OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

learn more… | top users | synonyms

3
votes
1answer
486 views

Why is OAuth 2.0 being used for mobile devices, and not OpenID?

Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices. Question What ...
1
vote
1answer
95 views

how secure is javascript based oauth2.0

Javascript based oauth exposes the client id of the application and it trusts only on the domain requesting the access token. The domain name can be forged with a dns hijack(or a virus affecting ...
1
vote
1answer
87 views

Confused about the most relevant way to secure my APIs

I own a Javascript application (Single Page Application) hitting some apis from my own RESTful backend. What I expect for my authentication/(authorization) mechanism is three things: Preventing ...
3
votes
1answer
81 views

Why does OAuth2 demand client credentials in an authorization header?

In section 2.3.1 of the the OAuth 2.0 Authorization Framework it states: The authorization server MUST support the HTTP Basic authentication scheme for authenticating clients that were issued a ...
3
votes
1answer
259 views

Authenticate users through Google using only an OAuth2 access token

I have a question about having users logon to my service using their Google Credentials. I've gone through the Using OAuth 2.0 for Login documentation provided by Google. The documentation mentions ...
2
votes
1answer
90 views

OAuth2 - Is it safe to return the access-token to the user?

I'm new to OAuth (1 & 2), and I'm developing the server side of a mobile app that has a form with a "Fill Details from Google account" button. I don't need any long-range ...
3
votes
1answer
112 views

OAuth2 authorization - save token in the cookies or in the session?

I'm a security newbie. I'm implementing oauth on my site and I want to ask where I should save my access token: cookies session (will be fetch from the server via ajax request) I have backend ...
2
votes
1answer
110 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
1
vote
1answer
25 views

When implementing an OAuth provider, what is the right granularity for a “scope”?

If I'm an OAuth provider and I want to empower the user to restrict apps to only a subset of resources (for example, only resources in folder X), what is the right mechanism to do this? Scopes would ...
1
vote
0answers
15 views

Purpose of Secure Key in Facebook(and other provider) in OAUTH?

I see lot of OAUTH provider give us a secure key. What is the purpose of secure key in Facebook(and other provider) in OAUTH?
9
votes
1answer
453 views

Is logging in using OAuth/OpenID also vulnerable to heartbleed?

If one has logged into a "heartbleed-vulnerable" site using OpenID, for example, using Google to log into StackExchange, does that mean that the Google password is now at risk as well?
7
votes
0answers
48 views

What are the implications of publicizing a consumer secret for sharing between developers doing local website development?

In relation to this GitHub issue on the Gittip project (which turned out to be a false alarm), what are the security implications, if any, of hardcoding into the git repo a test app's OAuth consumer ...
1
vote
1answer
203 views

Security: Oauth and Mobile apps

This is what I believe are the security implications of integrating Oauth using embedded webview vs browser in mobile application. Embedded Webview * Keep UI for mobile app Security implications ...
1
vote
0answers
18 views

Is indirection with ID federation possible?

At the moment I'm trying to design a system with some services. These services should make use of an ID provider (a) for login (for example using OAUTH) and another ID provider (b) to get user data. ...
1
vote
0answers
74 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
0
votes
0answers
21 views

OAuth 2.0 - Why does the authorization server return 400 instead of 401 when the resource owner credentials are invalid? [migrated]

When using a Resource Owner Password grant type, it appears that an authorization server should respond with an HTTP 400 (Bad Request) status code if an access token could not be granted due to the ...
1
vote
0answers
26 views

How do I get the Access-Token and Access-Token-Secret?

Can anyone explain me these terms with respect to OAuth ? Consumer Key Consumer Secret Access Token Access Token Secret Also, when I registered my application with twitter I got the consumer key ...
7
votes
2answers
763 views

What is the benefit of the scope in OAuth2?

In the question, substitute scope with state. Since there is an answer based on the wrong question, I'll let everything below as is. The answer is useful nonetheless. This question refers to ...
3
votes
1answer
116 views

Is OAuth always the right choice (and when isn't it)

So I am reluctant to ask too much of a noob question, as this guy aked about a non-standard approach and got down voted a bunch, but here goes. I am creating a mobile application which needs to ...
1
vote
1answer
72 views

Is Tweetdeck authentication really safe?

I have recently installed Tweetdeck, because my previous client stopped working. In my custom client, and in the third party client I have used previously I had to setup authorize the application in ...
2
votes
1answer
68 views

OAuth2 with client credentials v/s other auth mechanisms

For a REST API against which clients would be writing non-browser based, non-interactive applications, if OAuth2 is the authentication mechanism to be followed, then we would use the client ...
2
votes
1answer
299 views

Tomcat IP restriction vs Two Legged OAuth

We have a server side API that is completely REST based. We are coding to secure them with two legged oAuth type authentication. We are planning to iPhone and Android apps in the future, but for now, ...
35
votes
5answers
6k views

What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?

Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook. One advantage ...
4
votes
2answers
617 views

Is there any drawback of using OAuth “pseudoauthentication” as opposed to OpenID?

I have seen posts that insist that OAuth is an orthogonally different thing from OpenID, because OpenID is about authenticating users, while OAuth is about giving access to certain services to a third ...
3
votes
1answer
248 views

Does it make sense to implement OAuth when no 3rd party is involved

I own a REST API at server side and a distinct web application that would call those APIs. I want to secure my APIs calls. After some reading, I want to implement the OAuth 1.0a mechanism at server ...
5
votes
2answers
756 views

What is the purpose of OAuth 2.0 redirect_uri checking?

The OAuth 2.0 specification's authorization code mechanism includes redirect URI checking from the site you redirect to. See steps D and E in section 4.1 of the spec. Also, section 4.1.3 describes in ...
1
vote
0answers
159 views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...
6
votes
1answer
79 views

Design a webapp that uses OAuth, but with tokens that can't be used by the operator?

I'd like to make a webapp that would allow users to OAuth with Stack Exchange, so that they can perform actions like voting through the app. I'm stuck at one point, though: I know how to perform ...
1
vote
1answer
41 views

If a site says its API for login can't be made available for “Security Reasons” should I be worried

Stack Exchange API 2.2 is finally out, (Yay!) Reading through the linked blog post, i notice the line: Login methods that don’t use OAuth can’t be made public for security reasons. Is this ...
7
votes
2answers
231 views

How does an attacker abuse Facebook Connect with a leaked secret key?

I am reading about Facebook Connect and it looks a lot like OpenID Connect. Are these two similar enough that the Facebook Connect secret key is an OAuth Client Secret and therefore the same attacks ...
2
votes
2answers
119 views

Ways to authenticate client with a server

I have an app that sends an encrypted message to the server, with the sender and recipient username attached. The usernames are each linked to a unique device ID that allows messages to be sent to ...
1
vote
2answers
326 views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User ...
11
votes
4answers
3k views

Why use OpenID Connect instead of plain OAuth?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...
0
votes
2answers
353 views

E-Commerce website with REST backend : do I have to secure Backend URLs accessed by Front end public pages?

I have an e-commerce website with a REST backend and a Single page JS as front end. I intend to secure my REST backend with OAuth2. I don't want to oblige the user to authenticate when he first comes ...
15
votes
2answers
1k views

Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML

It's clear there there is no consistent set of features among any of the popular authentication providers. Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
2
votes
1answer
161 views

Google Open ID connect and ID token

I am wondering if it is safe to send "id token", which is one of the items that are result of authenticating a user using Google Open Id Connect, to the client and use it for further authentication. ...
6
votes
2answers
5k views

OAuth access token vs session key

Is there any advantage to OAuth vs cookie-based sessions (established via username/password) under the following assumptions? There is only one legitimate client to the service The OAuth client ...
3
votes
1answer
2k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
2
votes
0answers
133 views

Implementing ACS with REST + many Identity Providers - Problems - Azure

I am trying to integrate ACS to use in my application's authentication system. Currently I have a Javascript client and a WCF so I had to use a REST architecture. I am quite puzzled on how to do ...
1
vote
1answer
444 views

Securing REST API for mobile use with OAuth

I'm a complete noob about security, so please, forgive me if I say something wrong. I have to develop a social network. The client will be an Android app and (probably) a web page for smartphones ...
2
votes
1answer
1k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
0
votes
1answer
73 views

Why oauth use a secret with temporal credentials?

I am trying to understand oauth protocol. I am currently looking at temporal credentials section of the oauth 1.0 sepecification. I can't understand why the secret is needed along with the temporal ...
2
votes
2answers
154 views

OAuth for Multiparty Authentication/Authorization

I work for a web company that's undergoing a massive rewrite in order to separate our Data out into its own RESTful service application - the goal is to be able to sell access to third parties and ...
1
vote
0answers
105 views

Implementing OAuth flow in JavaScript

I am making a custom auth flow for the application. It is inspired by OAuth 2.0. Dev sends user to an auth page on my domain, passing callback_url and api_id. I redirect user to callback_url, passing ...
0
votes
0answers
41 views

Oauth2.0 redirect url checks [duplicate]

Why does Oauth2.0 protocol require that the redirect uri used to obtain the authorization code be the same as the one used to obtain the access token? Can you give me a clear example of an attack that ...
4
votes
1answer
170 views

Oauth Consumer Secret?

Using OAuth you have a consumer key and consumer secret to identify your application and the user provides an OAuth access token and secret to authenticate your application access to their account, ...
4
votes
1answer
491 views

Does returning `Access-Control-Allow-Origin: *` weaken the security of JSON GET responses?

The W3C CORS recommendation states: Certain types of resources should not attempt to specify particular authorized origins, but instead either deny or allow all origins. ... 3. A GET ...
2
votes
1answer
49 views

oauth and passing received toking to other application

An external software provider is hosting a website for us. We supply the login functionality via a restfull api(login/password over ssl). But the website is also the client for OAuth resource that it ...
0
votes
2answers
547 views

Google Authenticator - Counter Based [duplicate]

I'm trying to understand How google authenticator - counter based work. I have tried googling around finding a demo or at least how this work. I understand its a one time password but not like TOTP. I ...
0
votes
1answer
230 views

Secure API access over SSL using oauth token

On the project that i'm currently working, we authenticate the clients by username and password. In this system each user has a key which is calculated from his password. However, we want to provide ...