Tag Info

New answers tagged

0

Reading http://tools.ietf.org/html/rfc6749#section-4.1.1, this is what I interpret: The client (in this case, the server with an account that Mallory is fixating) directs the user-agent to an OAuth request. state has been determined by the client, and is passed with the request, and will be passed back when the user-agent is sent to redirect_uri with an ...


1

Firstly, and to be very clear, OAuth 2 is not an authentication protocol. If you wish to know the identity of the user, there are other protocols designed to solve this problem, such as OpenID Connect. If you intend to use OAuth 2 for the purpose of authorizing access to your protected resources, continue reading. To answer your direct question: you appear ...


0

These are really two questions. How can I guarantee that requests from sources claiming to be this client application can be trusted? You can't. The specification says: The resource owner password credentials grant type is suitable in cases where the resource owner has a trust relationship with the client [...] The resource owner (aka. user) ...


0

The "Authzcode," more commonly known as the "OAuth Authorization Code" is used in the Authorization Grant process. This specific OAuth process is used, when an application needs to ensure that a resource owner's credentials are never shared with the client. This specific use case can come into play when the client is running untrusted code, such as an app ...


0

It's sent back to the browser because it is essential to do it this way. It might be crazy, but the whole OAuth/OpenId security is based on the fact that your browser will do the right redirect. Let's look at an attack if you don't use the browser as a redirect but first let's define a simplified version of the OAuth "framework" for our example. Client : ...


1

The delivery of the Authorization Code is not more a security issue than is sending the user's password from the browser to the facebook server (for example). That means, if there is an insecure connection, an attacker would be able to compromise the user's authentication anyway. For that reason, OAuth is meant to be executed with HTTPS. The reason why it ...


1

What are the dangers of allowing “less secure apps” to access my Google account? Unsafe apps will open the door for man-in-the-middle (MITM) attacks against HTTPS communication . This will allow an MITM to inject an arbitrary amount of chosen plaintext into the beginning of the application protocol stream, leading to a variety of abuse possibilities. ...


5

I think OAuth is your best bet; specifically OAuth2. It might be a little overkill, but it does what you want. OAuth OAuth provides client applications a 'secure delegated access' to server resources on behalf of a resource owner. What does this mean? You have a client application, contentsite.com, that you would like to give secure access to ...


1

If you have HTTPS setup for your login pages there's hardly a valid reason why you wouldn't keep it up throughout the whole website. If a user visits a page unencrypted with a specific session ID/token, what prevents a spoofing adversary from stealing that token and then visiting the website as well? And it's not just a matter of the token being observed, ...



Top 50 recent answers are included