Hot answers tagged authorization
The user would be able to take ownership of a device by adding the device ID to a list of devices they own. What you need is some way to prove that the user is in physical possession of the device. Going by media (e.g. images, video) it sounds like you have a display of some form, therefore it would be easiest to display some temporary PIN on the ...
Client certificates? Set your SSL/TLS-server to reject any connection that does not present a valid Client Certificate. Related questions 2012-05-03: Advantages of client certificates for client authentication?
You need to add your app to a Context and then set up HTTP Authentication for it: https://github.com/zaproxy/zap-core-help/wiki/HelpStartConceptsAuthentication#httpntlm-authentication
state is information that is passed by the RP (resource provider) to the IP (identity provider) and it is expected that the IP will send the same information back. In my case I used the state in my JavaEE OpenID Connect implementation as the URL to the application relative to the URL that was originally requested on the RP before the OP login screen is ...
Only top voted, non community-wiki answers of a minimum length are eligible