Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authorization]

Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Not to be confused with authentication.

1
vote
0answers
23 views

Did I get it right? OAuth2, OpenID and OpenID Connect

After a lot of research about authentication and authorization, I reached the following but not sure if what I reached is the correct thing so please help me out: Authentication is who you are. ...
0
votes
1answer
42 views

Mobile apps that use OAuth2 to offload authentication to a 3rd party: are they misusing OAuth2?

I have been tasked with building a mobile app that requires users to login to a 3rd party service via OAuth2 to obtain some data about them. This mobile app also requires its own backend database ...
1
vote
3answers
104 views

How Secure is OAuth2 for Web Applications?

Let’s consider a single page client side application, developed using HTML and Javascript. In this case, even if the implicit or authentication code flow is being used to request Access Tokes, still ...
1
vote
1answer
73 views

Is it a good idea to notify a user that they signed up with a social-login account?

Say my website provides three main ways to signup/signin: Google, Facebook and typical username/password. Is it a good idea to flash "Please login using your Google account" if a user tries to login ...
2
votes
1answer
31 views

How to control program permissions and resources in Windows

Is it possible to set specific restrictions/permissions for a program(s) by using any software/feature on Windows? Preferably set before launch and preferably set using a single software/interface, ...
2
votes
1answer
44 views

Where custom auth source code fits into the micro-segmentation, zero-trust architecture

So micro-segmentation seems a bit of a buzz-word, but it helps in painting the picture of how to better do security in a network. Basically from what I understand divide the network into a bunch of ...
2
votes
1answer
41 views

Is it secure to handle the OAuth 2 Authorization callback from a CDN?

This question is in the context of the OAuth 2.0 Authorization Framework. Consider a web application that is backed by a first-party API but relies on a third-party authorization server for SSO. Say ...
2
votes
1answer
47 views

Is providing authentication data for other web applications unsecure?

I started to work on a company whose software engineers tried to reinvent everything. They did not use(or know) industry standarts and for authentication, they use their custom solution. Their "...
0
votes
0answers
46 views

Securing RESTful APIs with Private Keys

I'm currently working on building a rest service that other applications which we create will utilize (from backend application servers). My current process uses a single private key value for ...
3
votes
4answers
149 views

Does allowing a user to know their own authorized capabilities decrease security?

In a system with a complex set of computed authorizations, does conveniently allowing a given user access to view all of their own authorizations decrease security? In a "Policy as Code" system ...
3
votes
3answers
92 views

What is a simple and secure method to transfer virtual assets?

Consider a MMORPG where users own virtual assets like magical swords or rings that can be used by the player. This system needs a safe method for transferring assets from Alice to Bob. One ...
10
votes
2answers
2k views

Public API with authorization token — is it possible to protect the demo token?

I have a REST API for running some calculations and returning the result, with a very simple token system where only authorized users can use the API. The user adds their token to the query like this:...
0
votes
1answer
41 views

What is a good way to authorize a client at a time to perform an action through websockets?

I am working on a round based web game where only one client/player at a time can perform an action. Throughout the game every player will have a websocket connection to the server. The client will ...
2
votes
1answer
44 views

Should user be authorized in site after following email change confirmation URL?

When users triggers email change, we send a link to their new email address. If user follows the link, should we only proceed with email change after authorization (being logged in the site), or we ...
0
votes
1answer
51 views

What parameters can be used to configure context-sensitive authorisation?

I recognise that context-sensitive authorisation to applications is a good security control however I can currently only think of location being an example of a sensitive context. I don't consider ...
1
vote
1answer
32 views

Center for Internet Security Version 6.1 Critical Security Control 16-10

My project is implementing The CIS Critical Security Controls, Version 6.1 Can anyone please give me some advice on how we can address sub-control 16.10 which says..... "Profile each user’s typical ...
2
votes
1answer
50 views

What is the proper flow for authentication?

I'm tasked with migrating a group of .Net WebForms applications from a current custom username/password login scheme to an oauth2/openid connect based authentication and authorization. This specific ...
4
votes
1answer
234 views

Can oauth2 “state” parameter be used to avoid using session cookies to identify user

https://tools.ietf.org/html/rfc6749#section-4.1.1 states: 4.1.1. Authorization Request" "state" RECOMMENDED. An opaque value used by the client to maintain state between the ...
1
vote
1answer
38 views

What's the point in a proxy server authorizing/authenticating clients?

I've implemented a SOCKS5 proxy library, but I just don't get the point of authenticating (or encrypting) connections, which the RFC (1928) seemed pretty adamant about. Isn't anonymity the whole idea ...
1
vote
1answer
234 views

OAuth 2 Implicit grant type for first party SPA - Most secure and sensible way

My aim is to secure my stateless API and only allow the registered first-party clients (SPA) to consume my resources. There is not going to be any third party clients in my scenario. I know Oauth 2 ...
2
votes
1answer
60 views

Smartphone fingerprint plus iris scanning for login

I have often thought about the fact that when intimate relationship partners live together they eventually tend to sneak over your shoulder and gain access to your password on either your mobile phone ...
1
vote
1answer
241 views

Web-Application with CORS Origin: * using authorization header

As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote: When responding to a credentialed request, the server must specify an ...
1
vote
1answer
40 views

Attribute certificate to model subject-object-action for access control

I am using Attribute Certificate (along with X509 PKC) for access control. What I really want to model is an access control semantic where a subject has a privilege to perform certain action on ...
0
votes
1answer
445 views

XMLHttpRequest with preflighted CORS missing authorization token

I have a followup question to this older question: How to exploit a misconfigured CORS policy when a per user authorization token is required? According to the documentation here, the Access-Control-...
0
votes
0answers
122 views

Role-based and multitenant authorisation via JWT?

First thing: let's put aside the debate on whether JWT should be used for managing sessions, I'm already aware of it and (at least some of) its limitations (invalidation, automatic prolongation of ...
2
votes
2answers
212 views

Given a secure channel, are there any benefits in using SCRAM over a username and password?

Given that a communication over HTTP uses SSL encryption uses public key pinning to prevent MiTM attacks is security in any way elevated by using Salted Challenge Response Authentication Mechanism (...
1
vote
1answer
79 views

Encrypted log entries authorization

We have a database table of encrypted log entries, each encrypted entry containing information about the user who created the entry. The entry is encrypted with the encryption key of the particular ...
2
votes
2answers
991 views

OAuth - How does the Resource Server validate the access token is not for any other Resource Server?

Let's take an example where there are two resource servers - RS1 and RS2 and there is one authorization server - AS. Both resource servers - RS1 and RS2 use authorization server - AS If a client ...
3
votes
0answers
76 views

How can an organization manage permissions in a centralized way?

Almost all applications mantain the permissions with the application and have no way of having at least the roles outside the application. Is the only way to have centralized authentication but ...
0
votes
1answer
388 views

Avoid brute force attacks on oAuth authorization server

I've been looking into the oAuth 2 authorization framework for a while now. Yesterday I started wondering how to prevent a brute force attack during the Authorization Code Grant flow (https://tools....
2
votes
0answers
26 views

How to update authorization information in a KDC dynamically?

I wish to add Kerberos authentication and authorization into a project that has a service server that interacts with a Hadoop cluster that has some users and permissions. As far as I know, the KDC ...
5
votes
1answer
251 views

Need of scope in OAuth Client Credentials Flow

For me, Client Credential flow is like client is asking access token for itself - not on behalf of some user. Then, why would client like to limit its own scope? What is the benefit of scopes in ...
1
vote
1answer
622 views

OAuth2 for mobile apps with confidential backend client (Is PKCE required?)

I'm wondering why neither rfc6749 nor rfc8252 seem to consider the case where the mobile app does not make protected resource requests (and is therefore not a client) but instead relies on a backend ...
3
votes
0answers
205 views

Is passing claims about the user in an access token “abusing” OpenID Connect?

First, let me assure you that I have read a number of posts on the topic before asking this question, but I am still confused and would appreciate more insights. So, here's the premise: There is a ...
3
votes
1answer
91 views

Managing critical passwords and data across a small business with a focus on business continuity

I work with a small startup in the beginning of it's life cycle. I recently raised some security concerns involving business continuity and emergency preparedness. I have been trying to make a ...
5
votes
0answers
124 views

JWT in localStorage with encrypted sessionId

What I want: Store a JWT in localStorage. The JWT contains claims about authorization. Prevent the JWT from being stolen and used by an attacker (using XSS) Avoid CSRF Storing the JWT in ...
0
votes
1answer
47 views

SMTU AUTH and compromised user

Recently I've set up two SMTP auth-enabled sendmails, and within a week and month both of them were used to send unsolicited mail using SMTP AUTH. Attackers were acting from different IP and using ...
3
votes
0answers
78 views

Could this authentication/authorization flow be attacked without compromising the Authority Server?

I am trying to come up with (at this time) server-to-server distributed authorization/authentication that would have (near) the same advantages as OAuth2 but without it's drawbacks. Is there any ...
-3
votes
1answer
281 views

secure public facing wallet API accessed by mobile devices

I am implementing a public mobile wallet application where user can add his own card, like Android Pay, or Samsung Pay on Android device. The standard way how these applications are initially working ...
3
votes
1answer
867 views

Secure RESTful api communication between multiple servers

Currently I have the following design: Central cloud hosted server with a REST api Multiple remote servers each with a REST api Data is posted from the remote servers to the central server at ...
0
votes
3answers
220 views

Degree of safety of an unencrypted hard-drive and the general theory behind it

I always thought that everything on computer hard-disk is encrypted which can only be read(and understood) after passing my username and password to decrypt it. However, this is clearly not the case. ...
2
votes
0answers
309 views

Web app access control system design

I am having trouble finding a scalable way to create a access control system which both follows best practices and can scale well. I have looked at various approaches like RBAC and ABAC. For the ...
3
votes
2answers
257 views

Is SipHash a secure alternative to HMAC-SHA256 for user authentication?

After reading the Wikipedia page about SipHash I think it can be used like HMAC-SHA256 in JWT to create and verify API tokens (authenticate client devices). In JWT the server creates this MAC to sign ...
1
vote
0answers
267 views

Micro Service - Outh2 Workflow with a SPA, Facebook Login and JWT

Introduction We are currently trying to figure out a way to implement token based authentication and authorisation with Facebook Connect combined with maybe JWT within the micro service architecture. ...
1
vote
0answers
317 views

Is it safe to implement JWT auth with cookies, token versioning, and no refresh tokens?

I have some questions about my implementation of bearer token security (JWT to be specific) in an asp.net core 2.0 project that I'm working on. The bearer token is used when the frontend web app talks ...
0
votes
0answers
1k views

Alternative of etc/passwd for windows based server

I am doing Authorization test of Path traversal with Burp Suite. using payloads like below: ../(FileName) ../../(FileName) ../../../(FileName) ../../../../(FileName) ../../../../../(FileName) ../...
5
votes
0answers
335 views

Separating “function” from “scope” in RBAC

I'm trying to formulate an RBAC permission model which allows separation between permissions and the scopes on which those permissions are applied. I have been unable to find a standard model which ...
2
votes
1answer
153 views

Access based on type of information requested and access grant

The simple solution to access restriction when number of users are small is Access Control Matrix. Here the rows are the users and columns are different types of asset. In my case, I have a document ...
1
vote
1answer
372 views

Is the OAuth 2 authorization code flow vulnerable to the Confused Deputy Problem?

Confused Deputy Problem (also known as 'The Devil Wears Prada') is an OAuth 2 vulnerability arising when the protocol is used for authentication. Essentially, a malicious client obtains a token for a ...
0
votes
1answer
39 views

Is the following scheme for Google OAuth2 authentication and authorization satisfactory and secure?

I have a users table in my SPA application (Phoenix API application) which contains the fields: name, email, registered_at, role_id. I use OAuth2 authentication by Google API. After the end-user ...