1

Consider the following architecture: An on premise Web API 2 [Written in C# hosted in IIS] which uses OAuth 2 authentication [ Implicit Flow ] to secure itself. This API acts as the data source by external apps [ Currently an angular 9 APP ]. Token service itself is an installation of Identity Server which is responsible for issuing access tokens to the external apps. Now the question:

What would be the maximum risk associated with a compromised STS server [ The server which issues tokens ] apart from the API app not not being able to authenticate clients? I have been tasked to list all potential risks associated with an external STS [ Security Token Service ] in case of a security breach and cant categorically list them according to their severity.

Improve this question
1
  • Do you mean potential threats?
    – bhorkarg
    Apr 9, 2020 at 23:15

1 Answer 1

Reset to default
0

It is recommended to check RFC 6819 which describes the thread model and security considerations for OAuth 2.0. Also check the security considerations of RFC 6749 which describes security considerations in the context of different kinds of clients.

One you analyse the threats to your authorisation server (I assume that's what you mean by the Security Token Service), you can get an understanding of the risk of compromise based on how you have set up your authorisation server.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .