OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

learn more… | top users | synonyms

2
votes
0answers
30 views

OAuth - initial log in to get API key

I've been reasearching how major web systems implement OAuth in their RESTful API. Here is how Paypal describes theirs: Basically the question comes down to the "note" part of the picture. Say ...
2
votes
0answers
18 views

What is the benefit of OAuth “one-time code flow (hybrid authentication)”?

With reference to the omniauth-google-oauth2 gem which describes what it calls "One-time Code Flow (Hybrid Authentication)" as such: This hybrid authentication flow has significant functional and ...
0
votes
0answers
31 views

iframe basic auth or token security

We have two sites, both are trusted. On site1 we store the username and password for the user for site2. We make api calls on site1's backend to site2 via basic auth (all over HTTPS). I know this ...
0
votes
1answer
32 views

How to securely access web api from Html5 Website

So the thing is I have created a Asp.Net web api and am using oauth to secure the access. The problem is that the clients want to make a pure html(angular) website from which they will access the api. ...
0
votes
1answer
128 views

Sharing access-tokens in response header?

What's the best way to share my access tokens, I mean, is it okay to share it in the header as plain-text? - Or do I need to look into e.g.: JWT? Current workflow: -> POST /api/login -d {**creds} ...
0
votes
1answer
25 views

SecureData even for admins with external login

Given: A WebService which stores user Data and a server with a database. A Administrator which can acces the sever wit hthe webservice and the server with the database. Foreach user is a ...
0
votes
1answer
33 views

Identity and Access Management (IAM/IdAM) deployment guide

I'm working on a set of applications that require authentication and authorization. Can you point me in the right direction to some architecture design for this when I want to have multiple services ...
0
votes
0answers
17 views

Client secret verification vs redirect URL verification - is one more secure than the other is? [closed]

Is client secret verification (code flow) considered more secure that redirection URI verification (implicit flow)? Why? It seems to me that they are equivalently secure. https://tools.ietf.org/...
1
vote
1answer
47 views

what does `client_id` mean in password credentials grant of OAuth 2.0?

Public clients can't hide their requests. So password credentials grant doesn't need clientSecret. What I'm curious is, is there need client_id? because hacker or client user can know or trace the ...
2
votes
1answer
274 views

If my users use Google OAuth for authentication, can I allow 3rd party apps to read data on my site?

Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn. When the book club becomes popular, we discover that 3rd party ...
1
vote
1answer
24 views

Instant signin links for users from trusted third party sites

I'm owning web app "A" and want to work with a third party service "X". User "Alice" has accounts on both platforms. App A knows the user ID of alice on X, but X doesn't care about Alice being on A or ...
10
votes
4answers
17k views

Best place to store authentication tokens client side

When my users are authenticated they receive an authentication token, I need to use this authentication token to authorize some asp.net WebAPI calls. To do this I need to add the token to the head of ...
8
votes
2answers
190 views

Mobile API Authentication

I'm trying to design an Android Analytic service where every user's application who register in this service needs to download our SDK. The SDK itself need to communicate with our API server. The ...
52
votes
3answers
27k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
1
vote
1answer
49 views

Best practices for securing open APIs from quota theft

I know that appKey is not a means of authenticating applications. But I am wondering what are the best practices for avoiding quota theft for open APIs, that are not associated with any user account. ...
7
votes
2answers
348 views

Microservice to Microservice Auth

We're planning a new architecture which will utlize a backend of many different microservices that will need to talk with each other as well as field requests from systems not part of the service. In ...
1
vote
1answer
30 views

How to cycle OAuth2 client secrets without downtime

I have an app that relies on several OAuth2 providers to poll for background data on behalf of users, as a background process. As a matter of best-practice, I'd like to periodically cycle my client ...
0
votes
1answer
96 views

Why Oauth2 specification considers native desktop application clients less secure than web server application clients?

I assume here that the web server is owned the client as is the desktop. If they aren't, then I have my answer and I misunderstood the differences between desktop Vs web server clients. If they are ...
0
votes
0answers
23 views

Where should I store a refresh token

I'm building an oauth 2.0 protocol. I'm wondering how the refresh token works exactly. My understanding is that the use of a refresh token enable short lived access token and therefore limits the ...
-1
votes
1answer
92 views

What is this type of authentication with device id and token?

I'm trying to understand this strategy of authentication that I'm using to access resources of an enterprise. Basically, they have given me clientId and clientSecret, which I use to generate deviceId ...
0
votes
0answers
37 views

Securing a Web API Service Layer

We've created a website and am using a service layer to expose common functions so that other applications will be able to call via REST API. The main website will have users that will add/edit ...
0
votes
1answer
37 views

Authorizing an Android app to carry out operations on backend server

The users of my Android application can pay (using Paypal or in-app billing) to light a LED on a remote location. The LEDs are controlled, at each of the locations, by Internet-connected Arduinos. ...
1
vote
1answer
96 views

How does JTI prevent a JWT from being replayed?

According the JWT RFC a JWT token can optionally have a jti which I interpret to be an a unique ID for a JWT Token. Seems like a UUID is a good value for a jti. The RFC claims that the jti can be used ...
1
vote
0answers
12 views

Why do I need to redirect in order to send the external OAuth2 authentication token to the client?

In an OAuth2 scenario: user confirmed his identity, allows the app to access his details server got the external access token I intend to respond directly with a local access token as opposed to ...
3
votes
1answer
27 views

Does the auth server have to be separate from the resource server when using OAuth 2.0?

I'm trying to implement OAuth 2.0 and I noticed in the spec they mention two servers - an auth server to pass access tokens back to and a resource server to use the access tokens on. My question is, ...
3
votes
2answers
615 views

Stealing OAuth2 Tokens from IoT Devices

As I am delving into different forms of session authentication and persistence, I started to question how tokens are stored and the risk of a token being compromised. The scenario I have in mind is as ...
5
votes
1answer
1k views

Does returning Access-Control-Allow-Origin: * weaken the security of JSON GET responses?

The W3C CORS recommendation states: Certain types of resources should not attempt to specify particular authorized origins, but instead either deny or allow all origins. ... 3. A GET ...
3
votes
1answer
2k views

JSON Web Tokens vs. SAML

I don't know too much about security. Specifically, I don't understand the difference between JSON Web Tokens, SAML and OAuth 2. If you could provide some pointers and high level overview of their ...
2
votes
1answer
194 views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
5
votes
3answers
309 views

Authentication Middleware

We run a large distributed system consisting of a number (>10) of Django-based web services and web applications with a consumer base of about 10000 university students. Currently, we use a single ...
43
votes
5answers
8k views

What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?

Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook. One advantage ...
1
vote
0answers
33 views

JWT vs. Client Certificates

We have a transaction server that is connected to by different client applications. The requirement is to have a secure means of authentication for client applications to communicate with the ...
1
vote
0answers
56 views

Security of GMail API full-access scope

Recently more and more online services are popping up to help manage the mail of Gmail, such as Boomerang, Gmelius and many others. To work correctly they require a full access scope to the gmail api,...
41
votes
7answers
25k views

Why use OpenID Connect instead of plain OAuth?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...
2
votes
0answers
29 views

How do we get a JWT bearer grant with required audience?

According to the OAuth JWT Bearer grant spec, a valid JWT should have some sort of identifier (token endpoint may be used) of the token issuing authorization server within the audience claim. The ...
3
votes
3answers
73 views

Why is it required in OAuth 2.0 that refresh token cannot be guessed?

From RFC 6749 (section 10.4): The authorization server MUST ensure that refresh tokens cannot be generated, modified, or guessed to produce valid refresh tokens by unauthorized parties. I don't ...
4
votes
1answer
67 views

Any scenario for using both, OpenID Connect and OAuth 2.0?

Since OpenID Connect builds on OAuth 2.0, I am assuming that everything that is possible with OAuth 2.0 is also possible with OpenID Connect. In particular, say that my website stores some ...
4
votes
2answers
666 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
3
votes
1answer
58 views

How is an authorization server supposed to require client auth for confidential clients?

The OAuth2 password grant_type states, If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate ...
1
vote
0answers
25 views

Odd history of OAuth 2 device flow

OAuth 2 device flow has an odd history. It's found in early versions of the RFC, but was then taken out seemingly without an explanation I could find. Recently, a new draft was proposed specifically ...
3
votes
0answers
221 views

Is it safe to store bearer tokens in an iframe and/or pass them back to the parent window?

I am not a security expert, so I am hoping that a few of you might be able to tell me if there are any gaping flaws in the security design for my web app. Hopefully I'll be able to explain this ...
2
votes
1answer
1k views

OAuth and public keys

I get the basic OAuth and PKI flow and the different actors involved but I'm still unsure how public/private keys play a role. When a client identifies itself upon registration with a certified ...
7
votes
1answer
6k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
6
votes
1answer
213 views

If I misuse OAuth 2.0 to do authentication, am I at risk?

I understand that OAuth is not an authentication protocol, not authorization one (even if the first paragraph on Google's OAuth 2.0 page disagrees), as well as that: [...] authorization can be ...
1
vote
1answer
254 views

OAuth + Confused Deputy + access token verification + state parameter

Google's "Using OAuth 2.0 for Client-side Application" article at https://developers.google.com/accounts/docs/OAuth2UserAgent states that the client MUST validate all access tokens to verify that it ...
4
votes
2answers
112 views

Google OAuth 2.0 and Java. Is it safe to locally store access tokens?

I Installed this Java app: https://github.com/andresoviedo/google-drive-ftp-adapter The program asks permission to see my Google-Drive files and then stores an access-token on my local harddisk. ...
40
votes
6answers
12k views

Can someone explain the “Covert Redirect” vulnerability in OAuth and OpenID?

CNet is reporting that all OpenID and OAuth sites are vulnerable to an attack called "Covert Redirect". What is this attack, how does it work, and as an end user, how can I mitigate the risk?
47
votes
10answers
5k views

Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
3
votes
1answer
45 views

Translate token into cookie

I find myself in a situation where I need to hand a user off from a mobile application into a web application. The mobile application is using WebAPI on the backend with OAUTH 2. The web application ...
3
votes
0answers
972 views

Social Login + OAuth2-secured REST API

I'm implementing social login with Facebook, Twitter and Google+ on our OAuth2-secured REST API (secured using spring-security-oauth). I'd like to make sure that the following flow is secure and that ...