Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authorization]

Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Not to be confused with authentication.

0
votes
0answers
17 views

Securing RESTful APIs with Private Keys

I'm currently working on building a rest service that other applications which we create will utilize (from backend application servers). My current process uses a single private key value for ...
0
votes
1answer
56 views

How can I implement a safe login-type system? [closed]

I've tried many times to make a safe "login" type system with authentication to a server. However, I've found that just sending login information via POST to a server and getting a reply with ...
2
votes
3answers
100 views

Does allowing a user to know their own authorized capabilities decrease security?

In a system with a complex set of computed authorizations, does conveniently allowing a given user access to view all of their own authorizations decrease security? In a "Policy as Code" system ...
0
votes
0answers
43 views

Too Much Information Exposure in OAuth 2.0?

Section 4.1 of the OAuth 2.0 RFC states: (A) The client initiates the flow by directing the resource owner's user-agent to the authorization endpoint. The client includes its ...
3
votes
3answers
91 views

What is a simple and secure method to transfer virtual assets?

Consider a MMORPG where users own virtual assets like magical swords or rings that can be used by the player. This system needs a safe method for transferring assets from Alice to Bob. One ...
10
votes
2answers
2k views

Public API with authorization token — is it possible to protect the demo token?

I have a REST API for running some calculations and returning the result, with a very simple token system where only authorized users can use the API. The user adds their token to the query like this:...
0
votes
1answer
39 views

What is a good way to authorize a client at a time to perform an action through websockets?

I am working on a round based web game where only one client/player at a time can perform an action. Throughout the game every player will have a websocket connection to the server. The client will ...
2
votes
1answer
41 views

Should user be authorized in site after following email change confirmation URL?

When users triggers email change, we send a link to their new email address. If user follows the link, should we only proceed with email change after authorization (being logged in the site), or we ...
0
votes
1answer
28 views

What parameters can be used to configure context-sensitive authorisation?

I recognise that context-sensitive authorisation to applications is a good security control however I can currently only think of location being an example of a sensitive context. I don't consider ...
1
vote
1answer
29 views

Center for Internet Security Version 6.1 Critical Security Control 16-10

My project is implementing The CIS Critical Security Controls, Version 6.1 Can anyone please give me some advice on how we can address sub-control 16.10 which says..... "Profile each user’s typical ...
2
votes
1answer
48 views

What is the proper flow for authentication?

I'm tasked with migrating a group of .Net WebForms applications from a current custom username/password login scheme to an oauth2/openid connect based authentication and authorization. This specific ...
4
votes
1answer
93 views

Can oauth2 “state” parameter be used to avoid using session cookies to identify user

https://tools.ietf.org/html/rfc6749#section-4.1.1 states: 4.1.1. Authorization Request" "state" RECOMMENDED. An opaque value used by the client to maintain state between the ...
1
vote
1answer
32 views

What's the point in a proxy server authorizing/authenticating clients?

I've implemented a SOCKS5 proxy library, but I just don't get the point of authenticating (or encrypting) connections, which the RFC (1928) seemed pretty adamant about. Isn't anonymity the whole idea ...
0
votes
1answer
66 views

OAuth 2 Implicit grant type for first party SPA - Most secure and sensible way

My aim is to secure my stateless API and only allow the registered first-party clients (SPA) to consume my resources. There is not going to be any third party clients in my scenario. I know Oauth 2 ...
2
votes
1answer
39 views

Smartphone fingerprint plus iris scanning for login

I have often thought about the fact that when intimate relationship partners live together they eventually tend to sneak over your shoulder and gain access to your password on either your mobile phone ...
0
votes
0answers
22 views

How to let any number of external servers securely register to receive updates from my own server

My scenario is as follows: On one side I have a single server running an application, which I control fully. On the other, there can be any number of other servers that have to connect to my server ...
1
vote
1answer
102 views

Web-Application with CORS Origin: * using authorization header

As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote: When responding to a credentialed request, the server must specify an ...
0
votes
0answers
33 views

What oauth grant type should I use after social sign in

I have an application which has its own oauth microservice to issue access tokens. The flow runs as below: User enters username and password to register, which makes api call to user-microservice ...
0
votes
0answers
85 views

Can PASETO replace JWT for API authorization?

Has server symmetric-keyed PASETO been seriously evaluated as a viable candidate to replace JWT for API session authorization? JWT https://tools.ietf.org/html/rfc7519 https://jwt.io PASETO https:/...
0
votes
0answers
47 views

API isolation for multiple single page applications under the same domain

I have a case where I want to run multiple single page applications on the same domain. Those apps should get access to a specific set of APIs. Example: myapp.example/profile: hosts the profile app ...
0
votes
1answer
27 views

Attribute certificate to model subject-object-action for access control

I am using Attribute Certificate (along with X509 PKC) for access control. What I really want to model is an access control semantic where a subject has a privilege to perform certain action on ...
0
votes
1answer
264 views

XMLHttpRequest with preflighted CORS missing authorization token

I have a followup question to this older question: How to exploit a misconfigured CORS policy when a per user authorization token is required? According to the documentation here, the Access-Control-...
0
votes
0answers
80 views

Role-based and multitenant authorisation via JWT?

First thing: let's put aside the debate on whether JWT should be used for managing sessions, I'm already aware of it and (at least some of) its limitations (invalidation, automatic prolongation of ...
2
votes
2answers
195 views

Given a secure channel, are there any benefits in using SCRAM over a username and password?

Given that a communication over HTTP uses SSL encryption uses public key pinning to prevent MiTM attacks is security in any way elevated by using Salted Challenge Response Authentication Mechanism (...
1
vote
1answer
73 views

Encrypted log entries authorization

We have a database table of encrypted log entries, each encrypted entry containing information about the user who created the entry. The entry is encrypted with the encryption key of the particular ...
2
votes
2answers
628 views

OAuth - How does the Resource Server validate the access token is not for any other Resource Server?

Let's take an example where there are two resource servers - RS1 and RS2 and there is one authorization server - AS. Both resource servers - RS1 and RS2 use authorization server - AS If a client ...
3
votes
0answers
71 views

How can an organization manage permissions in a centralized way?

Almost all applications mantain the permissions with the application and have no way of having at least the roles outside the application. Is the only way to have centralized authentication but ...
0
votes
1answer
262 views

Avoid brute force attacks on oAuth authorization server

I've been looking into the oAuth 2 authorization framework for a while now. Yesterday I started wondering how to prevent a brute force attack during the Authorization Code Grant flow (https://tools....
2
votes
0answers
25 views

How to update authorization information in a KDC dynamically?

I wish to add Kerberos authentication and authorization into a project that has a service server that interacts with a Hadoop cluster that has some users and permissions. As far as I know, the KDC ...
4
votes
1answer
197 views

Need of scope in OAuth Client Credentials Flow

For me, Client Credential flow is like client is asking access token for itself - not on behalf of some user. Then, why would client like to limit its own scope? What is the benefit of scopes in ...
1
vote
1answer
481 views

OAuth2 for mobile apps with confidential backend client (Is PKCE required?)

I'm wondering why neither rfc6749 nor rfc8252 seem to consider the case where the mobile app does not make protected resource requests (and is therefore not a client) but instead relies on a backend ...
3
votes
0answers
126 views

Is passing claims about the user in an access token “abusing” OpenID Connect?

First, let me assure you that I have read a number of posts on the topic before asking this question, but I am still confused and would appreciate more insights. So, here's the premise: There is a ...
3
votes
1answer
79 views

Managing critical passwords and data across a small business with a focus on business continuity

I work with a small startup in the beginning of it's life cycle. I recently raised some security concerns involving business continuity and emergency preparedness. I have been trying to make a ...
3
votes
0answers
97 views

JWT in localStorage with encrypted sessionId

What I want: Store a JWT in localStorage. The JWT contains claims about authorization. Prevent the JWT from being stolen and used by an attacker (using XSS) Avoid CSRF Storing the JWT in ...
0
votes
1answer
34 views

SMTU AUTH and compromised user

Recently I've set up two SMTP auth-enabled sendmails, and within a week and month both of them were used to send unsolicited mail using SMTP AUTH. Attackers were acting from different IP and using ...
3
votes
0answers
76 views

Could this authentication/authorization flow be attacked without compromising the Authority Server?

I am trying to come up with (at this time) server-to-server distributed authorization/authentication that would have (near) the same advantages as OAuth2 but without it's drawbacks. Is there any ...
-3
votes
1answer
267 views

secure public facing wallet API accessed by mobile devices

I am implementing a public mobile wallet application where user can add his own card, like Android Pay, or Samsung Pay on Android device. The standard way how these applications are initially working ...
0
votes
0answers
15 views

Is there ever a situation where it makes sense for a web app to use Explicit (auth-code based) oAuth2 authentication?

From what I've read, the main reason to use explicit oAuth is that the user-agent never sees the auth token. However, if we are designing a web app with auth-code based oAuth2, it seems impossible for ...
0
votes
0answers
18 views

How to protect SSL/TLS certificate files allowing access to NodeJs app [duplicate]

What are recommended approaches or any methods to protect the SSL/TLS certificates, such that - only NodeJs application running on the server (linux) can access to the files securely. And no one else ...
3
votes
1answer
690 views

Secure RESTful api communication between multiple servers

Currently I have the following design: Central cloud hosted server with a REST api Multiple remote servers each with a REST api Data is posted from the remote servers to the central server at ...
0
votes
3answers
143 views

Degree of safety of an unencrypted hard-drive and the general theory behind it

I always thought that everything on computer hard-disk is encrypted which can only be read(and understood) after passing my username and password to decrypt it. However, this is clearly not the case. ...
2
votes
0answers
264 views

Web app access control system design

I am having trouble finding a scalable way to create a access control system which both follows best practices and can scale well. I have looked at various approaches like RBAC and ABAC. For the ...
3
votes
2answers
228 views

Is SipHash a secure alternative to HMAC-SHA256 for user authentication?

After reading the Wikipedia page about SipHash I think it can be used like HMAC-SHA256 in JWT to create and verify API tokens (authenticate client devices). In JWT the server creates this MAC to sign ...
1
vote
0answers
216 views

Micro Service - Outh2 Workflow with a SPA, Facebook Login and JWT

Introduction We are currently trying to figure out a way to implement token based authentication and authorisation with Facebook Connect combined with maybe JWT within the micro service architecture. ...
1
vote
0answers
293 views

Is it safe to implement JWT auth with cookies, token versioning, and no refresh tokens?

I have some questions about my implementation of bearer token security (JWT to be specific) in an asp.net core 2.0 project that I'm working on. The bearer token is used when the frontend web app talks ...
0
votes
0answers
827 views

Alternative of etc/passwd for windows based server

I am doing Authorization test of Path traversal with Burp Suite. using payloads like below: ../(FileName) ../../(FileName) ../../../(FileName) ../../../../(FileName) ../../../../../(FileName) ../...
5
votes
0answers
288 views

Separating “function” from “scope” in RBAC

I'm trying to formulate an RBAC permission model which allows separation between permissions and the scopes on which those permissions are applied. I have been unable to find a standard model which ...
2
votes
1answer
139 views

Access based on type of information requested and access grant

The simple solution to access restriction when number of users are small is Access Control Matrix. Here the rows are the users and columns are different types of asset. In my case, I have a document ...
1
vote
1answer
313 views

Is the OAuth 2 authorization code flow vulnerable to the Confused Deputy Problem?

Confused Deputy Problem (also known as 'The Devil Wears Prada') is an OAuth 2 vulnerability arising when the protocol is used for authentication. Essentially, a malicious client obtains a token for a ...
0
votes
1answer
35 views

Is the following scheme for Google OAuth2 authentication and authorization satisfactory and secure?

I have a users table in my SPA application (Phoenix API application) which contains the fields: name, email, registered_at, role_id. I use OAuth2 authentication by Google API. After the end-user ...