New answers tagged

1

Certificate Pinning is another commonly used control against Data-in-transit attacks. The TLS handshake never starts if the client doesn't receive a Public Key that is within the client's (the mobile app) known Pin List. I used Cert Pinning as a compliment to payload encryption. Perhaps the following are becoming the base standard for sensitive mobile app ...


0

Welcome Alex. I think confirming the "FB account" is enough to authenticate (provided that you verify the source and that SSO is correctly set). You can ask the user if they want to update their email if you detect it was changed. I assume you are using another ID to track your users and the email is just a simple field, right? I recommend you to hash the ...


4

I am very pleased to have stumbled upon this question as it is a common yet mostly wrongly handled situation. My answer is there has to be an internal service to serve the purpose of consuming/feeding to a 3rd party service and my rationale is as below. It helps me track all the occurrences of internal services catering to 3PEs. (assume one day after 1 ...


3

It can access it directly There may be reasons why an intermediate internal service may be useful, such as abstracting out the 3rd party web service or providing a common interface to several frontends. Yet, there's no reason the website couldn't directly consume the third party, if properly done. Note that the website would still need to interface with ...


0

You've already mentioned the stateless federated benefits of JWTs, I'm sure those can be agreed on. An attacker doesn't need a user's password to access protected resources, just access to their authentication context. I think one of the risks that you're missing with sever-side tokens, or session based methods, is that those identifiers are also stored on ...



Top 50 recent answers are included