Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

426 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
1
vote
2answers
259 views

OIDC SPA Keycloak refresh_token storage location

I have Single Page Application based on Open ID Connect flow (keycloak). I wonder what are the security considerations for refresh token storage - what are the advantages and disadvantages for ...
1
vote
0answers
125 views

HSM best practice for access

I've been building a product using AWS CloudHSM and things are working well in the POC. Now I want move to production, I've realised that there will be a need to authenticate with the HSM in order to ...
1
vote
1answer
111 views

Keycloak's Angular quickstart : XSS vulnerable?

We are using Keycloak for the authentication of our server-side rendered applications (Java/Spring/Thymeleaf), and now we want to use it for our Angular applications. Using the Angular quickstart, ...
1
vote
0answers
92 views

Payment gateway API authentication

I've been tasked with building an API that interacts with a couple of payment gateways to create payments. The API has accounts with multiple users and the accounts have payments associated with them....
1
vote
0answers
148 views

Multiple authentication servers providing authorization to resource server

What I want to achieve? To authorize people to single resource server over multiple different Authentication servers. Clients want to login via their own Domain credentials and have credentials only ...
1
vote
1answer
633 views

Remember me feature: do we need a server side token if the cookie is signed by the server?

Every resource I find (I, II, III) about how to implement in a secure way the typical "remember me" login feature, recommends storing a user identifier and an associated unique token in the cookie, ...
1
vote
0answers
75 views

Authentication: E-mailing security codes vs clickable links

I've noticed a trend in how big companies (Amazon, Skype, and a few others I don't remember in particular) handle e-mail authentication. Rather than e-mailing clickable links with some single-use ...
1
vote
0answers
162 views

Is having multiple access tokens valid at the same time a security risk?

I run an API that allows multiple access tokens (JWT) to be valid for the same account, in order to allow users to sign into the web application and mobile app at the same time. Is this a potential ...
1
vote
0answers
175 views

Is it secure to start a NTLM handshake not knowing if the server supports it?

I am writing a program in Python using the requests-ntlm library. That library adds support for NTLM in regular requests: import requests from requests_ntlm import HttpNtlmAuth requests.get("http://...
1
vote
0answers
47 views

How can this Authentication/Authorization flow be improved?

I am currently building a full stack web app mainly as part of an exercice. This app is made up of a back end on a server (written in Go), and a front end written in Angular (so on a user's browser). ...
1
vote
0answers
470 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
1
vote
5answers
2k views

Should I send the user ID of the user trying to authenticate in a HTTP header when using access token?

Im building a REST api for an ios application! Would it be a good idea to send the user id (primary autoincrementing token in my mySQL database) of an account when authenticating with user token? (...
1
vote
0answers
65 views

Hybrid cloud access controls

In a hybrid cloud setup, where we have a cloud component which writes data into an on premise component, is it necessary to have separate access controls between the cloud and on premise? Our ...
1
vote
1answer
808 views

Why is it recommended to use GCP service accounts vs user accounts?

I've recently started some work on Google Cloud Platform (GCP) and while developing the auth strategy for my company, I've repeatedly come across the recommendation to use service accounts for ...
1
vote
0answers
81 views

Securing internal API credentials on a public chrome extension

I've developed a Chrome extension that I plan to publish to the Chrome Web Store. On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...
1
vote
0answers
137 views

Verifying the authenticity of data coming to a server

I'm a newbie when it comes to information security. So pardon me if the solution can be found at page 12 of any introductory text. I have an express server and two android apps(for clients and admin)....
1
vote
0answers
55 views

Tunelling an Authenticated User Across Microservices Securely

On a platform which follows the OAuth 2.0 framework for authorization and a microserivce based architecture, what is a secure way to pass a user from one microservice to another on the same platform ...
1
vote
0answers
54 views

git credential cache and store

I just noticed we can use git credential in order to cache our username and password so we do not need to do it everytime especially if it's on server as usually for me I would add ssh for local ...
1
vote
0answers
119 views

Webauthn and TLS channel binding

my understanding is that webauthn supports a variety of authentication schemes --not necessarily FIDO2/CTAP ; is that true? if so what is the api at webauthn that provides the hook? TLS channel ...
1
vote
0answers
266 views

Securing RESTful APIs with Private Keys

I'm currently working on building a rest service that other applications which we create will utilize (from backend application servers). My current process uses a single private key value for ...
1
vote
0answers
276 views

How to bypass NTLM HTTP authentication?

Is there any way to bypass HTTP authentication rather than brute-forcing ?
1
vote
0answers
54 views

Can a single domain be deleted from HSTS list through GPO

I have proxy performing a IWA authentication which intercepts the web request and redirects it towards the proxy's host name for auth. The redirect url is over http however the HSTS list on the end ...
1
vote
0answers
383 views

OWASP ZAP : How to perform authentication when API endpoint only accepts raw XML?

I'm currently working at testing an Angular 6 application using OWASP ZAP. I really enjoy this tool, but like many of us, I struggle with the authentication part, and without it the whole tool turns ...
1
vote
0answers
59 views

How does using an app rather than code card to authenticate improve security?

Our bank used to issue code cards, with 72 passwords printed on them. To login to net bank we used to need to know: Our bank account number (we have that written down) A password we've picked. We ...
1
vote
0answers
93 views

What is the essence of Google Chrome’s new controversial sign-in feature?

What is the essence of Google Chrome’s new controversial sign-in feature? How does it work and how does it differ from what was it before? What is the danger of it? Is Chromium affected?
1
vote
0answers
359 views

Is this a secure implementation of JWT refresh tokens?

I am implementing a JWT refresh token and have developed the following way of refreshing tokens. The following is the program flow: When server retrieves login information, it checks against password ...
1
vote
0answers
31 views

Passing token/session values from one application to its sub application

My client currently has an existing ASP.NET web portal, which runs fine. It's hosted on their on-premise IIS Server. I will call this one the "parent application". Now I'm working on another web ...
1
vote
0answers
117 views

What is a trans-cipher?

While discussing archive authenticity/integrity for long term and the problem of potentially re-keying in case of compromise, someone came up with the term "trans-cipher" (or "trans-ciphering"). I ...
1
vote
0answers
74 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
1
vote
0answers
43 views

How to protect against rogue malicious applications in the Azure AD?

Consider the following hypothetical scenario: I create the PhotoApp - native Android application that is used by users to manage their private photos. I create the PhotoService - Web API that is ...
1
vote
1answer
140 views

Is there any system that can authenticate my device to open only select apps on it?

I am looking to have an authentication system with which I can link a device to an employee, and then put in place certain privileges so that the employee is only able to open select apps on only that ...
1
vote
0answers
74 views

Single-Page Application authentication and ISO 27001

I have a single-page javascript application that communicates with a .NET API running in IIS. Authentication is done after loading the application frontend, using an OAuth token from Office 365, ...
1
vote
0answers
93 views

Parent domain cookies for Single Sign on

Typically Single Sign On is implemented with existing protocols like SAML or OAuth. If all the sites belongs to the same parent domain such as a.example.com and b.example.com, we can also set a ...
1
vote
0answers
500 views

What is the reason why I am not able to able to use Maltego unless I disable port 135 (RPC) inbound on my Windows computer?

I originally attempted to use Maltego before making any configuration changes to my firewall; however, I was being blocked because I had port 135 disabled which is what Windows uses for RPC. After ...
1
vote
0answers
547 views

machine to machine authentication secret

For machine to machine communication (embedding other applications in applications etc.) we often face the problem that the site we're embedding requires a username and a password to authenticate. The ...
1
vote
0answers
44 views

Multi-factor asking condition

It is an established fact that the error message of login pages should not specify wether the password or the id is the problem. But for an application with multi factor authentication, should we ask ...
1
vote
0answers
73 views

Re-using the hash value of password to server by malicious actor

Let's say Alice logged into https://www.facebook.com with her email and password: Email: Alice@gmail.com Password: correctHorseShoeBattery Nonce given by ...
1
vote
0answers
41 views

How to (easily?) protect a mobile authentication endpoint?

I'm creating an app that runs both on the web and on mobile (loads offline files through cordova inside a webview) For my user's login forms in the web vesion, I use google captcha to protect ...
1
vote
0answers
333 views

How to make CNG certificates available for mutual authentication in browser?

I have implemented a CNG key storage provider and propagate my certificate according to the answer to this question to the MY store. I can see my certificate there using the MMC console. However, when ...
1
vote
0answers
25 views

AD authentication / authoraztion + WAM

soon we are going to introduce the OTRS Ticketing system in our environment - it will be used to handle security incidents related to SAP. Agents will be using their AD id's + pwd to authenticate (...
1
vote
0answers
77 views

OAuth2 auth server reusing the access token

I found some implementations of OAuth2 provider (auth server) which issues the same access token (for same user & scope) for different authentication request. Does the OAuth2 spec allows it? Any ...
1
vote
0answers
78 views

Securing pattern for tool for customer frontend

As a beginner in developing web APIs and other web technologies I'm wondering what could be the best approach for securing a tool in a customer's frontend. Let's say I'm offering a tool that can be ...
1
vote
0answers
35 views

GPG RSA Authenticity Mechanism Minimum Requirement

The GPG/PGP based RSA authenticity signing mechanism is based on 3 parts to ensure authenticity: the public key the signature the fingerprint of the public key Assuming that the author keeps his ...
1
vote
0answers
61 views

What current methods are there to gain access to Azure?

I'm currently working with our development teams and trying to build a threat model for the Azure environment and how attackers may gain access to our instance. So far I haven't found much in the way ...
1
vote
0answers
384 views

Micro Service - Outh2 Workflow with a SPA, Facebook Login and JWT

Introduction We are currently trying to figure out a way to implement token based authentication and authorisation with Facebook Connect combined with maybe JWT within the micro service architecture. ...
1
vote
0answers
571 views

Is it safe to implement JWT auth with cookies, token versioning, and no refresh tokens?

I have some questions about my implementation of bearer token security (JWT to be specific) in an asp.net core 2.0 project that I'm working on. The bearer token is used when the frontend web app talks ...
1
vote
0answers
105 views

How do Google, Microsoft and Yahoo mask or hash passwords on the client side?

I'm making recommendations to improve our user authentication (login). Our approach thus far is to ensure we (and libraries we use) are following all of the the OWASP guidelines. I have also been ...
1
vote
1answer
293 views

How does a user get authenticated on server B if they are already authenticated on server A through OAuth2?

Lets say I have server A (a web server). Users initially use an external provider such as Google to get authenticated on that server. An entry is created in my database saying that this user has ...
1
vote
0answers
68 views

Mutual auth client certs for a pool of requesting servers behind a proxy

I've got a situation that is puzzling me. We have a vendor that is requiring mutual authentication when making a request to them. They are requesting we give them a client cert identifying our ...
1
vote
0answers
57 views

Can we send a forms auth token back from an HMAC API?

We have an ASP.NET MVC application used by people from other organisations. Some of the features are accessible via a forms login. Other features are accessible as SHA256-HMAC-authenticated API ...

1 2 3
4
5
9