Questions tagged [access-token]
An access token is an object encapsulating the security identity of a process or thread. A token is used to make security decisions and to store tamper-proof information about some system entity.
53
questions
0
votes
1
answer
67
views
token leak by copying cookie
Imagine this scenario: I have a website where the token is stored in cookies without any session validation. If I were to take this exact token and use it in another web browser, I would be logged ...
1
vote
0
answers
76
views
JWT access vs refresh tokens
I have an application that I want to secure with JWT tokens. For what I have read, the common practice is to have very short lived access tokens and very long lived refresh tokens, so that when an ...
- 111
0
votes
2
answers
288
views
Can UUID v7 be treated as a unguessable, opaque identifier?
RFC4122bis specifies UUID v7, a version which contains 74 bits of randomness.
Assuming I use a CSPRNG to generate the random bits: Are these UUIDs considered to be unguessable and are enough to ...
- 103
1
vote
0
answers
66
views
Cannot `qwinsta` during WinRM, but it works when run under `NewCredentials` logon type
When I try to WinRM into a Windows host (with a tool like evil-winrm) into the and when I do qwinsta, it says "No sessions exists for *", however, when I do RunasCs.exe x x "qwinsta&...
- 111
1
vote
1
answer
199
views
Best login flow for username and password authentication
I've been reading countless articles about login flows and what's the best for user auth, but it's all even more confusing now.
My scenario:
I have a simple app (capacitor spa) that has a simple ...
- 13
0
votes
0
answers
60
views
Two-Factor authentication bypass
I use two-factor authentication where possible, I was always under the impression that not only it prevents brute-force attacks, but makes it safer to use my accounts in untrusted environments.
I ...
- 101
0
votes
0
answers
93
views
CryptoKey with IndexedDB to secure stateless authentication
Stateless authentication using e.g. JWT can be dangerous as they are non revocable and can leak giving full access. But they are really flexible.
I'm considering scenario where issued JWT is binded to ...
- 309
0
votes
0
answers
75
views
What type of token is this?
I started noticing this kind of token in a lot of CTF tasks from different authors:
eyJlbWFpbCI6ImVtYWlsQG1haWxib3guZG9tYWluIiwiaWQiOjN9.ZLNCAQ.MxwKVKj_dramWyfT5XxT6g9U3xk
The structure is as follows:
...
- 3
1
vote
1
answer
584
views
Re-authentication with biometrics in a mobile app using access token
My mobile app has this (fairly common) authentication user experience:
user signs in with email and password
user is prompted to enable biometrics for faster access next time
when user returns to app ...
- 165
0
votes
1
answer
47
views
Is create a key to access resources than send it to client instead of login/password system , a good idea?
I would like to make a key/string/token encrypted string to send it to the user via email.
This encrypted KEY would have encrypted data (resource id) and would be stored in the database along with ...
- 1
0
votes
2
answers
98
views
Security implications of using the current session to mint new access tokens
I saw a setup recently where frontend and resource servers were hosted on subdomains of the same second level domain. E.g. ui.example.com and api.example.com.
It had an interesting authentication flow ...
- 1
0
votes
2
answers
120
views
Data Model for JWT claims
I'm implementing a JWT-based REST API for the first time and I'm trying to figure out what information to send back on the response entity when a user logs in. The strategies I am considering are:
...
- 337
1
vote
1
answer
3k
views
How to pass authentication to iframe from host app?
I will implement a chat bot web app that can be used on other websites. I plan to to host this app in www.mysite.com and customers will be able display this chat bot inside an iframe on their sites. ...
- 11
1
vote
2
answers
403
views
Does a web access token need to be encoded?
Our sports site is unlocking one of its main services so it is no longer necessary to sign up to use it for a few days. Anonymous users would have access for a few days, then we would lock them out ...
- 111
0
votes
1
answer
65
views
what is the security/verification system paypal IPN use called?
In the implementation of an IPN listener: https://developer.paypal.com/api/nvp-soap/ipn/IPNImplementation/
I understand the IPN listener verifies that the message sent to it comes from paypal by using ...
- 101
1
vote
2
answers
403
views
I need to generate a token in order to share an 'invite' link, what should the token be?
Just to elaborate a bit more:
User A owns a directory of files on my server
User A wants to share a link with a token that grants anyone with the link access to that directory
I have an API user A ...
- 31
0
votes
1
answer
382
views
The reasoning behind having access and refresh tokens for a single user SPA
I'm trying to improve security in my single page application.
Before I had only one JWT that was stored in the browser's localStorage and expired in one day.
I've improved security by adding refresh ...
- 101
1
vote
1
answer
376
views
Best Way to handle Authorization tokens on mobile apps
in our organization we have our own OpenId server (Identity Server) that we use to authenticate people into our applications, let me explain how we currently handle our web clients.
so we have an API ...
- 111
0
votes
1
answer
270
views
Bearer JWT client authentication and access token issued by authorization server
An authorization server issues an access token with issuer details which are exposed in a well-known API of that server. This server uses client authentication JWT tokens with clients configured. ...
- 101
1
vote
1
answer
216
views
Azure Shared Access Signature (SAS) token security
I'm learning Azure Storage and I am doing my best to make sure access from Internet is as safe as possible.
When I generate a connection string there is a SAS token embedded in the URL.
That token has ...
- 173
2
votes
2
answers
758
views
Encrypted instead of signed access tokens in OAuth2
In OAuth2 access token is typically JWT signed by authorization server. Assuming that we will use Ed25519 to sign the JWT, we will have 128 bits of security.
But what about access tokens that would be ...
- 309
0
votes
0
answers
51
views
Can PASETO implicit assertion provide that footer wasn't modified?
I need to use public PASETO tokens with proof fast and reliable proof that footer wasnt modified. Implicit assertions seems good choice for me as they are authenticated data. So technically I would be ...
- 309
0
votes
2
answers
95
views
Shred, cut, melt, smash, grind, then flush, is it secure disposal of a security access id card?
I had a card like a credit card that I used to use for work. It was an ID card, and it had an access code, a swiper, a barcode, my picture, my name, my rank, my license, the name of the company, and ...
0
votes
0
answers
192
views
Personal Access Tokens vs OAuth
We want users of our service to be able to write programs/scripts that act on their (i.e. the user's) behalf.
I've seen various services (github, digital ocean, gitlab) use Personal Access Tokens (...
- 1
1
vote
1
answer
184
views
What is the significance of an app leaking its access token - knowingly/unknowingly with just read access
I am doing a research on an app which has some secret ID. I see that the source code of the app has the secret ID hardcoded inside and the API to request for the access token has just this Secret ID ...
- 23
2
votes
0
answers
98
views
What would be the most complete procedure to get a simple login system working securely?
I don't have formal CS education but i've written one or 2 little websites. I have troubles communicating even in my native language but i hope this is understandable.
With simple i mean something ...
1
vote
0
answers
55
views
When apps like CI/CD require your github access token, how do they store it securely?
I'm facing a similar situation where I need to store users' access tokens, but I'm not sure how to securely store them in the server.
I've only ever used a security manager for my tokens, and salt ...
- 141
1
vote
1
answer
897
views
Is there any danger in refreshing JWT tokens directly without a refresh token?
So I wrote the following logic for my web app:
When a user interacts with the website it initiates a Backend call. In the backend every endpoint has multiple middlewares, of which there is a JWT ...
- 244
1
vote
1
answer
49
views
Securely loading private tokens on a local machine
When doing local development, I have to export a token needed for downloading dependencies from a private repository. For example:
export NPM_TOKEN=token_value
I want to make sure that this token is ...
- 11
8
votes
1
answer
5k
views
PAT vs. SSH - Why Bother with SSH?
Are there any advantages to using SSH keys vs. a PAT when interacting with a site like Github?
Github claims SSH keys are a way to not have to enter your username + password (personal access token) ...
- 202
0
votes
1
answer
992
views
Is it acceptable to send an access token back to a browser client?
I am currently following the instructions for getting an access token on behalf of a Twilio user described here
The part that is confusing me where it seems to generate an access token then proxy it ...
- 231
0
votes
0
answers
38
views
What risks are there in using an OAuth2 access_token from an IdP that I do not control to secure an API that I do control?
Imagine I host some API. Its exact function is irrelevant to the question, but it needs to have some sort of authorization put in front of it. I want to call Google's APIs, so users can interact with ...
- 194
0
votes
1
answer
402
views
Creating secure website-based login for a desktop app
This question relates to this post I made on StackOverflow recently, which I'll recap here briefly.
I have a desktop app that I would like to authenticate through a website, using the process outlined ...
- 103
1
vote
0
answers
101
views
Best way to handle token authentication workflow on mobile apps
I'm working on a mobile application and I need to create a token-authentication workflow.
So far I've pointed out main token:
Token by reference, that are store in database, like (https://www.django-...
- 111
0
votes
0
answers
301
views
Good practice for generating opaque access-token
Restrictions:
Access token will be short lived (2 minutes)
Access token will be one-time use only.
Given a strong random algorithm, would it be considered good practice to generate an opaque access-...
0
votes
1
answer
159
views
is it safe to read the jwt token before validating it?
is it safe to read the jwt token before validating it?
my colleagues are implementing a "check jwt for aud value and route accordingly".
this means that:
First payload is being read by the ...
- 103
0
votes
0
answers
81
views
Refresh tokens in a web environment
As I understand it, the basic idea is that you have accessToken (15 minutes), and refreshToken (1 week), a few moments before the accessToken expires, you need to ask the server for a new accessToken.
...
- 161
1
vote
0
answers
74
views
Web password reset steps
I'm trying to implement authentication for users on a web page using JWT tokens and, so far, I can create users and authorize them. I'm now trying to write the password reset functionality and I think ...
- 11
1
vote
1
answer
184
views
Reset password parameters to send
I'm building a web app in Node.js, Express, and Mongoose. I'm worried about security and optimization issues on what to send in the email link.
I see many of them sending: /:userId/:token, but if I ...
- 11
2
votes
3
answers
796
views
Detecting session sharing with OAuth2
In the OAuth2 Implict Grant flow, the access token is added to the URL fragment as part of the redirect from the Authorization Server to the Relying Party. Since this access token is made visible to ...
- 125
-1
votes
1
answer
1k
views
How to secure backend API access?
In the good old days, you made server-side websites using PHP or something like that, now we have modern web apps divided into front-end and back-end (usually API Rest), you can't rely on CORS because ...
- 183
6
votes
4
answers
3k
views
OAuth2 - using Id Token for authentication to a backend service
Many resources on the internet state that you should use Access Token and not Id Token to authenticate to an API, but do not provide explicit reasons why. Are there any real drawbacks to use an Id ...
- 289
0
votes
1
answer
834
views
Is there a risk involved in refreshing a JWT token every time you refocus the webpage?
I am currently testing a website that appears to make a refresh token request every time I focus away from the web browser and back, or away from the tab the website is open in and back to it. I've ...
- 173
0
votes
0
answers
149
views
Requiring Google Mobile Service token
I'm pentesting an android application written in Cordova and while inspecting the network traffic I found some interesting endpoint that I would like to test.
However, this endpoint need a tokenID (ex....
- 101
2
votes
0
answers
450
views
Is it a good practice to store both the Google Oauth2 access token and the refresh token in the database un hashed?
I recently came across a source code where they save a user's refresh token and the access token upon sign in through Google into the database. This is done to access the Google APIs later on through ...
- 121
1
vote
1
answer
527
views
Security requirements for public API keys
I need to provide security requirements for public API keys that will be generated by a web application and then used in automation scripts by clients.
The scripts will be run on the endpoints several ...
- 11
1
vote
2
answers
2k
views
Is there a downside to sending a refresh token on every request to an API?
Let's say that my user signs in and the server responds with a refresh token saved in a cookie (SameSite strict, HttpOnly, CSRF token too) and with the access token in response (saved in JS memory).
I ...
- 13
0
votes
1
answer
3k
views
How is pop token more secure than bearer token?
I tried reading few articles, however I'm not able to understand the merit of POP over Bearer token. Bearer token if lost (during transit over the wire) can give the holder of the token same ...
- 141
1
vote
1
answer
431
views
When generating user session tokens, should i bother checking for a duplicate?
In a program i am writing, i use session authentication tokens that we give back to a user to have them hand in with their requests.
This is working very well but this question is about the generated ...
- 125
0
votes
1
answer
352
views
Does API access token that only have access to public information need to be kept secret?
I found a Instagram Basic Display API access token leaked in a website. This token belongs to a Instagram marketing account of this website. Using my leet investigating skill, below are the ...
- 51