Questions tagged [authorization]

Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Not to be confused with authentication.

Filter by
Sorted by
Tagged with
0
votes
0answers
23 views

Is it considered broken access control when access relies on knowledge of a CSPRNG string?

Say I have a server which hosts video files. This server allows a user to register for an account, and using OAuth, the requests to access a user's media look like: https://mysite.com/videos/...
0
votes
1answer
73 views

Google approach to device security (BeyondCorp): managed devices and inference engine

I'm reading the BeyondCorp papers and trying to get a very high level idea of how it could be implemented by a small to medium organisation, rather than a behemoth like Google. What kind of software ...
0
votes
0answers
46 views

Inverse of Third Party Authentication

Consider this scenario. I have a file hosted on AWS with private access. I want the file to be accessible to several authorized users of a web applicaton that I have built. As I am the one ...
0
votes
0answers
42 views

How come RFC7636 (PKCE) stops malicous app doing the same code challenge and get legitimate access to API

As per the RFC7636 it stops malicious apps which pretend to be legitimate apps, gaining access to OAuth2.0 protected API's. The flow suggests a method of having a runtime level secret which generated ...
2
votes
1answer
81 views

What is the purpose of the authorization code in OAuth 2? [duplicate]

Why do we need to ask the authorization server for theAuthorization code and then exchange the Authorization code for anAccess token on the same server? Why not to return anAccess token directly, ...
1
vote
1answer
58 views

Validating API keys in a back-end web-service with very few users

I have run into this scenario a couple of times now but am hoping to get either confirmation that I'm on the right track or a suggestion as to what else should be done. Situation I am building a ...
1
vote
0answers
41 views

AWS Appsync authorization - why is IAM authorization safer than API Key based approach

We are currently evaluating which authorization type to use for our production AppSync APIs. As per AWS docs(https://docs.aws.amazon.com/appsync/latest/devguide/security.html, https://aws.amazon.com/...
0
votes
0answers
42 views

What is delegation, identity delegation, and delegated authorization, and what are the differences among them?

I've been writing up a guide to OAuth 2.0, OpenID Connect, and Identity Server 4 mostly for my own learning, drawing on several sources such as OAuth2 In Action, OAuth 2.0 Simplified, and CISSP: A ...
2
votes
1answer
94 views

OAuth2 for first party web-app

I am building a web (also potentially mobile app) for a platform that allows plugins. We're using the OAuth2 Authorization Code grant type for third-party client plugins. Which, if any, grant type ...
0
votes
0answers
38 views

Endpoint authorization using Vault

I have a bunch of micro-services set up which interact with each other. I want to set up authentication and authorization within these services so if a user has access to only one service, then it can ...
1
vote
1answer
189 views

How to invalidate JWT tokens without a database lookup with each request to the server?

JWT Bearer token and stateless REST API question I am implementing a stateless REST API. I am used to using sessions built into frameworks or 0Auth but now I am in the process of developing my own ...
0
votes
1answer
70 views

Microservice security: How to perform authorization + services also need auth checks individually?

I have the following architecture for accessing a REST service that requires authentication: Oidc token flow managed at the client Access token verified at the server in the auth service (proxied ...
-2
votes
1answer
92 views

Security without Login

I am working on a web-app where user can access his purchased item using two word/Number combination and then user add card details on same page for the payment of those item. Point to be noted ...
3
votes
1answer
74 views

OAuth 2.0 authorization code flow vulnerable to “shoulder surfing”?

When using the OAuth authorization code flow in web applications, after successful authentication of the resource owner, the authorization server usually responds with a browser redirect to pass the ...
0
votes
0answers
33 views

Is it a good practice to implement admin pages in a mobile application?

So let's say there's a page on the website that shows the admin all the messages that came in from the users since he last logged in. And it's implemented on the mobile application, with checks in ...
0
votes
2answers
116 views

Best way to authorize and authenticate a user on web API

I am doing a hypothetical web just for learn some security tips and the first problem I've found is the login, I've read like 40 articles, a lot of questions here on stackoverflow and I still don't ...
0
votes
0answers
35 views

What are token types used by secure modular systems nowadays?

What are the possible token types for the authentication and authorization in a modular system? Are all of them bearer tokens?
0
votes
0answers
47 views

When Deserializing a User in Passport is there any reason not to remove Secrets?

I am using the passport-local passport strategy. I want to follow the principle of least privilege, so I was wondering if I should remove certain secret properties from the user when I deserialize ...
4
votes
1answer
80 views

Does the browser get the access_token in OAuth2?

I've spent more than 10 days trying to understand the Authorization Code Flow for a web application where I'm supposed to implement OpenID Connect for a single sign on. It feels that there is a lot of ...
0
votes
0answers
40 views

SSO - How Auth Code flow with PKCE is secure?

I've run into this docs when I was studying some SSO concepts; This grant adds the concept of a code_verifier to the Authorization Code Grant. When the Client asks for an Authorization Code it ...
0
votes
1answer
71 views

Use OpenID Connect for authentication and custom authorization

I'm working on a service where I want to protect endpoints from unauthorized access, but I don't want to deal with user management. This is how I found the OpenID Connect which I would like to use ...
2
votes
0answers
96 views

How are github personal access tokens and other github auth for 3rd parties not a securty issue?

Many services integrate with github. Some of them seem to require a personal access token with "repo" permission. Personal access tokens are global across all projects. In other words you may want to ...
0
votes
2answers
54 views

Resource authorization on multiple services

I have a client facing micro-service where user logs-in and initiate actions against their resources. After authorization of the resource against the logged in user, the client facing service forwards ...
2
votes
1answer
140 views

Security Risk of Stolen Session ID vs Authentication Token

I was intrigued by the discussion of this SO question as well as the accompanying blog post. I'm trying to better understand the mechanics of the two systems, and one of the questions I came up with ...
18
votes
12answers
5k views

Authentication versus Authorisation

I have referred this link and I know that Authentication = login + password (who you are) Authorization = permissions (what you are allowed to do) My question is: Suppose A gets the login id ...
2
votes
2answers
192 views

How to protect Authentication API from a DDoS attacks?

After Login, severs can check authorization, tokens etc at API and WAF levels to mitigate DDoS attacks. But this can only happen after user has logged in. How can we protect DDoS attack on login API? ...
1
vote
2answers
61 views

Use bidirectional SSL with CAC from phone

Is it possible to extract the certificate from a CAC (DOD common access card) and install it on a phone so that access to websites using bidirectional SSL can be done from a user phone. Ideally, the ...
0
votes
0answers
43 views

How to stop the user from intercepting their own credentials in mobile apps? [duplicate]

We are experiencing fraud with our open API, so we're turning it private. Let's suppose that I'm using OAuth and Bearer token to authorize who can access my API. Request: App -> Credentials -> Auth ...
0
votes
0answers
58 views

Google SMS verification codes broken on a loop - should I be concerned?

So this is a little out of the ordinary. Not sure what to make of it. I've enable 2-Step Verification on a Google account. When opening mail or other G-related services, it sends an SMS(text message) ...
2
votes
1answer
110 views

Is adding a prefix to an API token lowering it's security

When creating API tokens, one can pick any format one likes. Many people choose to use 40 random characters. I'm wondering how much of a security issue is to prefix the API key with a prefix "...
3
votes
2answers
245 views

2-step authorization (using SMS) less secure than being without 2FA at all?

I've been thinking about a paradoxical but a theoretically possible event: Even though SMS-based 2-step authorization increases security generally, on the other hand, in some cases, it might become ...
1
vote
3answers
109 views

Is exposing enumerated id's a bad idea if precautions are taken?

Say I have a website that has the URL website.com/student/{studentId}/courses for retrieving all the courses a student is enrolled in. The studentId is an auto-incrementing value in the Student table ...
1
vote
1answer
54 views

Reasonable security measures for unvalidated “login”

Sorry, kind of a long question. I am hoping that someone smarter about InfoSec than I am will read what I'm doing and give me guidance... Background My website allows psychiatrists to track their ...
2
votes
0answers
254 views

How does the photoTAN procedure work?

Lately, most banks (at least in Germany) are promoting the photoTAN procedure as the most modern and secure way of authorizing transactions in online banking, see for example here. However, searching ...
2
votes
3answers
64 views

Is it advisable to tie different capabilities to different session tokens?

Let's say you're creating a banking web application with mobile apps. A bank user has permissions "transfer money" and "view balances." When a user logs in, we can create a session token (typical ...
1
vote
1answer
73 views

Attribute-based access control standard definition

While reading a number of definitions of attribute-based access control (ABAC), I found that there are two different definitions: Access control decisions are made using the attributes of users, ...
0
votes
0answers
61 views

Potential problems not verifying the JWT signature if wrapped in another JWT depending on HTTPS

Say that we have an authentication system that generates JWT to authenticate users to other systems. This JWT contains an inner token that can be made by multiple IDP's. The signature of this JWT is ...
1
vote
1answer
268 views

Is Certified | Ethical Hacker (C|EH) a scam or legitimate? [closed]

I've been doing a lot of research on Certified | Ethical Hacker (C|EH) to see if it's a credible certification. But I've stumbled across a Wikipedia article on it and discovered that the sources are ...
0
votes
0answers
17 views

Server to Server API Security [duplicate]

Background I have a use case where external 3rd party remote servers (which I do not own or control) are sending data using a POST request to my central server over the internet. Each of these remote ...
1
vote
0answers
56 views

Is this a good approach to safely authorize requests to a SPA from an external website?

I developed an Angular app for a manufacturer that allows their customers to place orders for their products. The app uses a web service that is made available by the manufacturer's software, so it ...
2
votes
1answer
150 views

Was the Raspberry Pi-related NASA JPL network breach primarily caused by the failure to keep an updated list of authorized devices?

The question What information was stolen from JPL during the Raspberry Pi hack? refers to an event in recent news (e.g. Engadget's A rogue Raspberry Pi helped hackers access NASA JPL systems) and ...
1
vote
1answer
43 views

Securing implicit tokens (Example: Moltin)

I'm fairly new to security but I'm trying to understand how companies have their APIs set. One such case is Moltin's Implicit Token. Basically they provide you with a read-only (for the most part) ...
2
votes
1answer
403 views

Exploitability of allowed wildcard (*) CORS Origins with Bearer Token Authorization [duplicate]

I'm looking at the following setup. A web application uses a REST API to communicate with the server. All API responses include Origin: *. For authorization Authorization: Bearer <token> is used....
1
vote
0answers
70 views

Designing distributed authentication/authorisation system

I'm trying to design a system that has the following elements: the main backend REST API (currently one, probably multiple in the future) front-channel client(s) -- JS-based single-page app(s) back-...
2
votes
2answers
111 views

Attacker models of long-term logins: how should sensitive server endpoints require re-authentication?

Let's see the following scenario: "GutHib" is a fictional hosting service in the form of an online webapp for the fictional DVCS software "Gut". Alice logged in to GutHib with her password and 2FA, ...
0
votes
1answer
70 views

Does split knowledge always require an implementation of dual control?

Maybe I'm misunderstanding something here. Dual Control: Actions taken by different operators to affect a change. Split Knowledge: Information needed to affect a change is split between ...
0
votes
1answer
74 views

How to authorize access to a resource when requested with CORS and validate the origin?

I'll try to make the explanation simple and to the point (keyword try). And if that's not sufficient, then maybe I can expand on the question. Imagine two sites: resources.example.com and www.example....
0
votes
0answers
80 views

Having one OIDC provider and multiple APIs from third parties, how can I federate logins?

If I have an app which authenticates against one OIDC provider eg. Google but then uses the provided id- and access-token to make request against a 1. app-api and 2. a third-party-api using the tokens ...
1
vote
1answer
64 views

Is it recommended to send an authentication request to the Resource Owner (by the Authorization Server) if it already has an active session?

In OAuth 2.0 Authorization Code Flow (Grant Type), is it recommended (or is it maybe even a best practice) to send an authentication request (e.g. a login-request form) to the Resource Owner (by the ...
3
votes
0answers
83 views

How does “Fides” from the German Bundesdruckerei work?

I'm no security or cryptographic expert, just an interested computer scientist - so this question may be at the wrong place, or contain wrong assumptions. Nevertheless: The German Bundesdruckerei ...

1 2 3 4 5 7