I understand that OAUth 2.0 really just relies on SSL to encrypt the contents of the bearer token. However, are there any other best practices one should follow when securing OAuth 2.0?

I know you can use a bunch of extra stuff when using HMAC, like nonce, timestamp, etc., but are there any other recommended best practices for security on OAuth 2.0 messages other than just using SSL?

  • 1
    Which role of oAuth are you filling? – AJ Henderson Oct 10 '14 at 13:48
  • 1
    @AJHenderson, sorry, I should have pointed out, I'm both ends of it. I'm looking at hitting a web app and RESTful services from client browsers and mobile apps, but I own both ends of the communication, including the identity provider. Does this answer your question? – ChrisC Oct 10 '14 at 13:55
  • 1
    I think this boils down to best practices for SSL. Which boils down to the cipher suites. DHE/ECDHE with AES256 and SHA256/384/512 would be the currently accepted secure cipher suites. – RoraΖ Oct 10 '14 at 14:00
  • 1
    Fair enough. I guess what I really meant was whether there is anything else one should do to, or put in, the message to which they add the bearer token prior to putting it on the wire. – ChrisC Oct 10 '14 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.