Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authorization]

Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Authorization is a key theme in computer security practices.

4
votes
1answer
24 views

Can oauth2 “state” parameter be used to avoid using session cookies to identify user

https://tools.ietf.org/html/rfc6749#section-4.1.1 states: 4.1.1. Authorization Request" "state" RECOMMENDED. An opaque value used by the client to maintain state between the ...
1
vote
1answer
24 views

What's the point in a proxy server authorizing/authenticating clients?

I've implemented a SOCKS5 proxy library, but I just don't get the point of authenticating (or encrypting) connections, which the RFC (1928) seemed pretty adamant about. Isn't anonymity the whole idea ...
0
votes
1answer
16 views

OAuth 2 Implicit grant type for first party SPA - Most secure and sensible way

My aim is to secure my stateless API and only allow the registered first-party clients (SPA) to consume my resources. There is not going to be any third party clients in my scenario. I know Oauth 2 ...
0
votes
1answer
24 views

Smartphone fingerprint plus iris scanning for login

I have often thought about the fact that when intimate relationship partners live together they eventually tend to sneak over your shoulder and gain access to your password on either your mobile phone ...
0
votes
0answers
22 views

How to let any number of external servers securely register to receive updates from my own server

My scenario is as follows: On one side I have a single server running an application, which I control fully. On the other, there can be any number of other servers that have to connect to my server ...
1
vote
1answer
42 views

Web-Application with CORS Origin: * using authorization header

As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote: When responding to a credentialed request, the server must specify an ...
0
votes
0answers
31 views

What oauth grant type should I use after social sign in

I have an application which has its own oauth microservice to issue access tokens. The flow runs as below: User enters username and password to register, which makes api call to user-microservice ...
0
votes
0answers
34 views

Can PASETO replace JWT for API authorization?

Has server symmetric-keyed PASETO been seriously evaluated as a viable candidate to replace JWT for API session authorization? JWT https://tools.ietf.org/html/rfc7519 https://jwt.io PASETO https:/...
0
votes
0answers
30 views

API isolation for multiple single page applications under the same domain

I have a case where I want to run multiple single page applications on the same domain. Those apps should get access to a specific set of APIs. Example: myapp.example/profile: hosts the profile app ...
0
votes
1answer
20 views

Attribute certificate to model subject-object-action for access control

I am using Attribute Certificate (along with X509 PKC) for access control. What I really want to model is an access control semantic where a subject has a privilege to perform certain action on ...
0
votes
1answer
113 views

XMLHttpRequest with preflighted CORS missing authorization token

I have a followup question to this older question: How to exploit a misconfigured CORS policy when a per user authorization token is required? According to the documentation here, the Access-Control-...
0
votes
0answers
35 views

Role-based and multitenant authorisation via JWT?

First thing: let's put aside the debate on whether JWT should be used for managing sessions, I'm already aware of it and (at least some of) its limitations (invalidation, automatic prolongation of ...
2
votes
2answers
177 views

Given a secure channel, are there any benefits in using SCRAM over a username and password?

Given that a communication over HTTP uses SSL encryption uses public key pinning to prevent MiTM attacks is security in any way elevated by using Salted Challenge Response Authentication Mechanism (...
1
vote
1answer
59 views

Encrypted log entries authorization

We have a database table of encrypted log entries, each encrypted entry containing information about the user who created the entry. The entry is encrypted with the encryption key of the particular ...
1
vote
2answers
413 views

OAuth - How does the Resource Server validate the access token is not for any other Resource Server?

Let's take an example where there are two resource servers - RS1 and RS2 and there is one authorization server - AS. Both resource servers - RS1 and RS2 use authorization server - AS If a client ...
3
votes
0answers
71 views

How can an organization manage permissions in a centralized way?

Almost all applications mantain the permissions with the application and have no way of having at least the roles outside the application. Is the only way to have centralized authentication but ...
0
votes
1answer
184 views

Avoid brute force attacks on oAuth authorization server

I've been looking into the oAuth 2 authorization framework for a while now. Yesterday I started wondering how to prevent a brute force attack during the Authorization Code Grant flow (https://tools....
2
votes
0answers
17 views

How to update authorization information in a KDC dynamically?

I wish to add Kerberos authentication and authorization into a project that has a service server that interacts with a Hadoop cluster that has some users and permissions. As far as I know, the KDC ...
4
votes
1answer
115 views

Need of scope in OAuth Client Credentials Flow

For me, Client Credential flow is like client is asking access token for itself - not on behalf of some user. Then, why would client like to limit its own scope? What is the benefit of scopes in ...
1
vote
1answer
370 views

OAuth2 for mobile apps with confidential backend client (Is PKCE required?)

I'm wondering why neither rfc6749 nor rfc8252 seem to consider the case where the mobile app does not make protected resource requests (and is therefore not a client) but instead relies on a backend ...
2
votes
0answers
61 views

Is passing claims about the user in an access token “abusing” OpenID Connect?

First, let me assure you that I have read a number of posts on the topic before asking this question, but I am still confused and would appreciate more insights. So, here's the premise: There is a ...
3
votes
1answer
76 views

Managing critical passwords and data across a small business with a focus on business continuity

I work with a small startup in the beginning of it's life cycle. I recently raised some security concerns involving business continuity and emergency preparedness. I have been trying to make a ...
3
votes
0answers
87 views

JWT in localStorage with encrypted sessionId

What I want: Store a JWT in localStorage. The JWT contains claims about authorization. Prevent the JWT from being stolen and used by an attacker (using XSS) Avoid CSRF Storing the JWT in ...
0
votes
1answer
32 views

SMTU AUTH and compromised user

Recently I've set up two SMTP auth-enabled sendmails, and within a week and month both of them were used to send unsolicited mail using SMTP AUTH. Attackers were acting from different IP and using ...
3
votes
0answers
73 views

Could this authentication/authorization flow be attacked without compromising the Authority Server?

I am trying to come up with (at this time) server-to-server distributed authorization/authentication that would have (near) the same advantages as OAuth2 but without it's drawbacks. Is there any ...
-3
votes
1answer
264 views

secure public facing wallet API accessed by mobile devices

I am implementing a public mobile wallet application where user can add his own card, like Android Pay, or Samsung Pay on Android device. The standard way how these applications are initially working ...
0
votes
0answers
14 views

Is there ever a situation where it makes sense for a web app to use Explicit (auth-code based) oAuth2 authentication?

From what I've read, the main reason to use explicit oAuth is that the user-agent never sees the auth token. However, if we are designing a web app with auth-code based oAuth2, it seems impossible for ...
0
votes
0answers
17 views

How to protect SSL/TLS certificate files allowing access to NodeJs app [duplicate]

What are recommended approaches or any methods to protect the SSL/TLS certificates, such that - only NodeJs application running on the server (linux) can access to the files securely. And no one else ...
3
votes
1answer
557 views

Secure RESTful api communication between multiple servers

Currently I have the following design: Central cloud hosted server with a REST api Multiple remote servers each with a REST api Data is posted from the remote servers to the central server at ...
0
votes
3answers
105 views

Degree of safety of an unencrypted hard-drive and the general theory behind it

I always thought that everything on computer hard-disk is encrypted which can only be read(and understood) after passing my username and password to decrypt it. However, this is clearly not the case. ...
2
votes
0answers
226 views

Web app access control system design

I am having trouble finding a scalable way to create a access control system which both follows best practices and can scale well. I have looked at various approaches like RBAC and ABAC. For the ...
3
votes
2answers
193 views

Is SipHash a secure alternative to HMAC-SHA256 for user authentication?

After reading the Wikipedia page about SipHash I think it can be used like HMAC-SHA256 in JWT to create and verify API tokens (authenticate client devices). In JWT the server creates this MAC to sign ...
1
vote
0answers
185 views

Micro Service - Outh2 Workflow with a SPA, Facebook Login and JWT

Introduction We are currently trying to figure out a way to implement token based authentication and authorisation with Facebook Connect combined with maybe JWT within the micro service architecture. ...
1
vote
0answers
260 views

Is it safe to implement JWT auth with cookies, token versioning, and no refresh tokens?

I have some questions about my implementation of bearer token security (JWT to be specific) in an asp.net core 2.0 project that I'm working on. The bearer token is used when the frontend web app talks ...
0
votes
0answers
670 views

Alternative of etc/passwd for windows based server

I am doing Authorization test of Path traversal with Burp Suite. using payloads like below: ../(FileName) ../../(FileName) ../../../(FileName) ../../../../(FileName) ../../../../../(FileName) ../...
5
votes
0answers
224 views

Separating “function” from “scope” in RBAC

I'm trying to formulate an RBAC permission model which allows separation between permissions and the scopes on which those permissions are applied. I have been unable to find a standard model which ...
2
votes
1answer
119 views

Access based on type of information requested and access grant

The simple solution to access restriction when number of users are small is Access Control Matrix. Here the rows are the users and columns are different types of asset. In my case, I have a document ...
1
vote
1answer
254 views

Is the OAuth 2 authorization code flow vulnerable to the Confused Deputy Problem?

Confused Deputy Problem (also known as 'The Devil Wears Prada') is an OAuth 2 vulnerability arising when the protocol is used for authentication. Essentially, a malicious client obtains a token for a ...
0
votes
1answer
35 views

Is the following scheme for Google OAuth2 authentication and authorization satisfactory and secure?

I have a users table in my SPA application (Phoenix API application) which contains the fields: name, email, registered_at, role_id. I use OAuth2 authentication by Google API. After the end-user ...
0
votes
0answers
54 views

Was the Huddle problem just a “bug” in the implementation of true two-factor authentication?

I've just read the BBC News item Huddle's 'highly secure' work tool exposed KPMG and BBC files. According to the article: How did this happen? During the Huddle sign-in process, the customer's ...
0
votes
0answers
324 views

Tomcat : Authentication and Authorization Flow

Can anybody explain the code flow of tomcat's Authentication and Authorization. Or how we can explore, is there any way ? I have seen the code from BasicAuthenticator.java,AuthenticatorBase.java etc....
0
votes
2answers
56 views

Authorization / Access control in a client-side-encryption environment

I'm thinking about a client-side encryption concept where only the client knows the master secret (a user password). A correct implementation assumed, with KDF and authenticated encryption solutions ...
4
votes
2answers
2k views

Will “Authorization: Bearer” in request header fix CSRF attacks? [duplicate]

I have been reading on fixing CSRF attacks. From some research I understand that checking for a non-standard header would prevent CSRF attacks since the browser will not automatically send such ...
0
votes
4answers
111 views

Protecting from console attacks

I am creating a web-app using PHP and jQuery Ajax for my client-side. When I was testing some security stuff, I thought of inserting a malicious user account with admin access in the database by ...
2
votes
1answer
53 views

Authorization expiration without reliable clock / time

I've been looking, but I think its impossible to find a pairing solution that has the benefits of authorization expiration and renewal (like x509 cert expiry and OAuth expires_in), but that works ...
0
votes
2answers
832 views

Fine grained authorization with OAuth2

In my understanding of OAuth2 the scope may be used to specify access to what is asked and granted by code owner. In most cases I encounters the scope list is closed and specify "kinds" of thing ...
69
votes
7answers
18k views

User can't navigate to webpage through the UI due to permissions, but are able to navigate to page by pasting the URL. How do I protect against this?

In my application, users have certain roles which have permissions. These permissions dictate which UI elements are available to them at the home screen. Many of the elements link to other pages, ...
2
votes
1answer
993 views

How to secure handshake system-to-system in RESTful API calls without user/pass?

I have system X from another department in our company that sends basic user info (not passwords) to my system using RESTful API. Both systems are using subdomains of the same domain but reside on ...
1
vote
1answer
35 views

Are There Any Standards for building pin code authorization?

We're going to add a pin authorization feature to our website. So, I'm wondering a question, how to make it secure? As I understand, Apple/Windows after first user login link pincode to a specific ...
0
votes
0answers
46 views

Sending sensitive param to public API?

I need to modify a publicly-accessible REST API - unsecured, all HTTP GETs, access (theoretically) limited by API keys. I need one of the endpoints to now accept an additional parameter - one that's ...