OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

learn more… | top users | synonyms

6
votes
2answers
130 views

Mobile API Authentication

I'm trying to design an Android Analytic service where every user's application who register in this service needs to download our SDK. The SDK itself need to communicate with our API server. The ...
5
votes
2answers
101 views

What to use as 'state' in OAuth2 Authorization Code Grant workflow

I'm using csrf protection in my web app. Now I'm planning to trigger a OAuth2 Authorization Code Grant workflow, starting with a static template opened in a new browser window using ...
3
votes
2answers
618 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
6
votes
1answer
177 views

Microservice to Microservice Auth

We're planning a new architecture which will utlize a backend of many different microservices that will need to talk with each other as well as field requests from systems not part of the service. In ...
4
votes
1answer
97 views

Is using OAuth for login less or more secure than maintaining your own passwords?

Pros: The complexity in managing passwords is maintained by a company with stronger security policy. Let's assume they secure passwords properly. The user doesn't have to maintain yet another ...
0
votes
1answer
62 views

Why Oauth2 specification considers native desktop application clients less secure than web server application clients?

I assume here that the web server is owned the client as is the desktop. If they aren't, then I have my answer and I misunderstood the differences between desktop Vs web server clients. If they are ...
0
votes
1answer
89 views

Sharing access-tokens in response header?

What's the best way to share my access tokens, I mean, is it okay to share it in the header as plain-text? - Or do I need to look into e.g.: JWT? Current workflow: -> POST /api/login -d {**creds} ...
3
votes
0answers
168 views

ADFS 3.0 OAuth2.0 against client applications

ADFS 3.0 does not support the Implicit Grant client flow of Oauth2, nor does it support client secrets. Initial investigations suggest it is not secure to use the Authorize Code Grant flow from a ...
3
votes
0answers
2k views

JSON Web Tokens vs. SAML

I don't know too much about security. Specifically, I don't understand the difference between JSON Web Tokens, SAML and OAuth 2. If you could provide some pointers and high level overview of their ...
3
votes
0answers
846 views

Social Login + OAuth2-secured REST API

I'm implementing social login with Facebook, Twitter and Google+ on our OAuth2-secured REST API (secured using spring-security-oauth). I'd like to make sure that the following flow is secure and that ...
3
votes
0answers
227 views

Using multiple oAuth identity services simultaneously

This question is somewhat acedemic in nature. While educating myself about the topic of Security via a Bearer Tokens for a back-end service that I am working on, and specifically about oAuth2, a few ...
2
votes
0answers
30 views

Is it a bad idea to provide a “testing” OAuth ID and secret?

I'm working on a web app, and I may eventually want to bring others onto the project. I have two sets of GitHub credentials: one called Foo that calls back to foo.com/endpoint, and one called Foo -- ...
2
votes
0answers
48 views

What are the most common ways to Architect the verification process of the access tokens between resource and authentication server using OAUTH 2.0?

What are the most common ways to Architect the verification process of the access tokens between resource server and authentication server using OAUTH 2.0? I am trying to build a web application ...
2
votes
0answers
95 views

OAuth2 Authorization and Resource server certificates

I'm implementing a custom IAuthorizationServerHost using DotNetOpenAuth library. Example implementation uses two certificates for CreateAccessToken (see Listing 6): public AccessTokenResult ...
2
votes
0answers
160 views

Is it safe to store bearer tokens in an iframe and/or pass them back to the parent window

I am not a security expert, so I am hoping that a few of you might be able to tell me if there are any gaping flaws in the security design for my web app. Hopefully I'll be able to explain this ...
2
votes
0answers
166 views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
2
votes
0answers
86 views

How is an OpenID Authenticated user Identified?

On a system that I'm working on a user signs up by means of an OpenID/Social Media account (Twitter, Google, Facebook), and then subsequently signs in using that path. The System comprises of a ...
2
votes
0answers
136 views

suspicious oauth2 implementation detail in facebook API

in RFC 6749 The OAuth 2.0 Authorization Framework 2.3.1. Client Password definitely states that authentication at TokenEndpoint can be done in two alternate ways HTTP basic authentication - ...
2
votes
0answers
746 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook. Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
2
votes
0answers
266 views

using oAuth2 auth dance vs oAuth1 signing

I have been reading about oauth and 'how to create apis'. In oauth2, there is what they call the authentication dance where the client will be requesting a request token using a consumer key and ...
2
votes
0answers
262 views

If my users use Google OAuth for authentication, can I allow 3rd party apps to read data on my site?

Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn. When the book club becomes popular, we discover that 3rd party ...
2
votes
0answers
277 views

Implementing ACS with REST + many Identity Providers - Problems - Azure

I am trying to integrate ACS to use in my application's authentication system. Currently I have a Javascript client and a WCF so I had to use a REST architecture. I am quite puzzled on how to do ...
1
vote
0answers
23 views

OAuth 2.0 Resource Owner Password Grant - Handling of Access Token Upon Logging Out

I am new to OAuth 2.0. I used BShaffer's OAuth PHP Server on Authorization Code Grant, and I understand that the client application can have its OAuth token separate from its session authentication, ...
1
vote
0answers
101 views

Combining id_tokens and access_tokens for new auth spec

A common misuse of OAuth2 is as a strict authentication protocol. OpenID Connect addresses this by extending OAuth2 to include an id_token. Implementing clients for OAuth2 and OpenID Connect is a ...
1
vote
0answers
37 views

OAuth2 JWT Encryption for Tokens with Scopes to Multiple Resource Servers

Within the context of an OAuth2 deployment, I would like to grant a Client an encrypted JWT that has scopes that to several Resource Servers and can be decrypted by each Resource Server independently ...
1
vote
0answers
25 views

what does `client_id` mean in password credentials grant of OAuth 2.0?

Public clients can't hide their requests. So password credentials grant doesn't need clientSecret. What I'm curious is, is there need client_id? because hacker or client user can know or trace the ...
1
vote
0answers
108 views

How can I safely store a password during a user session

I am writing an Java application that is using OAuth to authentificate against a server API. The server is offering the OAuth secrets for users to copy from its website. Because each request needs ...
1
vote
0answers
24 views

OpenID Connect access token to access protected API

In our setup we need both reliable user authentication and scope-based authorization. Consider the following scenario: a user logs in into our client (portal) using OpenID Connect, and our client ...
1
vote
0answers
45 views

Confirm signature of JWT or make API call (JWT vs. oauth)

Given a setup where user credentials are stored on a server, but web services will be called from third-party clients, does the following seem reasonable: When clients want to login, they send ...
1
vote
0answers
29 views

Scope handling in OAuth2 protocol

I have a general question regarding how scopes in the OAuth2 protocol are handled. For easy argumentation lets start with a concrete example: Lets say I have an OAuth server A which I want to use in ...
1
vote
0answers
265 views

Why is using implicit grant more secure than just giving out your secret key?

The company I work for has created an API that is used by mobile devices. I've been reading up on using oAuth for mobile applications and from what I understand it is recommended that you use ...
1
vote
0answers
259 views

In Oauth what is the benefit of the access token being opaque

Why was the decision taken that the Client doesn't need to be able to parse the access token? It seems to me that if the token included, in addition to the current fields, a client_id and a user_id, ...
1
vote
0answers
166 views

Oauth authentication without state parameter

I have some security concerns about the first step of account authentication in my application. The authentication goes through an OpenID provider. If the response of such provider shows that the ...
1
vote
0answers
145 views

Correct approach to secure the back end service - oAuth

I'm developing a OAUTH service (I'm thinking so. It might not be exactly the same.) to open one of our back end API to a Merchants. basically users can purchase goods from Merchant's E-Commerce ...
1
vote
0answers
241 views

Best practices for OAuth 2.0

I understand that OAUth 2.0 really just relies on SSL to encrypt the contents of the bearer token. However, are there any other best practices one should follow when securing OAuth 2.0? I know you ...
1
vote
0answers
96 views

Purpose of Secure Key in Facebook(and other provider) in OAUTH?

I see lot of OAUTH provider give us a secure key. What is the purpose of secure key in Facebook(and other provider) in OAUTH?
1
vote
0answers
626 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
1
vote
0answers
195 views

How do I get the Access-Token and Access-Token-Secret?

Can anyone explain me these terms with respect to OAuth ? Consumer Key Consumer Secret Access Token Access Token Secret Also, when I registered my application with twitter I got the consumer key ...
1
vote
0answers
961 views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...
1
vote
0answers
402 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
0
votes
0answers
14 views

OAuth2 storing the shared-secret on a owned-server - how does it prevent abuse?

(This question assumes that all communication takes place on a SSL (TLS) secured connection. It also assumes that the third-party client doesn't have it's own user management.) I've read quite some ...
0
votes
0answers
60 views

OAUTH 2.0 Authorization Code flow and API key in Authorization header

We are creating Spring Boot REST services that registered third parties can use. We provided the third parties with a unique API key in JWT format, containing authorizations for that party to the ...
0
votes
0answers
28 views

Windows Integrated Authentication with OAuth2 - do I need SSP/APs for LSA?

I Need to develop an integrated authentication mechanism that trusts our OAuth2 STS. Yet implemented is a credential provider that collects the user credentials and asks our STS for authentification. ...
0
votes
0answers
423 views

Avoiding Client impersonation with Rest Api

I'm sure that this use case has a known solution, but I can't find anything on google or I don't know which keywords to use. We are building an Angular app that is backed by a Rest Api. For ...
0
votes
0answers
44 views

OAuth 2.0 client redirect endpoint security

This question is about securing the redirect endpoint on the client side at the end of an "authorization code" flow. We have designed a back-end server that handles the OAuth 2.0 authorization ...
0
votes
0answers
56 views

Are Android Facebook OAuth tokens vulnerable to theft?

If I have access to someone's unlocked Android phone, is it possible to get hold of their OAuth token for Facebook and use it on another device?
0
votes
0answers
121 views

Comparing Oauth and JWT auth in my web application

I have created an e-commerce website which has a REST API on the server side and Angular on the client side. I am considering to use OAuth to secure my API, but it seems to overkill because I have no ...
0
votes
0answers
29 views

Is it possible/sensible to split an OpenID Connect endpoint into multiple endpoints?

I just created an OpenID Connect auth* service to see how it works and if we can make use of it at work. I understand some of it; I wrote a couple client apps that use the implicit flow for user login ...
0
votes
0answers
131 views

Do I need my own oauth and/or openid connect provider

I have asked the same question on Server Fault but it possibly fits in better with the IS forum. The system I'm working on will have a mobile application, a web portal and an HTTP-based API. The ...
0
votes
0answers
223 views

OAuth - Facebook custom authorization grant

I've developed my own custom authorization grant. The steps I am undertaking are the following: I get the facebook authorization code from the mobile device (this is an an API for mobile devices) I ...