OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

learn more… | top users | synonyms

0
votes
0answers
9 views

OAuth2: What is the difference between the JWT Authorization Grant and Client Credentials Grant with JWT client authentication? [migrated]

The OAuth2 JWT Profile introduces the possibility to use JWTs both as authorization grant and as client authentication. The JWT client authentication feature is independent of a certain grant type, ...
0
votes
1answer
116 views

OAuth2 vs. JSON authentication

1) To what extent is OAuth2 more secure than JSON authentication (both over SSL)? The context is a client (one server) querying another server (via API) within a local network using RESTFul. Prior to ...
0
votes
0answers
14 views

Oauth authentication without state parameter

I have some security concerns about the first step of account authentication in my application. The authentication goes through an OpenID provider. If the response of such provider shows that the ...
3
votes
1answer
89 views

Enterprise Security : Where to Start? [closed]

I am trying to start self studying of Enterprise Security Context, but always feeling kind of lost among all the specs and standards etc. Unlike software development, this really is a challenge as far ...
4
votes
2answers
12k views

How to use OAuth with Active Directory

I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
2
votes
1answer
380 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
2
votes
0answers
24 views

cross client (iOS,web,android) + app server + resource (Gmail) - oAuth2, how to authenticate clients [closed]

I am building a Gmail augmentation that works as a browser plugin and it will also have dedicated iOS and android clients. There is an app server that will keep track of users emails and create ...
1
vote
0answers
31 views

OAuth 2 access token, pass by query or session [migrated]

I searched through similar questions but none seem to answer this particular concern: Assuming I am building a simple oauth user login system, when the oauth flow is done, should I pass the obtained ...
0
votes
0answers
32 views

Why OpenID Connect instead OAuth 2.0?

My life was very happy when I was using OAuth 2.0 tokens with grant_type=Password. My App flow: User authentication before giving OAuth tokens (AT and RT). Access token validation when user opt for ...
1
vote
1answer
35 views

Why should I include a client_id in an OAUTHv2 password grant request?

Like little red riding hood, you don't know who is knocking on the door... Why even bother accepting a client_id in case of a API <-> Javascript-website or API <-> Android App password grant ...
4
votes
2answers
190 views

Decide to REST API Security

I've developed an API. I got confused and I've been reading articles for days. Actually my question is close to these but not exact (maybe a combination of them); Securing REST API that will ...
3
votes
0answers
200 views

Social Login + OAuth2-secured REST API

I'm implementing social login with Facebook, Twitter and Google+ on our OAuth2-secured REST API (secured using spring-security-oauth). I'd like to make sure that the following flow is secure and that ...
1
vote
2answers
143 views

Using OAuth 2.0 without token storage

I am building a system for a product which requires Authentication and Authorization. Naturally I have chosen using OAuth 2.0 as it is a commonly used protocol and has proven to be useful. I am ...
3
votes
2answers
322 views

Securing a multi-tenant, multi-database REST API

I am looking to improve the security of an existing REST API accessed over SSL. The web service is multi-tenant, such that each tenant has an assigned TenantId. The problem I facing can be summarized ...
1
vote
0answers
35 views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
1
vote
2answers
174 views

How does a user get authorized wihtout authentication

I have a back-end (API) and a front-end, eg a web server, and I have users and ID-providers. The web server is provided by a third aprty and it may just as well be a mobile app, but whatever the case ...
-1
votes
0answers
19 views

OpenID is the successor of Oauth2? [duplicate]

I started to learn the two new protocols Oauth2 and OpenID, but i guess that they do the same thing ! how can i differentiate between OpenID and Oauth2. Thanks
6
votes
3answers
932 views

How were resources shared before OAuth?

With OAuth 2.0, it is pretty straight forward for a developer to authenticate a user via another service in order to obtain its data, e.g. get tweets from a Twitter user or fitness data via RunKeeper, ...
2
votes
2answers
132 views

Why do we trust session info over the wire but not an OAuth access token?

I've been spending a lot of time looking into building an API that needs to be accessible by a single page JavaScript application and how to make it as secure as possible. A lot of what I'm reading ...
22
votes
3answers
8k views

What are the dangers of allowing “less secure apps” to access my Google account?

According to https://support.google.com/accounts/answer/6010255: Google may block sign in attempts from some apps or devices that do not use modern security standards. Since these apps and devices ...
10
votes
2answers
5k views

OAuth2 Cross Site Request Forgery, and state parameter

http://tools.ietf.org/html/draft-ietf-oauth-v2-30#section-10.12 says: The client MUST implement CSRF protection [...] typically accomplished by requiring any request sent to the redirection URI ...
3
votes
2answers
65 views

Why would you decouple your resource and login servers?

As described on this link, OAuth specifies that a login server and a resource server should be decoupled. The idea is that if one of your resource servers gets hacked, no password data is lost. All ...
0
votes
1answer
388 views

ADFS 2012 R2 (3.0) JSON web token validation

Our client would like for us to utilize ADFS 2012 R2 (aka 3.0) as the primary means for two security features in internal apps that we are building: The web app (there are two .NET & Angular) ...
0
votes
0answers
22 views

OAuth2 Authorization and Resource Server security check

I'm about to launch a web api using OAuth2 for authentication (authorization code, implicit and client credentials flows). The protocol is implemented using the DotNetOpenAuth v4.3 library. Although a ...
1
vote
1answer
114 views

Risk of keeping OAuth2 client_secret in application

As an exercise, I'm developing a desktop application with which users need to log in to a web service. A logical use-case for OAuth2 one would say, but I'm beginning to doubt its usefulness. I am ...
4
votes
3answers
2k views

OAuth2 - Resource Owner Password Credentials grant

The OAuth2 spec describes the Resource Owner Password Credentials grant type and authorisation flow here. I understand that only 'trusted' client applications would be allowed to use this grant, for ...
0
votes
0answers
21 views

Using a website as a middleman for Oauth

I am working with a customer that has started to look at an unusual solution for Oauth. They have a mobile application that they want to authenticate using Oauth. To do this they are setting up a ...
3
votes
1answer
910 views

OAuth2 with client credentials v/s other auth mechanisms

For a REST API against which clients would be writing non-browser based, non-interactive applications, if OAuth2 is the authentication mechanism to be followed, then we would use the client ...
0
votes
0answers
113 views

JSON Web Tokens vs. SAML

I don't know too much about security. Specifically, I don't understand the difference between JSON Web Tokens, SAML and OAuth 2. If you could provide some pointers and high level overview of their ...
1
vote
1answer
36 views

add another layer of protection on top of oauth 2

My Rest API is protected using Oauth2. My main client is a native app. it's working great but there are certain calls to the API that i want to make sure that are performed from my client - meaning ...
18
votes
5answers
8k views

Why use OpenID Connect instead of plain OAuth?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...
2
votes
0answers
30 views

How is an OpenID Authenticated user Identified?

On a system that I'm working on a user signs up by means of an OpenID/Social Media account (Twitter, Google, Facebook), and then subsequently signs in using that path. The System comprises of a ...
0
votes
1answer
158 views

Why isn't Google oauth2 giving a refresh token for Client-side applications?

I've been reading Google's oauth2 documentation for Client-side applications. I was surprised that nowhere does it mention refresh tokens. Also, their examples hint that the access_token has a default ...
0
votes
0answers
45 views

How to associate an oAuth token with a particular user. Is this possible?

We have HTTP Rest services and SignalR (aka Web sockets, server send events, etc) for cases in which we need to push data from the server to the Web UI . We are currently using the built in tools that ...
4
votes
1answer
337 views

How secure is JavaScript based OAuth 2.0

JavaScript based OAuth exposes the client ID of the application and it trusts only on the domain requesting the access token. The domain name can be forged with a DNS hijack (or a virus affecting ...
0
votes
1answer
50 views

OAuth + Confused Deputy + access token verification + state parameter

Google's "Using OAuth 2.0 for Client-side Application" article at https://developers.google.com/accounts/docs/OAuth2UserAgent states that the client MUST validate all access tokens to verify that it ...
1
vote
1answer
69 views

OAuth implicit flow and confused deputy problem

I'm reading about Google OAuth and implicit flow. In Google docs it says that the access token received using the implicit flow must be validated otherwise the application might be vulnerable to ...
3
votes
2answers
307 views

Best place to store authentication tokens client side

When my users are authenticated they receive an authentication token, I need to use this authentication token to authorize some asp.net WebAPI calls. To do this I need to add the token to the head of ...
0
votes
0answers
24 views

What are the consequences of revealing OAuth2 client secret?

Basing on this post I understand that client secret is used in "Authorization code" flow to: Create authorization request for registered domain Exchange returned code for actual auth token ...
0
votes
0answers
30 views

Is it a better security measurement to generate new refresh token on every access token request?

I far as I know refresh token is a long-lived token to generate new access tokens based on that. Can we consider refresh token generation as a better security measurement on every access token ...
1
vote
0answers
30 views

Correct approach to secure the back end service - oAuth

I'm developing a oAuth service (I'm thinking so. It might not be exactly the same.) to open one of our back end API to a Merchants. basically users can purchase goods from Merchant's E-Commerce ...
2
votes
0answers
41 views

Using multiple oAuth identity services simultaneously

This question is somewhat acedemic in nature. While educating myself about the topic of Security via a Bearer Tokens for a back-end service that I am working on, and specifically about oAuth2, a few ...
7
votes
1answer
2k views

Compromised JSON Web Token (JWT) Bearer Token

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
0
votes
0answers
24 views

Authentication API that just returns ID with right email / password combination a security problem?

Two companies. MegaSocialPlatform CorporateCompany. CorporateCompany wants that their employees can reuse their current login credentials of CorporateCompany.com on MegaSocialPlatform, so ...
0
votes
1answer
70 views

Why not oAuth for Authentication - AKA what is bad about OpenID Connect [duplicate]

I read many questions and answers on this forum stating that oAuth is for authorization, OpenID is for authentication and more than a few of them goes on to say that OpenID Connect provides ...
3
votes
0answers
35 views

Does changing my password after OAuth login in mobile app help reduce risk?

When you use a mobile app that needs Google OAuth login, you can't fully trust the third party app because you can't tell what url the webview is using. Who knows if they aren't storing my login and ...
1
vote
1answer
74 views

Correct auth method using oAuth 2.0?

Been trying to wrap my head around oAuth 2.0, but I'm struggling figure out the correct way to implement it for our system, as there are so many different approaches. Our specifications are: Secure ...
0
votes
1answer
79 views

How to incorporate the man-in-the-middle

I am designing a web-based back-end for an online service. The service could support web based portals and mobile apps as front end. But I am stuck on how to support third-party, i.e untrusted, web ...
12
votes
3answers
2k views

Should we store accesstoken in our database for oauth2?

I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list. I have gone through the complete OAuth2 documentation of ...
1
vote
2answers
58 views

Is it normal if user gets logged in Facebook or Twitter after they use Like or Tweet button? [closed]

Personally I don't use social networks, so I'm not sure about their behaviour. Currently I must code website which heavily depends on "Likes" and "Tweets" about articles. Each article has Like and ...