New answers tagged oauth
You've misunderstood the cookie issue for Safari/Chrome, I think. Both of them implement the RFC properly, whereas Firefox/IE have been more relaxed in the past. The normal rules are: Setting a cookie for xyz.com does not allow any subdomains to read it. Setting a cookie for .xyz.com allows all subdomains to read it. Setting a cookie for app1.xyz.com only ...
Take a look at Keycloak (it is an identity broker). In particular, read their documentation on security vulnerabilities. I imagine you will also need something like Cross Origin Resource Sharing (CORS) - use CORS protocol rather than invent your own.
So most application are going to use SAML or OAuth, not both. And SAML is a lot more involved than a simple cookie. If your primary focus is authentication for multiple systems, and you don't have a federated auth provided in place today that will give you the infrastructure for SAML, I'd stick with OAuth, and if you need a authentication/profile ...
Acceptably secure within the realm of what? You have described the basic flow for all bearer tokens. They who bear the token have the power. You do have a condition where you check if the token has been revoked, but that will mean the token is valid until they expire or are revoked. This is fundamentally the same as checking if the user is valid in the ...
Top 50 recent answers are included