Questions tagged [authorization]

Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Not to be confused with authentication.

Filter by
Sorted by
Tagged with
0
votes
2answers
58 views

Placing authorization data on JWT claims

I am an application developer and am building a token-based auth mechanism for my application. Essentially, the user will log in with username+password, if the credentials are valid, my code will ...
1
vote
1answer
45 views

Multiple “Bearer” keywords in single Authorization header

I have recently seen a web application that, while using Authorization header, accepted multiple Bearer keywords followed by a valid JWT token. For example, all of the following headers would result ...
0
votes
2answers
38 views

Role-based authorisation and TLS

I want to implement role based authorisation in my TLS connections. I.e. when my client authenticates with the server I want them to have certain privileges based on their role. Are there any ...
1
vote
1answer
54 views

How to properly invalidate JWT tokens and sessions in this use case?

I am building a web app, which is made of a Node.js Backend and Angular (NOT AngularJS!!! I only used the tag, because Angular was not available..) Frontend. How do I properly secure this app? I ...
3
votes
2answers
212 views

How to share passwords *only* after death?

I am looking for a modern, password manager-based way to share my passwords with certain parties (partner, executor of my will) within a week or so of my death, but no sooner. The scenario I wish to ...
0
votes
0answers
35 views

Providing shared access to a single machine without a shared account

In our factory we have a "Big Machine" which runs 24/7 and requires input and monitoring from different operators across various shifts. Every operator needs to be able to stop/start/control ...
0
votes
0answers
97 views

Is this HTTP authorization token secure?

I am new to backend development and read about Authorization methods such as Basic, Bearer and OAuth 2.0. I haven't use any of these directly, but used a token based implementation. User logs in with ...
0
votes
1answer
40 views

How to implement MySQL query fo RBAC authorization with fine grained business restrictions in role?

When implementing an authorization system like RBAC/DAC, or XACML, or the AWS IAM authorization model, I see that I can't totally decouple business logic from authorization when there are fine-grained ...
0
votes
0answers
56 views

Can a secure key-exchange algorithm replace hashing for password authentication?

Over the weekend I was thinking about the problem of scaling various web services. One common practice to scale authorization is to use cryptographically signed tokens. This way when a request comes ...
0
votes
4answers
73 views

Restricting authorization on a web app based on certain criteria

For a web app, we are authenticating and authorizing users. There is no Sign-up option, but rather these users are provisioned into the system explicitly and are given certain permissions based on ...
0
votes
0answers
53 views

Authorization Header (Bearer) Vulnerability

I'd like to brainstorm/ ask regarding a possible vulnerability that I encounter recently. So recently, I was able to find an endpoint where generating an Authorization Token is possible for a user and ...
0
votes
1answer
77 views

Is it safe to use a JWT as an Authorization Code?

I'm implementing an OAuth 2.0 Authorization Code grant type flow and considering to use a very short-lived JWT as the authorization code so this step doesn't require a database. I understand that this ...
0
votes
1answer
70 views

Trusting CA Certificates by Thumbprint

Id like to create an application which trusts certificates issued from specific CAs. My ideas is to have a list of thumbprints for CA certificates I trust. Then whenever my app receives a certificate ...
0
votes
0answers
31 views

How to prevent horizontal escalation attacks when a centralized authorization service as gateway is used?

Say I have a gateway which provides authorization mechanisms by validating a JWT, behind an api-gateway there are different micro-services but only the gateway port is public. As a software designer ...
4
votes
0answers
164 views

Deauthorization Bug in messenger application - How serious is this?

My question refers to a behavior on a production system with more than 100 million chat users. Some time ago I changed my account password and removed all devices connected to my account. The next day ...
1
vote
2answers
71 views

Authorization Header in dev tools

My web application need to make call to 3rd party REST API which is protected by Basic authentication on some user click. We are planning to use a technical user for the call. This will expose the ...
0
votes
0answers
34 views

Registration process by OAuth2

I have been analyzing the security process in 3gpp specs (pg 11) and the registration process in the spec explained with that flow. The flow represents the registration of a client to the server.. I ...
1
vote
1answer
94 views

Is it safe to make every resource public in a Google Cloud Storage bucket?

I'm developing a business web application for my client, in which he can upload images (e.g. floor plans, photos of object etc.) and documents of different objects (word, excel etc.). The images ...
2
votes
2answers
151 views

Is autologin dangerous? (Debian/Linux)

If I use only a computer, can I disable the password when I log in? That is, the user account has a password, but in the settings I turn on autologin: /etc/lightdm/lightdm.conf [Seat:*] autologin-...
0
votes
0answers
28 views

Choosing oauth flow-type for on-prem installations

So according to the resources found here and in the official protocol documents I have a good grasp on what flow-types to use for what client-type. According to the following picture (credit: https://...
7
votes
3answers
210 views

Zero Knowledge Proof of ownership of an email address

Let's say that we want to develop a blogging service where only people with an @example.com email can contribute. Prior to post submission, the user requests that a large random token be generated by ...
0
votes
1answer
79 views

Why to use username and password instead of just a long password? [duplicate]

Why do most websites use the pair of username and password as we can just use a long password like a token to identify a user? A simple example: On the server, we create a JSON file with user data ...
1
vote
1answer
90 views

What is the best form of authorization for captive portal WiFi

I've been looking into captive portal WiFi implementations and on a few I'be been able to easily bypass their login with the following steps: 1) Open Wireshark and run a report getting the most used ...
1
vote
1answer
20 views

Should OAuth2 proprietary client authorization prompt a confirmation window?

Given a company named X. X has an OAuth 2 API available for its proprietary clients and also for 3rd party clients. When a user P enters the process of authorizing a client, it is prompted with a ...
0
votes
2answers
57 views

How to establish a secure channel with authenticated and authorized access to a remote entity

I have the following problem: There are 3 parties A, B and X. X is holding 2 entities on behalf of A and B. A communicates with X to operate it's own entity. B also communicates with X to operate ...
1
vote
1answer
66 views

Is it ok to share relevant login information on an API's public endpoint?

I have an (https-only) API that uses OAuth2 for authentication and authorization via access tokens. Any request to the API needs an access token to the Authorization header. The API validates that ...
3
votes
3answers
96 views

When to implement authentication and authorization?

I am currently in situation where I have to decide when to implement security measures. So the question is simple, is it better to implement authorization and authentication methods right off the bat ...
3
votes
2answers
99 views

Using OAuth SPA app to provide third party with access token

Say I had a centralized OAuth 2 authentication server, a Single Page Application (SPA) in an electron app, and a third-party server. The user launches this SPA, goes through the PKCE flow to obtain an ...
-1
votes
2answers
49 views

Is CSRF possible if i know the value of the authorization bearer token?

If i know the value of bearer token of the victim, can i generate a get csrf page and set a custom Autorization: Bearer [token] header?
1
vote
1answer
88 views

Custom OAuth2 Authorization Server / Identity Provider

I am currently trying to implement my own Authorization Server following the OAuth2 protocol PKCE flow, coupled with my own Identity Provider. The idea is to be able to reuse the same identity ...
2
votes
1answer
129 views

Should we use API keys for authorization on a public API (instead of JWT)?

We are building a public-facing API. The consumers of this API will be business partners of ours - we will probably have a personal relationship with each one, and I suspect there will only ever be 10-...
2
votes
0answers
118 views

Does my app need authentication in addition to Spotify authorization?

I have an app that revolves entirely around Spotify. I have followed the authorization guide from Spotify and am using the Authorization Code Flow so the access token can be refreshed. My thinking was ...
1
vote
1answer
119 views

Why aren't we scared of our signing key being stolen with JWTs?

With the traditional session system where only the session ID is stored on the client possibly even encrypted, the user won't be able to assume the identity of another user or escalate their ...
0
votes
0answers
24 views

Does OAuth2 state have to be server side?

I have a "stateless" OAuth2 client for the Authorization Code flow written like thus: Involved parties: Untrusted User, Controlled OAuth2 Client, External OAuth2 Service. User sends client.invalid/...
0
votes
0answers
26 views

Reuse Firebase Token for other authentication purporses

I'm building an app where the users should have restricted access to certain api-services. I use gRPC as API. Right now I'm asking the user's mobile number, send him an SMS with a code which he has to ...
2
votes
0answers
36 views

Authentication and authorization of a subrequest

A user sends a request to a system A. The request is signed with a digital signature, so the system A can authenticate and authorize the user. Then the system A creates a series of sub-requests to ...
0
votes
1answer
207 views

How to approach Web App? [closed]

I'm doing testing on the app, if we take only login url as a starting point. How to expand my horizons? I want to make my surface wider, really kinda stuck on this one.
0
votes
1answer
69 views

Is it safe to use third party OIDC ID Token as our APIs bearer token?

Practically, we are outsourcing the authentication of our users to a third party application, that's, needless to say, external to our system. I am not sure if this is actually advisable, but from our ...
0
votes
2answers
74 views

Saving authorization token in browser [duplicate]

I have a REST API which returns an auth token when the user is logged in successfully. This token needs to be sent in different routes for authorisation. This is working fine is my android app. But I ...
1
vote
1answer
47 views

How to implement “Enter Password to Continue” for a page in a stateless application which uses JWTs?

In my application I want a page to be accessible to the user only after s/he has entered the password again to prevent someone else opening that page in case the user has left a logged-in device open. ...
1
vote
1answer
95 views

Encrypting file stores in s3

I am developing a system for storage of medical records. A person could upload image(s) or file(s). Since it is a medical record , it needs to be stored in encrypted form.Also I want that the files or ...
0
votes
0answers
25 views

Is it considered broken access control when access relies on knowledge of a CSPRNG string?

Say I have a server which hosts video files. This server allows a user to register for an account, and using OAuth, the requests to access a user's media look like: https://mysite.com/videos/...
0
votes
1answer
93 views

Google approach to device security (BeyondCorp): managed devices and inference engine

I'm reading the BeyondCorp papers and trying to get a very high level idea of how it could be implemented by a small to medium organisation, rather than a behemoth like Google. What kind of software ...
0
votes
0answers
48 views

Inverse of Third Party Authentication

Consider this scenario. I have a file hosted on AWS with private access. I want the file to be accessible to several authorized users of a web applicaton that I have built. As I am the one ...
0
votes
0answers
42 views

How come RFC7636 (PKCE) stops malicous app doing the same code challenge and get legitimate access to API

As per the RFC7636 it stops malicious apps which pretend to be legitimate apps, gaining access to OAuth2.0 protected API's. The flow suggests a method of having a runtime level secret which generated ...
2
votes
1answer
107 views

What is the purpose of the authorization code in OAuth 2? [duplicate]

Why do we need to ask the authorization server for theAuthorization code and then exchange the Authorization code for anAccess token on the same server? Why not to return anAccess token directly, ...
1
vote
1answer
78 views

Validating API keys in a back-end web-service with very few users

I have run into this scenario a couple of times now but am hoping to get either confirmation that I'm on the right track or a suggestion as to what else should be done. Situation I am building a ...
1
vote
0answers
141 views

AWS Appsync authorization - why is IAM authorization safer than API Key based approach

We are currently evaluating which authorization type to use for our production AppSync APIs. As per AWS docs(https://docs.aws.amazon.com/appsync/latest/devguide/security.html, https://aws.amazon.com/...
1
vote
1answer
193 views

What is delegation, identity delegation, and delegated authorization, and what are the differences among them?

I've been writing up a guide to OAuth 2.0, OpenID Connect, and Identity Server 4 mostly for my own learning, drawing on several sources such as OAuth2 In Action, OAuth 2.0 Simplified, and CISSP: A ...
2
votes
1answer
552 views

OAuth2 for first party web-app

I am building a web (also potentially mobile app) for a platform that allows plugins. We're using the OAuth2 Authorization Code grant type for third-party client plugins. Which, if any, grant type ...

1
2 3 4 5
8