New answers tagged sso
TL;DR: You're not using a passphrase multiple times with OpenID, but have other parties (like Stack Exchange) trust your identity provider (like Google) to be carefully authenticating you. The passphrase (or any other authentication schema like two factor authentication, certificates and so on) only is revealed to the identity provider. Identity ...
Providing a JWT token to the authenticated user is not a problem, but you shoud take into account the following considerations: Are your environment secure (is it internal or public network)? Do your use secure transport (TLS) for communications? If not,you shoud care about token integrity and privacy using JWS and\or JWE Do you transfer any PII ...
Provided that you are sure that you are giving the JWT to the actual user who logged in, delivering it after authentication isn't a problem.
The point of OpenId or other similar mechanisms is that it allows you to select a single, highly trustworthy organisation to hold your credentials. There is an assumption that they are in some way more secure than the average site. For example: They should offer 2 factor authentication They should have good, proactive account misuse monitoring They should ...
Top 50 recent answers are included