Tag Info

New answers tagged

1

As soon as you deploy your client to a device you cannot fully control, there is no way to be absolutely sure anyone can tamper with the requests. What you can do though is put some measures in place that will require work from the attacker, for example, you could encrypt and/or sign your data using embedded keys in the application. In order to send data ...


1

OAuth is an authorisation protocol, providing a way to give authorisation to access a protected resource. A by-product of the authorisation process is that the user is authenticated. Technically, OAuth does not have to give you any information about the user. What it provides is a validation that the user has given authority to the application to access ...


1

The OAuth 2.0 specification prohibits the issuing of a refresh token to non-confidential clients. A client-side application is not considered a confidential client.


0

This is the problem you are trying to prevent by validating the token: As a simplified example, imagine there are two apps: (1) FileStore, a legitimate file storage app, and (2) EvilApp. Both apps use Google's authentication process for client-side apps. Alice is an innocent end user, and her Google user ID is XYZ. Alice signs into ...


1

I believe that the following example demonstrates the problem (based on the accepted answer from http://stackoverflow.com/questions/17241771/how-and-why-is-google-oauth-token-validation-performed) All of this assumes the use of the OAuth Implicit Flow Alice connects her browser to GoodApp.com GoodApp.com obtains an OAuth access token authorized by Alice. ...


1

There are two ways you can save authentication information in the browser: Cookies HTML5 Web Storage In each case, you have to trust that browsers are implemented correctly, and that Website A can't somehow access the authentication information for Website B. In that sense, both storage mechanisms are equally secure. Problems can arise in terms of how ...


1

The safest way to store your access token is to simply not store it client-side at all. How does that work? Well at the point of generating the access token, generate some other cryptographically secure PRNG (which you map to the access token on the server), map this to the users session ID and return this to the client instead. This will reduce the attack ...


0

Look into the process of OAuth for client-side applications. Your OAuth flow should look something like this: User logs in Your API returns an access token for that user Your desktop application stores the user token Future requests send the token, and the API uses it to authenticate the user You cannot realistically protect a global secret key in your ...



Top 50 recent answers are included