New answers tagged

1

Simple Terms OpenID is about verifying a person's identity. OAuth is about accessing a person's stuff. OpenID Connect does both. All three let a person give their username/password (or other credential) to a trusted authority instead of to a less trusted app. More Details To understand something, look at its history. OpenID & OAuth have ...


0

Agree they are different, but some of the answers are more about typical implementations rather than basic differences. Seems to me encryption info (algorithm, key, etc) are attributes of data, clear data is just a special case. Access control takes care of who can do what to some data and to its attributes. It should make sense for access control to say "...


4

Does encrypting HTTP header value provide additional security? There is no general response for this but it depends on what exactly you are doing and what kind of "additional security" you aim for. In your case it looks that you just replaced a plain text password with an encrypted password. Unless you have some replay protection baked into your unknown ...


4

If I understand this correctly, this is a lot of complexity with absolutely no security gain at all. The one thing that the whole scheme hinges upon is that an attacker stealing the cookies would not also get session_key. So you are guarding the session ID with a session key. But who guards the session key? According to you: Each user gets a random key ...


2

You should set your cookies with "httponly" and "Secure" options. That will prevent that cookies could be hijacked using Javascript and be sure SSL is used. There is a way to check if the cookies are "httponly" using session_get_cookie_params, which can increase the protection. Also enable HSTS in your web server. While it will add a little of safety, it ...


0

Process or verify the payment server-side. This works for paypal und afaik your server can see in-app purchases of a authorized app and specific user, too. Just dig into the documentation on PayPal, Google Play e.t.c


1

Even though the connection between user agent and servers are secure, the user agent may not be fully protected. Since authorization code flow ensures the user agent is not privy to the tokens, security is improved by reducing exposure of tokens to between servers only.



Top 50 recent answers are included