The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [authorization]

Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Not to be confused with authentication.

Filter by
Sorted by
Tagged with
2
votes
2answers
106 views

How to protect Authentication API from a DDoS attacks?

After Login, severs can check authorization, tokens etc at API and WAF levels to mitigate DDoS attacks. But this can only happen after user has logged in. How can we protect DDoS attack on login API? ...
1
vote
2answers
61 views

Use bidirectional SSL with CAC from phone

Is it possible to extract the certificate from a CAC (DOD common access card) and install it on a phone so that access to websites using bidirectional SSL can be done from a user phone. Ideally, the ...
0
votes
0answers
43 views

How to stop the user from intercepting their own credentials in mobile apps? [duplicate]

We are experiencing fraud with our open API, so we're turning it private. Let's suppose that I'm using OAuth and Bearer token to authorize who can access my API. Request: App -> Credentials -> Auth ...
0
votes
0answers
52 views

Google SMS verification codes broken on a loop - should I be concerned?

So this is a little out of the ordinary. Not sure what to make of it. I've enable 2-Step Verification on a Google account. When opening mail or other G-related services, it sends an SMS(text message) ...
2
votes
1answer
107 views

Is adding a prefix to an API token lowering it's security

When creating API tokens, one can pick any format one likes. Many people choose to use 40 random characters. I'm wondering how much of a security issue is to prefix the API key with a prefix "...
3
votes
2answers
228 views

2-step authorization (using SMS) less secure than being without 2FA at all?

I've been thinking about a paradoxical but a theoretically possible event: Even though SMS-based 2-step authorization increases security generally, on the other hand, in some cases, it might become ...
1
vote
3answers
104 views

Is exposing enumerated id's a bad idea if precautions are taken?

Say I have a website that has the URL website.com/student/{studentId}/courses for retrieving all the courses a student is enrolled in. The studentId is an auto-incrementing value in the Student table ...
1
vote
1answer
52 views

Reasonable security measures for unvalidated “login”

Sorry, kind of a long question. I am hoping that someone smarter about InfoSec than I am will read what I'm doing and give me guidance... Background My website allows psychiatrists to track their ...
2
votes
0answers
96 views

How does the photoTAN procedure work?

Lately, most banks (at least in Germany) are promoting the photoTAN procedure as the most modern and secure way of authorizing transactions in online banking, see for example here. However, searching ...
2
votes
3answers
61 views

Is it advisable to tie different capabilities to different session tokens?

Let's say you're creating a banking web application with mobile apps. A bank user has permissions "transfer money" and "view balances." When a user logs in, we can create a session token (typical ...
1
vote
1answer
64 views

Attribute-based access control standard definition

While reading a number of definitions of attribute-based access control (ABAC), I found that there are two different definitions: Access control decisions are made using the attributes of users, ...
0
votes
0answers
53 views

Potential problems not verifying the JWT signature if wrapped in another JWT depending on HTTPS

Say that we have an authentication system that generates JWT to authenticate users to other systems. This JWT contains an inner token that can be made by multiple IDP's. The signature of this JWT is ...
1
vote
1answer
174 views

Is Certified | Ethical Hacker (C|EH) a scam or legitimate? [closed]

I've been doing a lot of research on Certified | Ethical Hacker (C|EH) to see if it's a credible certification. But I've stumbled across a Wikipedia article on it and discovered that the sources are ...
0
votes
0answers
17 views

Server to Server API Security [duplicate]

Background I have a use case where external 3rd party remote servers (which I do not own or control) are sending data using a POST request to my central server over the internet. Each of these remote ...
1
vote
0answers
53 views

Is this a good approach to safely authorize requests to a SPA from an external website?

I developed an Angular app for a manufacturer that allows their customers to place orders for their products. The app uses a web service that is made available by the manufacturer's software, so it ...
2
votes
1answer
143 views

Was the Raspberry Pi-related NASA JPL network breach primarily caused by the failure to keep an updated list of authorized devices?

The question What information was stolen from JPL during the Raspberry Pi hack? refers to an event in recent news (e.g. Engadget's A rogue Raspberry Pi helped hackers access NASA JPL systems) and ...
0
votes
1answer
34 views

Securing implicit tokens (Example: Moltin)

I'm fairly new to security but I'm trying to understand how companies have their APIs set. One such case is Moltin's Implicit Token. Basically they provide you with a read-only (for the most part) ...
1
vote
1answer
245 views

Exploitability of allowed wildcard (*) CORS Origins with Bearer Token Authorization [duplicate]

I'm looking at the following setup. A web application uses a REST API to communicate with the server. All API responses include Origin: *. For authorization Authorization: Bearer <token> is used....
1
vote
0answers
68 views

Designing distributed authentication/authorisation system

I'm trying to design a system that has the following elements: the main backend REST API (currently one, probably multiple in the future) front-channel client(s) -- JS-based single-page app(s) back-...
2
votes
2answers
105 views

Attacker models of long-term logins: how should sensitive server endpoints require re-authentication?

Let's see the following scenario: "GutHib" is a fictional hosting service in the form of an online webapp for the fictional DVCS software "Gut". Alice logged in to GutHib with her password and 2FA, ...
0
votes
1answer
58 views

Does split knowledge always require an implementation of dual control?

Maybe I'm misunderstanding something here. Dual Control: Actions taken by different operators to affect a change. Split Knowledge: Information needed to affect a change is split between ...
0
votes
1answer
62 views

How to authorize access to a resource when requested with CORS and validate the origin?

I'll try to make the explanation simple and to the point (keyword try). And if that's not sufficient, then maybe I can expand on the question. Imagine two sites: resources.example.com and www.example....
0
votes
0answers
61 views

Having one OIDC provider and multiple APIs from third parties, how can I federate logins?

If I have an app which authenticates against one OIDC provider eg. Google but then uses the provided id- and access-token to make request against a 1. app-api and 2. a third-party-api using the tokens ...
1
vote
1answer
63 views

Is it recommended to send an authentication request to the Resource Owner (by the Authorization Server) if it already has an active session?

In OAuth 2.0 Authorization Code Flow (Grant Type), is it recommended (or is it maybe even a best practice) to send an authentication request (e.g. a login-request form) to the Resource Owner (by the ...
3
votes
0answers
82 views

How does “Fides” from the German Bundesdruckerei work?

I'm no security or cryptographic expert, just an interested computer scientist - so this question may be at the wrong place, or contain wrong assumptions. Nevertheless: The German Bundesdruckerei ...
1
vote
0answers
59 views

Abusively? repurposing authorization token handler

Background I have an authorization handler of the form: Auth(AllowedGroups, Token) -> [Allow/Deny] Where the Token consist of the following tuple and its MAC tag. TbsToken := (userid, ...
2
votes
2answers
72 views

What prevents an identity provider from falsifying authorization in a SAML 2.0 flow?

I'm confused about something in the SAML 2.0 flow. When the initial access to the service provider is made, the service provider must first validate that the user indeed has access and so the service ...
1
vote
1answer
66 views

What is the logic behind Microsoft recommending that creation of “god group” / Tier -0 in their Red Forest model for AD?

Creating a Tier-0, which is basically a "God Group" in Red Forest AD model seems a bit off to me, so I was wondering about its logic.
1
vote
1answer
129 views

How to get access token programatically when we try to authorize by grand_type auth-code in the OAuth 2.0 like a user?

There is a bank service that provides API to do some operations with bank accounts. To perform a request to all endpoints of this service I, first of all, need to get auth token via grand_type=...
0
votes
1answer
38 views

Security and Links on Social Media

My sister is afraid to let me have a link on her Facebook page (I don't use Facebook) to my page at the artofwhere website where I have products adorned with my artwork for sale. Am I correct that her ...
1
vote
0answers
70 views

What is a gain from storing jws token in database

Recently someone mentioned he is using JWS token for authorisation, but JWS tokens received via API calls are validated against active ones stored in database. (EDIT he also checks signature). In my ...
0
votes
0answers
43 views

How to prohibit overwriting of Files

I have applied NTFS permissions to help protect a few files from accidental deletion. All the features do prevent users from accidentally/purposefully delete files. However, I am unable to find a ...
0
votes
0answers
168 views

How to create an anonymous user account like the app Day-One does?

A new iOS app should be able to connect to a web service to sync data across devices. I like the way the diary app Day One solved this by offering "real" user accounts and automatically generated "...
1
vote
1answer
116 views

Authorization over Internet without storing user details

We have a requirement where we are creating an user generation page over internet for various vendors. This was earlier done by our operations team on intranet. For each vendor to create a unique ID ...
1
vote
1answer
591 views

OpenID Connect: Is storing access token in browser secure?

I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
0
votes
0answers
127 views

Alternative OAuth 2 flow?

I have an implementation of the OAuth 2.0 authorization code flow, but I'm wondering if I can securely introduce a new flow. I'd like a flow that doesn't require the resource owner to ever need to ...
0
votes
1answer
170 views

capture authorization code programmatically in OAuth 2.0

In a standard OAuth auth code Grant flow, user is redirected to authorization server page where he provides consent to allow the requesting app to perform some actions on his behalf, after which a ...
0
votes
1answer
72 views

SSO authentication & authorization architecture/implemenation

We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
-1
votes
1answer
58 views

How do I detect spoofed REST API responses in my webapp?

I am building an internal admin panel for my team that will communicate to the backend server using a REST API. One of the API calls that will be performed will be an "authorization check" where the ...
0
votes
1answer
215 views

What is the protocol used for authentication/authorization of my internet access using account inside web browser?

Our university uses Microtik devices and a 3rd party application to manage our access to web and internet services. When I open browser in my desktop or connect to a wi-fi access point, it prompt that ...
1
vote
1answer
215 views

Did I get it right? OAuth2, OpenID and OpenID Connect

After a lot of research about authentication and authorization, I reached the following but not sure if what I reached is the correct thing so please help me out: Authentication is who you are. ...
0
votes
1answer
77 views

Mobile apps that use OAuth2 to offload authentication to a 3rd party: are they misusing OAuth2?

I have been tasked with building a mobile app that requires users to login to a 3rd party service via OAuth2 to obtain some data about them. This mobile app also requires its own backend database ...
2
votes
3answers
907 views

How Secure is OAuth2 for Web Applications?

Let’s consider a single page client side application, developed using HTML and Javascript. In this case, even if the implicit or authentication code flow is being used to request Access Tokes, still ...
1
vote
1answer
78 views

Is it a good idea to notify a user that they signed up with a social-login account?

Say my website provides three main ways to signup/signin: Google, Facebook and typical username/password. Is it a good idea to flash "Please login using your Google account" if a user tries to login ...
2
votes
1answer
38 views

How to control program permissions and resources in Windows

Is it possible to set specific restrictions/permissions for a program(s) by using any software/feature on Windows? Preferably set before launch and preferably set using a single software/interface, ...
2
votes
1answer
57 views

Where custom auth source code fits into the micro-segmentation, zero-trust architecture

So micro-segmentation seems a bit of a buzz-word, but it helps in painting the picture of how to better do security in a network. Basically from what I understand divide the network into a bunch of ...
2
votes
1answer
155 views

Is it secure to handle the OAuth 2 Authorization callback from a CDN?

This question is in the context of the OAuth 2.0 Authorization Framework. Consider a web application that is backed by a first-party API but relies on a third-party authorization server for SSO. Say ...
2
votes
1answer
51 views

Is providing authentication data for other web applications unsecure?

I started to work on a company whose software engineers tried to reinvent everything. They did not use(or know) industry standarts and for authentication, they use their custom solution. Their "...
1
vote
0answers
153 views

Securing RESTful APIs with Private Keys

I'm currently working on building a rest service that other applications which we create will utilize (from backend application servers). My current process uses a single private key value for ...
3
votes
4answers
167 views

Does allowing a user to know their own authorized capabilities decrease security?

In a system with a complex set of computed authorizations, does conveniently allowing a given user access to view all of their own authorizations decrease security? In a "Policy as Code" system ...