Questions tagged [access-token]

An access token is an object encapsulating the security identity of a process or thread. A token is used to make security decisions and to store tamper-proof information about some system entity.

Filter by
Sorted by
Tagged with
0
votes
1answer
54 views

How is pop token more secure than bearer token?

I tried reading few articles, however I'm not able to understand the merit of POP over Bearer token. Bearer token if lost (during transit over the wire) can give the holder of the token same ...
1
vote
1answer
90 views

When generating user session tokens, should i bother checking for a duplicate?

In a program i am writing, i use session authentication tokens that we give back to a user to have them hand in with their requests. This is working very well but this question is about the generated ...
0
votes
0answers
33 views

Storing an OAuth 2.0 access token

I'm in a debate of where to securely store an OAuth 2.0 access token. There are two opinions: On the browser (inside of a HttpOnly cookie) On the server/inside the a database The argument against ...
0
votes
0answers
30 views

Securing a public service with single use token (or alternative approach)

I am working on a data uploading service. The requirements for this service dictate that it is accessible publicly on the internet. I need to protect the service from abuse. The service will be shared ...
0
votes
1answer
33 views

Does API access token that only have access to public information need to be kept secret?

I found a Instagram Basic Display API access token leaked in a website. This token belongs to a Instagram marketing account of this website. Using my leet investigating skill, below are the ...
1
vote
0answers
51 views

MFA authentication to O365 - remote workers users without mobile phone. Which secure solution? [closed]

We are deploying O365 in my company (Teams, Sharepoint, Exchange online, Office suite). In order to connect outside our network (remote workers especially during this pandemic), we've implemented MFA ...
1
vote
2answers
39 views

Is access token confidentiality also ensured in the Authorization Code grant type in Oauth2.0

One of the really nice articles I came across while trying to understand the various grant types in Oauth2.0 was this. The author really has done a good job at explaining quite clearly what various ...
1
vote
2answers
43 views

What is a reasonable timeframe that should be defined and enforced for access token expiry to reduce the risk of unauthorised access? [duplicate]

What is a reasonable timeframe that should be defined and enforced for access token expiry to reduce the risk of unauthorized access?