Questions tagged [authorization]

Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Not to be confused with authentication.

Filter by
Sorted by
Tagged with
2
votes
0answers
44 views

Authenticate embedding a third party site into a website

When embedding a third party site into a website e.g. a chatbot, what is the safest way to authenticate the chatbot so a a user doesn't have to login twice? i.e. at login, and then when they click the ...
0
votes
1answer
49 views

Trusting CA Certificates by Thumbprint

Id like to create an application which trusts certificates issued from specific CAs. My ideas is to have a list of thumbprints for CA certificates I trust. Then whenever my app receives a certificate ...
0
votes
0answers
28 views

How to prevent horizontal escalation attacks when a centralized authorization service as gateway is used?

Say I have a gateway which provides authorization mechanisms by validating a JWT, behind an api-gateway there are different micro-services but only the gateway port is public. As a software designer ...
4
votes
0answers
144 views

Deauthorization Bug in messenger application - How serious is this?

My question refers to a behavior on a production system with more than 100 million chat users. Some time ago I changed my account password and removed all devices connected to my account. The next day ...
1
vote
2answers
57 views

Authorization Header in dev tools

My web application need to make call to 3rd party REST API which is protected by Basic authentication on some user click. We are planning to use a technical user for the call. This will expose the ...
0
votes
0answers
31 views

Registration process by OAuth2

I have been analyzing the security process in 3gpp specs (pg 11) and the registration process in the spec explained with that flow. The flow represents the registration of a client to the server.. I ...
1
vote
1answer
88 views

Is it safe to make every resource public in a Google Cloud Storage bucket?

I'm developing a business web application for my client, in which he can upload images (e.g. floor plans, photos of object etc.) and documents of different objects (word, excel etc.). The images ...
2
votes
2answers
118 views

Is autologin dangerous? (Debian/Linux)

If I use only a computer, can I disable the password when I log in? That is, the user account has a password, but in the settings I turn on autologin: /etc/lightdm/lightdm.conf [Seat:*] autologin-...
0
votes
0answers
28 views

Choosing oauth flow-type for on-prem installations

So according to the resources found here and in the official protocol documents I have a good grasp on what flow-types to use for what client-type. According to the following picture (credit: https://...
7
votes
3answers
197 views

Zero Knowledge Proof of ownership of an email address

Let's say that we want to develop a blogging service where only people with an @example.com email can contribute. Prior to post submission, the user requests that a large random token be generated by ...
0
votes
1answer
76 views

Why to use username and password instead of just a long password? [duplicate]

Why do most websites use the pair of username and password as we can just use a long password like a token to identify a user? A simple example: On the server, we create a JSON file with user data ...
1
vote
1answer
54 views

What is the best form of authorization for captive portal WiFi

I've been looking into captive portal WiFi implementations and on a few I'be been able to easily bypass their login with the following steps: 1) Open Wireshark and run a report getting the most used ...
1
vote
1answer
20 views

Should OAuth2 proprietary client authorization prompt a confirmation window?

Given a company named X. X has an OAuth 2 API available for its proprietary clients and also for 3rd party clients. When a user P enters the process of authorizing a client, it is prompted with a ...
0
votes
2answers
47 views

How to establish a secure channel with authenticated and authorized access to a remote entity

I have the following problem: There are 3 parties A, B and X. X is holding 2 entities on behalf of A and B. A communicates with X to operate it's own entity. B also communicates with X to operate ...
1
vote
1answer
66 views

Is it ok to share relevant login information on an API's public endpoint?

I have an (https-only) API that uses OAuth2 for authentication and authorization via access tokens. Any request to the API needs an access token to the Authorization header. The API validates that ...
3
votes
3answers
90 views

When to implement authentication and authorization?

I am currently in situation where I have to decide when to implement security measures. So the question is simple, is it better to implement authorization and authentication methods right off the bat ...
2
votes
2answers
73 views

Using OAuth SPA app to provide third party with access token

Say I had a centralized OAuth 2 authentication server, a Single Page Application (SPA) in an electron app, and a third-party server. The user launches this SPA, goes through the PKCE flow to obtain an ...
-1
votes
2answers
37 views

Is CSRF possible if i know the value of the authorization bearer token?

If i know the value of bearer token of the victim, can i generate a get csrf page and set a custom Autorization: Bearer [token] header?
1
vote
1answer
61 views

Custom OAuth2 Authorization Server / Identity Provider

I am currently trying to implement my own Authorization Server following the OAuth2 protocol PKCE flow, coupled with my own Identity Provider. The idea is to be able to reuse the same identity ...
2
votes
1answer
89 views

Should we use API keys for authorization on a public API (instead of JWT)?

We are building a public-facing API. The consumers of this API will be business partners of ours - we will probably have a personal relationship with each one, and I suspect there will only ever be 10-...
2
votes
0answers
95 views

Does my app need authentication in addition to Spotify authorization?

I have an app that revolves entirely around Spotify. I have followed the authorization guide from Spotify and am using the Authorization Code Flow so the access token can be refreshed. My thinking was ...
1
vote
1answer
110 views

Why aren't we scared of our signing key being stolen with JWTs?

With the traditional session system where only the session ID is stored on the client possibly even encrypted, the user won't be able to assume the identity of another user or escalate their ...
0
votes
0answers
21 views

Does OAuth2 state have to be server side?

I have a "stateless" OAuth2 client for the Authorization Code flow written like thus: Involved parties: Untrusted User, Controlled OAuth2 Client, External OAuth2 Service. User sends client.invalid/...
0
votes
0answers
25 views

Reuse Firebase Token for other authentication purporses

I'm building an app where the users should have restricted access to certain api-services. I use gRPC as API. Right now I'm asking the user's mobile number, send him an SMS with a code which he has to ...
2
votes
0answers
35 views

Authentication and authorization of a subrequest

A user sends a request to a system A. The request is signed with a digital signature, so the system A can authenticate and authorize the user. Then the system A creates a series of sub-requests to ...
0
votes
1answer
187 views

How to approach Web App? [closed]

I'm doing testing on the app, if we take only login url as a starting point. How to expand my horizons? I want to make my surface wider, really kinda stuck on this one.
0
votes
1answer
60 views

Is it safe to use third party OIDC ID Token as our APIs bearer token?

Practically, we are outsourcing the authentication of our users to a third party application, that's, needless to say, external to our system. I am not sure if this is actually advisable, but from our ...
0
votes
2answers
66 views

Saving authorization token in browser [duplicate]

I have a REST API which returns an auth token when the user is logged in successfully. This token needs to be sent in different routes for authorisation. This is working fine is my android app. But I ...
1
vote
1answer
47 views

How to implement “Enter Password to Continue” for a page in a stateless application which uses JWTs?

In my application I want a page to be accessible to the user only after s/he has entered the password again to prevent someone else opening that page in case the user has left a logged-in device open. ...
1
vote
1answer
95 views

Encrypting file stores in s3

I am developing a system for storage of medical records. A person could upload image(s) or file(s). Since it is a medical record , it needs to be stored in encrypted form.Also I want that the files or ...
0
votes
0answers
25 views

Is it considered broken access control when access relies on knowledge of a CSPRNG string?

Say I have a server which hosts video files. This server allows a user to register for an account, and using OAuth, the requests to access a user's media look like: https://mysite.com/videos/...
0
votes
1answer
85 views

Google approach to device security (BeyondCorp): managed devices and inference engine

I'm reading the BeyondCorp papers and trying to get a very high level idea of how it could be implemented by a small to medium organisation, rather than a behemoth like Google. What kind of software ...
0
votes
0answers
48 views

Inverse of Third Party Authentication

Consider this scenario. I have a file hosted on AWS with private access. I want the file to be accessible to several authorized users of a web applicaton that I have built. As I am the one ...
0
votes
0answers
42 views

How come RFC7636 (PKCE) stops malicous app doing the same code challenge and get legitimate access to API

As per the RFC7636 it stops malicious apps which pretend to be legitimate apps, gaining access to OAuth2.0 protected API's. The flow suggests a method of having a runtime level secret which generated ...
2
votes
1answer
102 views

What is the purpose of the authorization code in OAuth 2? [duplicate]

Why do we need to ask the authorization server for theAuthorization code and then exchange the Authorization code for anAccess token on the same server? Why not to return anAccess token directly, ...
1
vote
1answer
75 views

Validating API keys in a back-end web-service with very few users

I have run into this scenario a couple of times now but am hoping to get either confirmation that I'm on the right track or a suggestion as to what else should be done. Situation I am building a ...
1
vote
0answers
110 views

AWS Appsync authorization - why is IAM authorization safer than API Key based approach

We are currently evaluating which authorization type to use for our production AppSync APIs. As per AWS docs(https://docs.aws.amazon.com/appsync/latest/devguide/security.html, https://aws.amazon.com/...
0
votes
0answers
118 views

What is delegation, identity delegation, and delegated authorization, and what are the differences among them?

I've been writing up a guide to OAuth 2.0, OpenID Connect, and Identity Server 4 mostly for my own learning, drawing on several sources such as OAuth2 In Action, OAuth 2.0 Simplified, and CISSP: A ...
2
votes
1answer
356 views

OAuth2 for first party web-app

I am building a web (also potentially mobile app) for a platform that allows plugins. We're using the OAuth2 Authorization Code grant type for third-party client plugins. Which, if any, grant type ...
0
votes
0answers
45 views

Endpoint authorization using Vault

I have a bunch of micro-services set up which interact with each other. I want to set up authentication and authorization within these services so if a user has access to only one service, then it can ...
1
vote
1answer
585 views

How to invalidate JWT tokens without a database lookup with each request to the server?

JWT Bearer token and stateless REST API question I am implementing a stateless REST API. I am used to using sessions built into frameworks or 0Auth but now I am in the process of developing my own ...
0
votes
1answer
158 views

Microservice security: How to perform authorization + services also need auth checks individually?

I have the following architecture for accessing a REST service that requires authentication: Oidc token flow managed at the client Access token verified at the server in the auth service (proxied ...
-2
votes
1answer
92 views

Security without Login

I am working on a web-app where user can access his purchased item using two word/Number combination and then user add card details on same page for the payment of those item. Point to be noted ...
3
votes
1answer
86 views

OAuth 2.0 authorization code flow vulnerable to “shoulder surfing”?

When using the OAuth authorization code flow in web applications, after successful authentication of the resource owner, the authorization server usually responds with a browser redirect to pass the ...
0
votes
0answers
34 views

Is it a good practice to implement admin pages in a mobile application?

So let's say there's a page on the website that shows the admin all the messages that came in from the users since he last logged in. And it's implemented on the mobile application, with checks in ...
0
votes
2answers
123 views

Best way to authorize and authenticate a user on web API

I am doing a hypothetical web just for learn some security tips and the first problem I've found is the login, I've read like 40 articles, a lot of questions here on stackoverflow and I still don't ...
0
votes
0answers
35 views

What are token types used by secure modular systems nowadays?

What are the possible token types for the authentication and authorization in a modular system? Are all of them bearer tokens?
0
votes
0answers
233 views

When Deserializing a User in Passport is there any reason not to remove Secrets?

I am using the passport-local passport strategy. I want to follow the principle of least privilege, so I was wondering if I should remove certain secret properties from the user when I deserialize ...
4
votes
1answer
89 views

Does the browser get the access_token in OAuth2?

I've spent more than 10 days trying to understand the Authorization Code Flow for a web application where I'm supposed to implement OpenID Connect for a single sign on. It feels that there is a lot of ...
0
votes
0answers
71 views

SSO - How Auth Code flow with PKCE is secure?

I've run into this docs when I was studying some SSO concepts; This grant adds the concept of a code_verifier to the Authorization Code Grant. When the Client asks for an Authorization Code it ...

1
2 3 4 5
8