Timeline for Secure authentication on SPA/Javascript application with “remember me” support
Current License: CC BY-SA 3.0
32 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Dec 5 at 11:03 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Aug 7 at 11:00 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Apr 9 at 10:01 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Dec 11, 2023 at 9:04 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Aug 13, 2023 at 9:01 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Apr 15, 2023 at 9:00 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Dec 16, 2022 at 8:02 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Aug 18, 2022 at 8:00 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Apr 20, 2022 at 7:03 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Dec 21, 2021 at 6:04 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Aug 23, 2021 at 5:01 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Apr 25, 2021 at 4:33 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Dec 26, 2020 at 3:07 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Aug 28, 2020 at 1:03 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Apr 29, 2020 at 23:05 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Dec 31, 2019 at 20:02 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Sep 2, 2019 at 19:03 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
May 5, 2019 at 19:01 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Jan 5, 2019 at 19:00 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Dec 6, 2018 at 18:03 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
Nov 6, 2018 at 17:01 | answer | added | Lance Parkington | timeline score: 0 | |
Apr 3, 2017 at 13:05 | comment | added | Marko Vodopija | Introducing a reverse proxy will not incur dramatic performance penalty if that is your only concern. I tested the scenario with RP between Tomcat app server and IIS as frontend proxy. Incurred penalty was between 2-5ms in total response time. As for CORS, I don't feel comfortable giving advice on how to configure it. I, personally, would avoid CORS if I could. In scenarios where I control complete stack, I would configure it in such way that CORS is not needed. Using reverse proxy is one of the options. If CORS is your real concern, I would advice to post new question and be more specific. | |
Apr 3, 2017 at 10:51 | history | edited | Hasan | CC BY-SA 3.0 |
added 179 characters in body
|
Apr 3, 2017 at 10:41 | comment | added | Hasan | Also, I actually implemented the second option currently and it is working well. I enabled CORS only for the SPA's domain (www.example.com), this should protect me from the dangers of CORS, no? | |
Apr 3, 2017 at 10:39 | comment | added | Hasan | @MarkoVodopija First option introduces use of an additional (proxy) layer for every request. I feel like this would have negative impact on request times as the requests/responses will have to jump through another hoop (proxy). The second option will need CORS as you said. But it's advantage on the first option is, there is no proxy layer between the client (SPA) and the API and I still get to hide my client secret and refresh token from anybody. I don't know the dangers of using CORS though. What do you think which one is more feasible? | |
Apr 3, 2017 at 10:32 | comment | added | Marko Vodopija | I understand your reasoning in first scenario. You don't want to deal with CORS and use single origin policy to your advantage. What I don't understand with your second secnario is that you abandoned the original idea and you now need to have CORS fully configured. I don't really see the point in delegating only token handling to SPA backend. What would you achieve with this? If you don't want to deal with CORS and want to make use of SOP but still have API on separate domain, you can configure reverse proxy inside your backend using Application Request Routing for IIS. | |
Apr 2, 2017 at 9:28 | comment | added | Lie Ryan | There are no authentication mechanism where the user cannot get the token that their user-agent uses to authenticate against the service. It's impossible to build one. Cookies, HTTP only Cookies, local storage, session storage, flash supercookies, etc; user can always get the token because the token is in the user's machine. | |
Apr 2, 2017 at 8:12 | comment | added | Hasan | @LieRyan Maybe I am overcomplicating things. All I want to do is to be able to use refresh_tokens without going against agreed standards and having security related troubles | |
Apr 2, 2017 at 8:07 | comment | added | Hasan | @LieRyan thanks for the comment. localStorage is not safe against the user (the user can access the client secrets and the tokens). I am currently using implicit grant. What I am trying to do is to have another flow/grant to be able to get refresh_tokens because IdentityServer4 doesn't provide refresh_tokens for the implicit grant type. Yes I am aware the two "solutions" I proposed are not using the implicit grant flow | |
Apr 2, 2017 at 7:53 | comment | added | Lie Ryan |
Since localStorage is not safe not safe against who? What's your threat model? Also, I don't think you're implementing an implicit grant. Proper implicit grant, your client application redirect user to identity.example.com rather than collecting the credential from the user itself. The entire OAuth premise is that applications and resource server never need to deal with the user's actual username/password.
|
|
Apr 2, 2017 at 6:05 | review | First posts | |||
Apr 2, 2017 at 6:24 | |||||
Apr 2, 2017 at 6:01 | history | asked | Hasan | CC BY-SA 3.0 |