMAC Signature Based authentication for REST APIs

We are building publicly available RESTful APIs for eCommerce where clients can place logistics requests with us. We want stateless authentication on these APIs. While on-boarding, every client will ...
47
votes
10answers
5k views

Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
3
votes
1answer
42 views

Translate token into cookie

I find myself in a situation where I need to hand a user off from a mobile application into a web application. The mobile application is using WebAPI on the backend with OAUTH 2. The web application ...
3
votes
0answers
946 views

Social Login + OAuth2-secured REST API

I'm implementing social login with Facebook, Twitter and Google+ on our OAuth2-secured REST API (secured using spring-security-oauth). I'd like to make sure that the following flow is secure and that ...
1
vote
4answers
376 views

OAuth2 vs. JSON authentication

1) To what extent is OAuth2 more secure than JSON authentication (both over SSL)? The context is a client (one server) querying another server (via API) within a local network using RESTFul. Prior to ...
0
votes
1answer
43 views

Protecting third-party credentials in a web database in light of weak passwords

I need to store third party credentials in a database for a web application. The third party supports OAUTH and I plan on getting a long-lived token to allow my app to access the third party, but I ...
0
votes
0answers
43 views

Token-based SSO for multiple domains for backend API requests

I’m in the process of setting up SSO for a service I’m creating. After looking at solutions, I’ve found nothing to fit exactly what we need. I’m looking to make sure from a security standpoint what we ...
4
votes
1answer
139 views

Is using OAuth for login less or more secure than maintaining your own passwords?

Pros: The complexity in managing passwords is maintained by a company with stronger security policy. Let's assume they secure passwords properly. The user doesn't have to maintain yet another ...
3
votes
1answer
62 views

JWT authentication and authorization schema

I was going through Oauth2 docs and thought it was kind of permissive security wise, so i tried to implement JWT tokens with a special scheme like in the picture for a mobile app communicating with a ...
1
vote
0answers
58 views

SAML, OAUTH, XACML oh my (Authorization)!

Unfortunately, after using several SSO/IAM products at a 'lite touch' to 'deep integration' level, I'm still left unsatisfied, so going to ask the most basic question I can: Given multiple ...
0
votes
0answers
147 views

How to do role-based authorization with OAuth2 / OpenID Connect?

I'm trying to use OAuth2 for authentication/authorization, but after much reading around, I am confused... I'm trying to understand how OAuth and OpenIDConnect relate to each other, and how exactly I ...
0
votes
1answer
23 views

How to properly secure a resource server, but allow public clients to have access in a machine-machine style without user interaction

My scenario is this, I have my web API that I want to protect from external people, but I want to allow access for my own applications that could be running in windows forms/android/ios/etc... [...
1
vote
1answer
26 views

Using external OAauth Authentication Service, how to manage the users's relations

I'm trying to create an API and a website client for it. Lately I've been reading a lot about OAuth2 as a security mechanism and companies that offers authentication as a service such as auth0.com or ...
1
vote
0answers
35 views

OAuth 2.0 Resource Owner Password Grant - Handling of Access Token Upon Logging Out

I am new to OAuth 2.0. I used BShaffer's OAuth PHP Server on Authorization Code Grant, and I understand that the client application can have its OAuth token separate from its session authentication, ...
1
vote
2answers
98 views

Why are Facebook, etc. considered as typical authorization servers in OpenId?

The OAuth2 specification says: The interaction between the authorization server and resource server is beyond the scope of this specification. The authorization server may be the same server ...
5
votes
2answers
122 views

What to use as 'state' in OAuth2 Authorization Code Grant workflow

I'm using csrf protection in my web app. Now I'm planning to trigger a OAuth2 Authorization Code Grant workflow, starting with a static template opened in a new browser window using window.open(...
2
votes
0answers
113 views

Combining id_tokens and access_tokens for new auth spec

A common misuse of OAuth2 is as a strict authentication protocol. OpenID Connect addresses this by extending OAuth2 to include an id_token. Implementing clients for OAuth2 and OpenID Connect is a ...
1
vote
0answers
91 views

OAuth2 JWT Encryption for Tokens with Scopes to Multiple Resource Servers

Within the context of an OAuth2 deployment, I would like to grant a Client an encrypted JWT that has scopes that to several Resource Servers and can be decrypted by each Resource Server independently ...
1
vote
0answers
29 views

what does `client_id` mean in password credentials grant of OAuth 2.0?

Public clients can't hide their requests. So password credentials grant doesn't need clientSecret. What I'm curious is, is there need client_id? because hacker or client user can know or trace the ...
6
votes
2answers
194 views

OAuth2 and Authentication

I see a lot of confusion about OAuth2 and Authentication so I created this question in the hope to clear some of the confusion. So, let's talk about the following points : What is the difference ...
7
votes
1answer
343 views

Including a OAuth client_secret file in a Java application

A client_secret.json file is used in the OAuth 2.0 authorization flow for the Google Drive API (example). If I include client_secret.json in my Java application, access the JAR contents is extremely ...
2
votes
0answers
264 views

If my users use Google OAuth for authentication, can I allow 3rd party apps to read data on my site?

Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn. When the book club becomes popular, we discover that 3rd party ...
1
vote
3answers
110 views

3rd party API access: Is OAuth really required?

Having a web application with a REST API (say, our-app.com), we want to open our API to 3rd party web applications (say, their-app.com). After some research, having read about OAuth, OpenID Connect, ...
2
votes
1answer
49 views

OpenID Connect: API access using same identity provider

Does OpenID Connect support the following SSO-like scheme: Both website S and some meta-website M support login using OpenID Connect, e.g. with a Google account. Is it possible for M to access a ...
1
vote
3answers
63 views

OAuth2 client registration: should redirect_uri be unique across clients?

When operating an OAuth2 Authorization Server: The authorization server MUST require the following clients to register their redirection endpoint: o Public clients. o Confidential ...