Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Authorization is a key theme in computer security practices.

0
votes
1answer
21 views

XMLHttpRequest with preflighted CORS missing authorization token

I have a followup question to this older question: How to exploit a misconfigured CORS policy when a per user authorization token is required? According to the documentation here: https://developer....
0
votes
0answers
17 views

Role-based and multitenant authorisation via JWT?

First thing: let's put aside the debate on whether JWT should be used for managing sessions, I'm already aware of it and (at least some of) its limitations (invalidation, automatic prolongation of ...
2
votes
2answers
165 views

Given a secure channel, are there any benefits in using SCRAM over a username and password?

Given that a communication over HTTP uses SSL encryption uses public key pinning to prevent MiTM attacks is security in any way elevated by using Salted Challenge Response Authentication Mechanism (...
1
vote
1answer
42 views

Encrypted log entries authorization

We have a database table of encrypted log entries, each encrypted entry containing information about the user who created the entry. The entry is encrypted with the encryption key of the particular ...
0
votes
2answers
111 views

OAuth - How does the Resource Server validate the access token is not for any other Resource Server?

Let's take an example where there are two resource servers - RS1 and RS2 and there is one authorization server - AS. Both resource servers - RS1 and RS2 use authorization server - AS If a client ...
3
votes
0answers
71 views

How can an organization manage permissions in a centralized way?

Almost all applications mantain the permissions with the application and have no way of having at least the roles outside the application. Is the only way to have centralized authentication but ...
0
votes
1answer
87 views

Avoid brute force attacks on oAuth authorization server

I've been looking into the oAuth 2 authorization framework for a while now. Yesterday I started wondering how to prevent a brute force attack during the Authorization Code Grant flow (https://tools....
2
votes
0answers
15 views

How to update authorization information in a KDC dynamically?

I wish to add Kerberos authentication and authorization into a project that has a service server that interacts with a Hadoop cluster that has some users and permissions. As far as I know, the KDC ...
4
votes
1answer
59 views

Need of scope in OAuth Client Credentials Flow

For me, Client Credential flow is like client is asking access token for itself - not on behalf of some user. Then, why would client like to limit its own scope? What is the benefit of scopes in ...
1
vote
1answer
198 views

OAuth2 for mobile apps with confidential backend client (Is PKCE required?)

I'm wondering why neither rfc6749 nor rfc8252 seem to consider the case where the mobile app does not make protected resource requests (and is therefore not a client) but instead relies on a backend ...
2
votes
0answers
36 views

Is passing claims about the user in an access token is “abusing” OpenID Connect?

First, let me assure you that I have read a number of posts on the topic before asking this question, but I am still confused and would appreciate more insights. So, here's the premise: There is a ...
3
votes
1answer
75 views

Managing critical passwords and data across a small business with a focus on business continuity

I work with a small startup in the beginning of it's life cycle. I recently raised some security concerns involving business continuity and emergency preparedness. I have been trying to make a ...
2
votes
0answers
63 views

JWT in localStorage with encrypted sessionId

What I want: Store a JWT in localStorage. The JWT contains claims about authorization. Prevent the JWT from being stolen and used by an attacker (using XSS) Avoid CSRF Storing the JWT in ...
0
votes
1answer
30 views

SMTU AUTH and compromised user

Recently I've set up two SMTP auth-enabled sendmails, and within a week and month both of them were used to send unsolicited mail using SMTP AUTH. Attackers were acting from different IP and using ...
3
votes
0answers
72 views

Could this authentication/authorization flow be attacked without compromising the Authority Server?

I am trying to come up with (at this time) server-to-server distributed authorization/authentication that would have (near) the same advantages as OAuth2 but without it's drawbacks. Is there any ...
-3
votes
1answer
250 views

secure public facing wallet API accessed by mobile devices

I am implementing a public mobile wallet application where user can add his own card, like Android Pay, or Samsung Pay on Android device. The standard way how these applications are initially working ...
0
votes
0answers
13 views

Is there ever a situation where it makes sense for a web app to use Explicit (auth-code based) oAuth2 authentication?

From what I've read, the main reason to use explicit oAuth is that the user-agent never sees the auth token. However, if we are designing a web app with auth-code based oAuth2, it seems impossible for ...
0
votes
0answers
16 views

How to protect SSL/TLS certificate files allowing access to NodeJs app [duplicate]

What are recommended approaches or any methods to protect the SSL/TLS certificates, such that - only NodeJs application running on the server (linux) can access to the files securely. And no one else ...
3
votes
1answer
431 views

Secure RESTful api communication between multiple servers

Currently I have the following design: Central cloud hosted server with a REST api Multiple remote servers each with a REST api Data is posted from the remote servers to the central server at ...
0
votes
3answers
84 views

Degree of safety of an unencrypted hard-drive and the general theory behind it

I always thought that everything on computer hard-disk is encrypted which can only be read(and understood) after passing my username and password to decrypt it. However, this is clearly not the case. ...
2
votes
0answers
183 views

Web app access control system design

I am having trouble finding a scalable way to create a access control system which both follows best practices and can scale well. I have looked at various approaches like RBAC and ABAC. For the ...
3
votes
2answers
153 views

Is SipHash a secure alternative to HMAC-SHA256 for user authentication?

After reading the Wikipedia page about SipHash I think it can be used like HMAC-SHA256 in JWT to create and verify API tokens (authenticate client devices). In JWT the server creates this MAC to sign ...
1
vote
0answers
169 views

Micro Service - Outh2 Workflow with a SPA, Facebook Login and JWT

Introduction We are currently trying to figure out a way to implement token based authentication and authorisation with Facebook Connect combined with maybe JWT within the micro service architecture. ...
1
vote
0answers
219 views

Is it safe to implement JWT auth with cookies, token versioning, and no refresh tokens?

I have some questions about my implementation of bearer token security (JWT to be specific) in an asp.net core 2.0 project that I'm working on. The bearer token is used when the frontend web app talks ...
0
votes
0answers
512 views

Alternative of etc/passwd for windows based server

I am doing Authorization test of Path traversal with Burp Suite. using payloads like below: ../(FileName) ../../(FileName) ../../../(FileName) ../../../../(FileName) ../../../../../(FileName) ../...
5
votes
0answers
164 views

Separating “function” from “scope” in RBAC

I'm trying to formulate an RBAC permission model which allows separation between permissions and the scopes on which those permissions are applied. I have been unable to find a standard model which ...
2
votes
1answer
102 views

Access based on type of information requested and access grant

The simple solution to access restriction when number of users are small is Access Control Matrix. Here the rows are the users and columns are different types of asset. In my case, I have a document ...
1
vote
1answer
183 views

Is the OAuth 2 authorization code flow vulnerable to the Confused Deputy Problem?

Confused Deputy Problem (also known as 'The Devil Wears Prada') is an OAuth 2 vulnerability arising when the protocol is used for authentication. Essentially, a malicious client obtains a token for a ...
0
votes
1answer
33 views

Is the following scheme for Google OAuth2 authentication and authorization satisfactory and secure?

I have a users table in my SPA application (Phoenix API application) which contains the fields: name, email, registered_at, role_id. I use OAuth2 authentication by Google API. After the end-user ...
0
votes
0answers
53 views

Was the Huddle problem just a “bug” in the implementation of true two-factor authentication?

I've just read the BBC News item Huddle's 'highly secure' work tool exposed KPMG and BBC files. According to the article: How did this happen? During the Huddle sign-in process, the customer's ...
0
votes
0answers
306 views

Tomcat : Authentication and Authorization Flow

Can anybody explain the code flow of tomcat's Authentication and Authorization. Or how we can explore, is there any way ? I have seen the code from BasicAuthenticator.java,AuthenticatorBase.java etc....
0
votes
2answers
53 views

Authorization / Access control in a client-side-encryption environment

I'm thinking about a client-side encryption concept where only the client knows the master secret (a user password). A correct implementation assumed, with KDF and authenticated encryption solutions ...
4
votes
2answers
2k views

Will “Authorization: Bearer” in request header fix CSRF attacks? [duplicate]

I have been reading on fixing CSRF attacks. From some research I understand that checking for a non-standard header would prevent CSRF attacks since the browser will not automatically send such ...
0
votes
4answers
109 views

Protecting from console attacks

I am creating a web-app using PHP and jQuery Ajax for my client-side. When I was testing some security stuff, I thought of inserting a malicious user account with admin access in the database by ...
2
votes
1answer
53 views

Authorization expiration without reliable clock / time

I've been looking, but I think its impossible to find a pairing solution that has the benefits of authorization expiration and renewal (like x509 cert expiry and OAuth expires_in), but that works ...
0
votes
2answers
530 views

Fine grained authorization with OAuth2

In my understanding of OAuth2 the scope may be used to specify access to what is asked and granted by code owner. In most cases I encounters the scope list is closed and specify "kinds" of thing ...
69
votes
7answers
18k views

User can't navigate to webpage through the UI due to permissions, but are able to navigate to page by pasting the URL. How do I protect against this?

In my application, users have certain roles which have permissions. These permissions dictate which UI elements are available to them at the home screen. Many of the elements link to other pages, ...
2
votes
1answer
793 views

How to secure handshake system-to-system in RESTful API calls without user/pass?

I have system X from another department in our company that sends basic user info (not passwords) to my system using RESTful API. Both systems are using subdomains of the same domain but reside on ...
0
votes
0answers
240 views

How to load static content using iFrame with authorization

Let's say we have a static .html file hosted here: https://content.domain.com/dir1/dir2/index.html Content server requires authorization token in order to access the file. Is there anyway I can ...
1
vote
1answer
33 views

Are There Any Standards for building pin code authorization?

We're going to add a pin authorization feature to our website. So, I'm wondering a question, how to make it secure? As I understand, Apple/Windows after first user login link pincode to a specific ...
0
votes
0answers
46 views

Sending sensitive param to public API?

I need to modify a publicly-accessible REST API - unsecured, all HTTP GETs, access (theoretically) limited by API keys. I need one of the endpoints to now accept an additional parameter - one that's ...
1
vote
2answers
94 views

Self-Coded User Authentication Security

We are currently using Apache Shiro for our User Authentication needs. We have dynamic authorization\authentication needs, in some cases users will be authenticated using Active Directory while some ...
0
votes
1answer
268 views

How to store encrypted user's data on a server, decrypt only on the client, and store the key elsewhere?

Here's what I would like to do: have a client side that generates and processes the user's data, then encrypts it and stores in a database - in order to later retrieve, decrypt and process the data ...
1
vote
2answers
128 views

What should I check on temporarily lost computer?

I physically lost my laptop containing some sensitive information and it was picked up by a stranger. I was of course over confident and didn't have it password locked. He was very courteous in ...
2
votes
1answer
262 views

Do we need to maintain Authentication and Authorization Logic separately? [closed]

We are using Keycloak Identity server which will take care of Authentication and Authorization for our new Multi Level Marketing Website. There was a discussion going on within our team to maintain ...
1
vote
1answer
125 views

OAuth 2.0: Are refresh tokens still beneficial when all clients are public?

I'm designing a new REST API for a mobile app service, which is something I've not yet had to do from scratch. I decided to use OAuth 2.0 with the Resource Owner Password Credentials grant. Ideally, ...
0
votes
1answer
186 views

Where should the authorization logic go in an api based application?

I have a brand new Rails api based application, where i need to implement authorization. Overall Architecture: React frontend -> Rails API layer -> Rails model/server layer While exploring ...
1
vote
1answer
361 views

OAuth 2.0: What is the advantage of authorization_code grant flow over Implicit grant flow?

I'm not able to appreciate what is the advantage of having a autorization_code given to the client and then exchanging this for access token on webapp side. Instead why not just give access_token to ...
1
vote
2answers
118 views

We want to give an outside party access to a demo environment. How do we ensure only they get access to only their version of the environment?

We are currently setting up a system where we can create demo environments for prospective clients to use, where we host those demo environments in our own DMZ. The idea is that if a prospect wants to ...
2
votes
1answer
460 views

Using Simple JWT for Public Facing API Auth

I'm looking at security methods for APIs. Using JWT access tokens after client login with user/password will work well for internal web apps using our own APIs. However, I'm looking at how we should ...