The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

350 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
1
vote
1answer
95 views

Centralized brute force login detection using netflow data

Is brute force login detection feasible with netflow data? With the netflow data one could check the number of incoming packets to a specific destination port (for each flow). If the number is below a ...
1
vote
0answers
68 views

Designing distributed authentication/authorisation system

I'm trying to design a system that has the following elements: the main backend REST API (currently one, probably multiple in the future) front-channel client(s) -- JS-based single-page app(s) back-...
1
vote
0answers
58 views

Reason for iOS and Android fingerprint behaviour

Both iOS and Android allow using a fingerprint sensor for logging in, and allow applications to store secrets that can only be unlocked using the fingerprint. Both allow one or more fingerprints to be ...
1
vote
1answer
136 views

Why is there a redirect to the native app in PKCE?

Why even have a redirect or even use the browser? Wouldn't just a normal TLS/HTTPS request/response in the app protect the requests and token? The one argument I have heard against solely relying on ...
1
vote
0answers
69 views

HSM best practice for access

I've been building a product using AWS CloudHSM and things are working well in the POC. Now I want move to production, I've realised that there will be a need to authenticate with the HSM in order to ...
1
vote
1answer
78 views

Can I use a JWT for both Authentication & Data Transmission

I think I have a high level understanding of what a JWT is and how it works. I would now like to apply it to a use case, namely that the token would be used for authentication purposes, and passing ...
1
vote
0answers
63 views

Payment gateway API authentication

I've been tasked with building an API that interacts with a couple of payment gateways to create payments. The API has accounts with multiple users and the accounts have payments associated with them....
1
vote
3answers
241 views

Is it possible to truly hide content behind a paywall in a single page app?

I would like to hide certain content behind a paywall in my VueJS app. In googling around... Some tutorials recommend storing the currently logged in user in local storage. And then before showing ...
1
vote
0answers
55 views

Proper implementation of JWT authentication in mobile app

I'm building a mobile app that connects to a Python Flask API and backend. Currently, I am using JWTs for authentication. The expiration of the token is set to be 6 months in advance. The thing ...
1
vote
1answer
275 views

Remember me feature: do we need a server side token if the cookie is signed by the server?

Every resource I find (I, II, III) about how to implement in a secure way the typical "remember me" login feature, recommends storing a user identifier and an associated unique token in the cookie, ...
1
vote
0answers
73 views

Authentication: E-mailing security codes vs clickable links

I've noticed a trend in how big companies (Amazon, Skype, and a few others I don't remember in particular) handle e-mail authentication. Rather than e-mailing clickable links with some single-use ...
1
vote
0answers
115 views

Is having multiple access tokens valid at the same time a security risk?

I run an API that allows multiple access tokens (JWT) to be valid for the same account, in order to allow users to sign into the web application and mobile app at the same time. Is this a potential ...
1
vote
1answer
176 views

OPC-UA Certificate Handling

I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems. My ...
1
vote
0answers
112 views

Is it secure to start a NTLM handshake not knowing if the server supports it?

I am writing a program in Python using the requests-ntlm library. That library adds support for NTLM in regular requests: import requests from requests_ntlm import HttpNtlmAuth requests.get("http://...
1
vote
0answers
44 views

How can this Authentication/Authorization flow be improved?

I am currently building a full stack web app mainly as part of an exercice. This app is made up of a back end on a server (written in Go), and a front end written in Angular (so on a user's browser). ...
1
vote
0answers
272 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
1
vote
4answers
314 views

Should I send the user ID of the user trying to authenticate in a HTTP header when using access token?

Im building a REST api for an ios application! Would it be a good idea to send the user id (primary autoincrementing token in my mySQL database) of an account when authenticating with user token? (...
1
vote
1answer
215 views

Did I get it right? OAuth2, OpenID and OpenID Connect

After a lot of research about authentication and authorization, I reached the following but not sure if what I reached is the correct thing so please help me out: Authentication is who you are. ...
1
vote
0answers
58 views

Hybrid cloud access controls

In a hybrid cloud setup, where we have a cloud component which writes data into an on premise component, is it necessary to have separate access controls between the cloud and on premise? Our ...
1
vote
0answers
53 views

Securing internal API credentials on a public chrome extension

I've developed a Chrome extension that I plan to publish to the Chrome Web Store. On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...
1
vote
0answers
412 views

OpenID connect authentication with cookie authentication middleware [Asp.Net MVC ]

In my ASP.NET MVC based application I am using 'OpenID connect authentication' middleware with 'cookie authentication middleware' (session/transient cookie). While accessing the application I ...
1
vote
0answers
83 views

Verifying the authenticity of data coming to a server

I'm a newbie when it comes to information security. So pardon me if the solution can be found at page 12 of any introductory text. I have an express server and two android apps(for clients and admin)....
1
vote
0answers
51 views

Tunelling an Authenticated User Across Microservices Securely

On a platform which follows the OAuth 2.0 framework for authorization and a microserivce based architecture, what is a secure way to pass a user from one microservice to another on the same platform ...
1
vote
0answers
35 views

git credential cache and store

I just noticed we can use git credential in order to cache our username and password so we do not need to do it everytime especially if it's on server as usually for me I would add ssh for local ...
1
vote
0answers
92 views

Webauthn and TLS channel binding

my understanding is that webauthn supports a variety of authentication schemes --not necessarily FIDO2/CTAP ; is that true? if so what is the api at webauthn that provides the hook? TLS channel ...
1
vote
0answers
260 views

How to properly store OAuth 2.0 client_id and client_secret in a web application?

In the PoC (Proof of Concept) that I'm currently developing, data from an API is consumed and OAuth 2.0 is required for authentication. The application is already working as expected, the users are ...
1
vote
0answers
153 views

Securing RESTful APIs with Private Keys

I'm currently working on building a rest service that other applications which we create will utilize (from backend application servers). My current process uses a single private key value for ...
1
vote
0answers
211 views

How to bypass NTLM HTTP authentication?

Is there any way to bypass HTTP authentication rather than brute-forcing ?
1
vote
0answers
30 views

Can a single domain be deleted from HSTS list through GPO

I have proxy performing a IWA authentication which intercepts the web request and redirects it towards the proxy's host name for auth. The redirect url is over http however the HSTS list on the end ...
1
vote
0answers
2k views

SSL routines:ssl3_read_bytes:sslv3 alert bad certificate

Running the following command: curl -v --key client_key.key --cert client_cert.crt <some url> -u <username> I get the following response: * Trying XX.XXX.XXX.X... * TCP_NODELAY set * ...
1
vote
0answers
272 views

OWASP ZAP : How to perform authentication when API endpoint only accepts raw XML?

I'm currently working at testing an Angular 6 application using OWASP ZAP. I really enjoy this tool, but like many of us, I struggle with the authentication part, and without it the whole tool turns ...
1
vote
0answers
57 views

How does using an app rather than code card to authenticate improve security?

Our bank used to issue code cards, with 72 passwords printed on them. To login to net bank we used to need to know: Our bank account number (we have that written down) A password we've picked. We ...
1
vote
0answers
89 views

What is the essence of Google Chrome’s new controversial sign-in feature?

What is the essence of Google Chrome’s new controversial sign-in feature? How does it work and how does it differ from what was it before? What is the danger of it? Is Chromium affected?
1
vote
0answers
303 views

Is this a secure implementation of JWT refresh tokens?

I am implementing a JWT refresh token and have developed the following way of refreshing tokens. The following is the program flow: When server retrieves login information, it checks against password ...
1
vote
0answers
26 views

Passing token/session values from one application to its sub application

My client currently has an existing ASP.NET web portal, which runs fine. It's hosted on their on-premise IIS Server. I will call this one the "parent application". Now I'm working on another web ...
1
vote
0answers
89 views

What is a trans-cipher?

While discussing archive authenticity/integrity for long term and the problem of potentially re-keying in case of compromise, someone came up with the term "trans-cipher" (or "trans-ciphering"). I ...
1
vote
0answers
52 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
1
vote
0answers
37 views

How to protect against rogue malicious applications in the Azure AD?

Consider the following hypothetical scenario: I create the PhotoApp - native Android application that is used by users to manage their private photos. I create the PhotoService - Web API that is ...
1
vote
1answer
116 views

Is there any system that can authenticate my device to open only select apps on it?

I am looking to have an authentication system with which I can link a device to an employee, and then put in place certain privileges so that the employee is only able to open select apps on only that ...
1
vote
0answers
61 views

Single-Page Application authentication and ISO 27001

I have a single-page javascript application that communicates with a .NET API running in IIS. Authentication is done after loading the application frontend, using an OAuth token from Office 365, ...
1
vote
0answers
71 views

Parent domain cookies for Single Sign on

Typically Single Sign On is implemented with existing protocols like SAML or OAuth. If all the sites belongs to the same parent domain such as a.example.com and b.example.com, we can also set a ...
1
vote
0answers
53 views

What is the reason why I am not able to able to use Maltego unless I disable port 135 (RPC) inbound on my Windows computer?

I originally attempted to use Maltego before making any configuration changes to my firewall; however, I was being blocked because I had port 135 disabled which is what Windows uses for RPC. After ...
1
vote
0answers
477 views

machine to machine authentication secret

For machine to machine communication (embedding other applications in applications etc.) we often face the problem that the site we're embedding requires a username and a password to authenticate. The ...
1
vote
0answers
43 views

Multi-factor asking condition

It is an established fact that the error message of login pages should not specify wether the password or the id is the problem. But for an application with multi factor authentication, should we ask ...
1
vote
0answers
68 views

Re-using the hash value of password to server by malicious actor

Let's say Alice logged into https://www.facebook.com with her email and password: Email: Alice@gmail.com Password: correctHorseShoeBattery Nonce given by ...
1
vote
0answers
34 views

How to (easily?) protect a mobile authentication endpoint?

I'm creating an app that runs both on the web and on mobile (loads offline files through cordova inside a webview) For my user's login forms in the web vesion, I use google captcha to protect ...
1
vote
0answers
291 views

How to make CNG certificates available for mutual authentication in browser?

I have implemented a CNG key storage provider and propagate my certificate according to the answer to this question to the MY store. I can see my certificate there using the MMC console. However, when ...
1
vote
0answers
23 views

AD authentication / authoraztion + WAM

soon we are going to introduce the OTRS Ticketing system in our environment - it will be used to handle security incidents related to SAP. Agents will be using their AD id's + pwd to authenticate (...
1
vote
0answers
68 views

OAuth2 auth server reusing the access token

I found some implementations of OAuth2 provider (auth server) which issues the same access token (for same user & scope) for different authentication request. Does the OAuth2 spec allows it? Any ...
1
vote
0answers
75 views

Securing pattern for tool for customer frontend

As a beginner in developing web APIs and other web technologies I'm wondering what could be the best approach for securing a tool in a customer's frontend. Let's say I'm offering a tool that can be ...