OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

learn more… | top users | synonyms

33
votes
2answers
19k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
33
votes
6answers
18k views

Why use OpenID Connect instead of plain OAuth?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...
46
votes
9answers
4k views

Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
17
votes
2answers
2k views

Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML

It's clear there there is no consistent set of features among any of the popular authentication providers. Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
11
votes
1answer
642 views

Is logging in using OAuth/OpenID also vulnerable to heartbleed?

If one has logged into a "heartbleed-vulnerable" site using OpenID, for example, using Google to log into StackExchange, does that mean that the Google password is now at risk as well?
31
votes
3answers
25k views

What are the dangers of allowing “less secure apps” to access my Google account?

According to https://support.google.com/accounts/answer/6010255: Google may block sign in attempts from some apps or devices that do not use modern security standards. Since these apps and devices ...
29
votes
3answers
14k views

Should we store accesstoken in our database for oauth2?

I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list. I have gone through the complete OAuth2 documentation of ...
12
votes
3answers
7k views

What is the purpose of OAuth 2.0 redirect_uri checking?

The OAuth 2.0 specification's authorization code mechanism includes redirect URI checking from the site you redirect to. See steps D and E in section 4.1 of the spec. Also, section 4.1.3 describes in ...
43
votes
5answers
8k views

What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?

Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook. One advantage ...
14
votes
2answers
8k views

OAuth2 Cross Site Request Forgery, and state parameter

http://tools.ietf.org/html/draft-ietf-oauth-v2-30#section-10.12 says: The client MUST implement CSRF protection [...] typically accomplished by requiring any request sent to the redirection URI ...
11
votes
4answers
2k views

Is Facebook Connect or Twitter OAuth PCI Compliant?

We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter. Obviously this wouldn't be secure if we were trusting just any old ...
4
votes
2answers
383 views

Decide to REST API Security

I've developed an API. I got confused and I've been reading articles for days. Actually my question is close to these but not exact (maybe a combination of them); Securing REST API that will ...
6
votes
2answers
3k views

Security drawbacks for using short-lived access token in javascript client side

I intend to build a front end site entirely in javascript (NodeJS) and i would like to do ajax calls to a REST WS which is on another domain on client side. I intend to use oauth2 and SSL to secure ...
7
votes
1answer
1k views

Is it safe to store twitter access tokens client side?

After the Twitter oauth process, once I finally get my access_token_key and access_token_secret is it safe to store these in a javascript variable client side? As far as I can work out nothing can be ...
4
votes
1answer
970 views

Does returning `Access-Control-Allow-Origin: *` weaken the security of JSON GET responses?

The W3C CORS recommendation states: Certain types of resources should not attempt to specify particular authorized origins, but instead either deny or allow all origins. ... 3. A GET ...
2
votes
2answers
374 views

How does a user get authorized wihtout authentication

I have a back-end (API) and a front-end, eg a web server, and I have users and ID-providers. The web server is provided by a third aprty and it may just as well be a mobile app, but whatever the case ...
9
votes
1answer
450 views

How secure are expiring tokens and refresh tokens?

In the comments of a question on StackOverflow, OAuth2 Why do access tokens expire?, people are questioning how secure refresh tokens are. This comment is how I feel: So it provides some ...
6
votes
2answers
1k views

Client authentication vs. user authentication

I am currently looking into authentication protocols which work well with REST API, in java. There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
4
votes
1answer
68 views

Create a web session from within a 3rd party website using an existing oauth2 token

We're trying to allow a trusted 3rd party web application to automatically authenticate users in our own application. We thought about using oauth2 for that matter. In our scenario we would provide ...
4
votes
1answer
330 views

How to store client secret securely on application base in Windows?

I would like to store valuable client data (ex. passwords, OAuth tokens) in a way that they will be accessible only from one application (separation on application base). The mechanism must be ...
4
votes
2answers
346 views

Does providing OAuth for mobile apps pose a security threat?

Let's take a look at the basic OAuth workflow: The basic idea is that the Consumer (App) asks the user to grant him access to the Service Provider. The service protects the user by asking him each ...
3
votes
1answer
139 views

Would this work to protect a cookie with an OAuth token?

I'm currently trying to set up an OAuth 2.0 authentication scheme to protect some stateless REST webservices. These services deal with sensitive information, and the OAuth support is a requirement. ...
3
votes
1answer
575 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
0
votes
1answer
186 views

OAuth + Confused Deputy + access token verification + state parameter

Google's "Using OAuth 2.0 for Client-side Application" article at https://developers.google.com/accounts/docs/OAuth2UserAgent states that the client MUST validate all access tokens to verify that it ...
0
votes
1answer
242 views

Why not oAuth for Authentication - AKA what is bad about OpenID Connect [duplicate]

I read many questions and answers on this forum stating that oAuth is for authorization, OpenID is for authentication and more than a few of them goes on to say that OpenID Connect provides ...