Questions tagged [access-token]

An access token is an object encapsulating the security identity of a process or thread. A token is used to make security decisions and to store tamper-proof information about some system entity.

Filter by
Sorted by
Tagged with
-1
votes
1answer
99 views

How to secure backend API access?

In the good old days, you made server-side websites using PHP or something like that, now we have modern web apps divided into front-end and back-end (usually API Rest), you can't rely on CORS because ...
0
votes
0answers
76 views

how to avoid Oauth2 timeouts with orchestrator REST API

I have a REST API, which I'll call "R". R uses Oauth2 Bearer tokens for auth. However, R has a fairly complex API, so we're designing a new system called "O" that provides a ...
2
votes
3answers
213 views

OAuth2 - using Id Token for authentication to a backend service

Many resources on the internet state that you should use Access Token and not Id Token to authenticate to an API, but do not provide explicit reasons why. Are there any real drawbacks to use an Id ...
0
votes
1answer
71 views

Is there a risk involved in refreshing a JWT token every time you refocus the webpage?

I am currently testing a website that appears to make a refresh token request every time I focus away from the web browser and back, or away from the tab the website is open in and back to it. I've ...
0
votes
0answers
47 views

Requiring Google Mobile Service token

I'm pentesting an android application written in Cordova and while inspecting the network traffic I found some interesting endpoint that I would like to test. However, this endpoint need a tokenID (ex....
2
votes
0answers
105 views

Is it a good practice to store both the Google Oauth2 access token and the refresh token in the database un hashed?

I recently came across a source code where they save a user's refresh token and the access token upon sign in through Google into the database. This is done to access the Google APIs later on through ...
1
vote
1answer
94 views

Security requirements for public API keys

I need to provide security requirements for public API keys that will be generated by a web application and then used in automation scripts by clients. The scripts will be run on the endpoints several ...
0
votes
2answers
208 views

Is there a downside to sending a refresh token on every request to an API?

Let's say that my user signs in and the server responds with a refresh token saved in a cookie (SameSite strict, HttpOnly, CSRF token too) and with the access token in response (saved in JS memory). I ...
0
votes
1answer
295 views

How is pop token more secure than bearer token?

I tried reading few articles, however I'm not able to understand the merit of POP over Bearer token. Bearer token if lost (during transit over the wire) can give the holder of the token same ...
1
vote
1answer
115 views

When generating user session tokens, should i bother checking for a duplicate?

In a program i am writing, i use session authentication tokens that we give back to a user to have them hand in with their requests. This is working very well but this question is about the generated ...
0
votes
0answers
52 views

Storing an OAuth 2.0 access token

I'm in a debate of where to securely store an OAuth 2.0 access token. There are two opinions: On the browser (inside of a HttpOnly cookie) On the server/inside the a database The argument against ...
0
votes
0answers
42 views

Securing a public service with single use token (or alternative approach)

I am working on a data uploading service. The requirements for this service dictate that it is accessible publicly on the internet. I need to protect the service from abuse. The service will be shared ...
0
votes
1answer
60 views

Does API access token that only have access to public information need to be kept secret?

I found a Instagram Basic Display API access token leaked in a website. This token belongs to a Instagram marketing account of this website. Using my leet investigating skill, below are the ...
1
vote
0answers
68 views

MFA authentication to O365 - remote workers users without mobile phone. Which secure solution? [closed]

We are deploying O365 in my company (Teams, Sharepoint, Exchange online, Office suite). In order to connect outside our network (remote workers especially during this pandemic), we've implemented MFA ...
1
vote
2answers
60 views

Is access token confidentiality also ensured in the Authorization Code grant type in Oauth2.0

One of the really nice articles I came across while trying to understand the various grant types in Oauth2.0 was this. The author really has done a good job at explaining quite clearly what various ...
1
vote
2answers
56 views

What is a reasonable timeframe that should be defined and enforced for access token expiry to reduce the risk of unauthorised access? [duplicate]

What is a reasonable timeframe that should be defined and enforced for access token expiry to reduce the risk of unauthorized access?