Questions tagged [access-token]

An access token is an object encapsulating the security identity of a process or thread. A token is used to make security decisions and to store tamper-proof information about some system entity.

Filter by
Sorted by
Tagged with
0 votes
0 answers
18 views

What risks are there in using an OAuth2 access_token from an IdP that I do not control to secure an API that I do control?

Imagine I host some API. Its exact function is irrelevant to the question, but it needs to have some sort of authorization put in front of it. I want to call Google's APIs, so users can interact with ...
user avatar
0 votes
1 answer
46 views

Creating secure website-based login for a desktop app

This question relates to this post I made on StackOverflow recently, which I'll recap here briefly. I have a desktop app that I would like to authenticate through a website, using the process outlined ...
user avatar
  • 103
0 votes
0 answers
11 views

Best way to handle token authentication workflow on mobile apps

I'm working on a mobile application and I need to create a token-authentication workflow. So far I've pointed out main token: Token by reference, that are store in database, like (https://www.django-...
user avatar
0 votes
0 answers
79 views

Good practice for generating opaque access-token

Restrictions: Access token will be short lived (2 minutes) Access token will be one-time use only. Given a strong random algorithm, would it be considered good practice to generate an opaque access-...
user avatar
0 votes
1 answer
64 views

is it safe to read the jwt token before validating it?

is it safe to read the jwt token before validating it? my colleagues are implementing a "check jwt for aud value and route accordingly". this means that: First payload is being read by the ...
user avatar
  • 103
0 votes
0 answers
33 views

Refresh tokens in a web environment

As I understand it, the basic idea is that you have accessToken (15 minutes), and refreshToken (1 week), a few moments before the accessToken expires, you need to ask the server for a new accessToken. ...
user avatar
  • 161
1 vote
0 answers
44 views

Web password reset steps

I'm trying to implement authentication for users on a web page using JWT tokens and, so far, I can create users and authorize them. I'm now trying to write the password reset functionality and I think ...
user avatar
  • 11
1 vote
1 answer
64 views

Reset password parameters to send

I'm building a web app in Node.js, Express, and Mongoose. I'm worried about security and optimization issues on what to send in the email link. I see many of them sending: /:userId/:token, but if I ...
user avatar
2 votes
3 answers
183 views

Detecting session sharing with OAuth2

In the OAuth2 Implict Grant flow, the access token is added to the URL fragment as part of the redirect from the Authorization Server to the Relying Party. Since this access token is made visible to ...
user avatar
-1 votes
1 answer
336 views

How to secure backend API access?

In the good old days, you made server-side websites using PHP or something like that, now we have modern web apps divided into front-end and back-end (usually API Rest), you can't rely on CORS because ...
user avatar
  • 143
0 votes
0 answers
129 views

how to avoid Oauth2 timeouts with orchestrator REST API

I have a REST API, which I'll call "R". R uses Oauth2 Bearer tokens for auth. However, R has a fairly complex API, so we're designing a new system called "O" that provides a ...
user avatar
  • 51
2 votes
3 answers
492 views

OAuth2 - using Id Token for authentication to a backend service

Many resources on the internet state that you should use Access Token and not Id Token to authenticate to an API, but do not provide explicit reasons why. Are there any real drawbacks to use an Id ...
user avatar
  • 229
0 votes
1 answer
181 views

Is there a risk involved in refreshing a JWT token every time you refocus the webpage?

I am currently testing a website that appears to make a refresh token request every time I focus away from the web browser and back, or away from the tab the website is open in and back to it. I've ...
user avatar
  • 173
0 votes
0 answers
87 views

Requiring Google Mobile Service token

I'm pentesting an android application written in Cordova and while inspecting the network traffic I found some interesting endpoint that I would like to test. However, this endpoint need a tokenID (ex....
user avatar
  • 101
2 votes
0 answers
162 views

Is it a good practice to store both the Google Oauth2 access token and the refresh token in the database un hashed?

I recently came across a source code where they save a user's refresh token and the access token upon sign in through Google into the database. This is done to access the Google APIs later on through ...
user avatar
  • 121
1 vote
1 answer
164 views

Security requirements for public API keys

I need to provide security requirements for public API keys that will be generated by a web application and then used in automation scripts by clients. The scripts will be run on the endpoints several ...
user avatar
  • 11
0 votes
2 answers
710 views

Is there a downside to sending a refresh token on every request to an API?

Let's say that my user signs in and the server responds with a refresh token saved in a cookie (SameSite strict, HttpOnly, CSRF token too) and with the access token in response (saved in JS memory). I ...
user avatar
0 votes
1 answer
1k views

How is pop token more secure than bearer token?

I tried reading few articles, however I'm not able to understand the merit of POP over Bearer token. Bearer token if lost (during transit over the wire) can give the holder of the token same ...
user avatar
  • 141
1 vote
1 answer
205 views

When generating user session tokens, should i bother checking for a duplicate?

In a program i am writing, i use session authentication tokens that we give back to a user to have them hand in with their requests. This is working very well but this question is about the generated ...
user avatar
  • 125
0 votes
1 answer
118 views

Does API access token that only have access to public information need to be kept secret?

I found a Instagram Basic Display API access token leaked in a website. This token belongs to a Instagram marketing account of this website. Using my leet investigating skill, below are the ...
user avatar
1 vote
0 answers
97 views

MFA authentication to O365 - remote workers users without mobile phone. Which secure solution? [closed]

We are deploying O365 in my company (Teams, Sharepoint, Exchange online, Office suite). In order to connect outside our network (remote workers especially during this pandemic), we've implemented MFA ...
user avatar
1 vote
2 answers
87 views

Is access token confidentiality also ensured in the Authorization Code grant type in Oauth2.0

One of the really nice articles I came across while trying to understand the various grant types in Oauth2.0 was this. The author really has done a good job at explaining quite clearly what various ...
user avatar
  • 1,472
1 vote
2 answers
96 views

What is a reasonable timeframe that should be defined and enforced for access token expiry to reduce the risk of unauthorised access? [duplicate]

What is a reasonable timeframe that should be defined and enforced for access token expiry to reduce the risk of unauthorized access?
user avatar