Questions tagged [authorization]
Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Not to be confused with authentication.
450
questions
1
vote
2
answers
588
views
How to control authorized access to specific data for specific users
I am building a web application that involves a login system. Once a user has logged in and is authenticated they should have the ability to access data from a database. This is however where I get a ...
0
votes
1
answer
237
views
Authorization Controls for Offline Windows C# Application
I've been looking into trying to see if there are any authorization controls that can be implemented for a local, and offline, .NET application that are tied to the Windows local authentication. The ...
2
votes
2
answers
4k
views
Secret key in Authorization header vs. inside POST body
We have a few in house endpoint that we'd like to keep in house and be used by developers who have access to different servers. We were going to generate a secret key, save the key on the respective ...
3
votes
0
answers
609
views
Why are animated QR-codes more secure?
I recently had a look at implementing the swedish BankID identification system for an app.
A prerequisite is that a client certificate is installed on our backend, which authenticates requests from ...
1
vote
1
answer
619
views
Security requirements for public API keys
I need to provide security requirements for public API keys that will be generated by a web application and then used in automation scripts by clients.
The scripts will be run on the endpoints several ...
1
vote
0
answers
122
views
Authorise access to hierarchical data
Consider a scenario in which you offer service access based on a hierarchy of authority. i.e., a HEAD can register his subordinates. The authenticated HEAD has the previledge to read and update data ...
0
votes
1
answer
265
views
What should I worry about when attaching a token to a request manually?
I'm developing a platform that has 2 parts:
An API written using Laravel, that integrates with the database and provided data in a restful state.
Multiple fronts that connect to the API and perform ...
0
votes
1
answer
264
views
How to mitigate risk of spoofing / Impersonating in OAuth Device flow ( device code flow ) in Azure AD?
I have developed C# application and hosted it as a windows service on a machine http://localhost:5000 . This application registered in `Azure Active Directory
Application is using the below details in-...
0
votes
2
answers
806
views
Is a consent screen in an OAuth 2.0 implementation optional
I've read through RFC 6749: https://datatracker.ietf.org/doc/html/rfc6749
The only mention of consent is in this bit:
The authorization server MUST implement CSRF protection for its
authorization ...
1
vote
0
answers
228
views
Where should I store an OAuth refresh token for a third party?
I am connecting to a third party which authenticates with OAuth2. Once the user has logged in, I want to store the access & refresh tokens for the user. Which is more secure & proper - to save ...
2
votes
2
answers
414
views
Frontend authenticates in server using jwt token issued by another server
I have two servers and frontend client:
one server authorize and authenticate user, after that issue jwt token to client.
Frontend client also visits second backend server using jwt token as ...
1
vote
0
answers
132
views
How can I authorize access to a resource without knowing who I've authorized?
I have a database-backed web application, with authentication via
organizational single sign-on, modeling a library lending system for
digital books. I'd like to allow users to check out books and see ...
1
vote
1
answer
120
views
Security risks of the following authentication flow
Let's say Party A has many customers (one of them let's call it Customer X) with data in Party A.
Party A is allowing Customer X to get data from their API. In order to do that:
Customer X downloads ...
2
votes
1
answer
1k
views
Is PKCE really protecting public facing clients? Can't a rogue app steal the ClientID and Secret and make a AuthCode request of its own?
From what I have understood, for public facing clients such as JavaScript apps that run on the browser or mobile apps which have no backend there is no secure place to store client id and secret. ...
0
votes
1
answer
217
views
Can we prevent users from generating a QR code with edited information
Currently there is this design of two apps that work together:
Proof app: On customers phone, takes in a textcode and creates a QR code
Scanner app: On hosts phone, Scans the QR code and displays ...
1
vote
1
answer
160
views
urbanairship basic Authorization found in Mobile Application Outgoing Traffic
I was testing an android application using Burp suite. When I opened the android application, an app "Outgoing Traffic" log was added in Burp suite Site map. The API request is:
PUT /api/...
1
vote
2
answers
121
views
Is access token confidentiality also ensured in the Authorization Code grant type in Oauth2.0
One of the really nice articles I came across while trying to understand the various grant types in Oauth2.0 was this. The author really has done a good job at explaining quite clearly what various ...
0
votes
0
answers
701
views
JWT refresh tokens and Double Submit Cookies
I am struggling to implement JWT refresh tokens with the Double Submit Cookies method.
My current set up for a browser based webapp without refresh tokens looks like this:
Upon successful login, API ...
0
votes
2
answers
439
views
Approach to authorizing users and X.509 certificates
I have a system where I'm using X.509 certificates to authenticate the client to the server. The certificate is sent to an HSM to be signed. When it is returned it is used as part of a TLS connection. ...
1
vote
0
answers
113
views
What is the optimal authorization flow for this usecase?
Imagine that I'm building a server that provides useful APIs for web chat development. I want it to be accessible only to registered developer accounts. A developer registers and builds a chat that ...
1
vote
0
answers
89
views
Why do some "OAuth" providers ask for personal info?
I don't mean to start another OAuth vs OpenID discussion, but I want to share the underlying cause of my confusion.
When I want a Client to process my google docs for something, I have to go through ...
0
votes
0
answers
49
views
Using fields in X.509 cert for authorization [duplicate]
I understand that X.509 certificates are used for authentication.
How can I use the information provided in an X.509 certificate for authorization? For example, are there any fields in the certificate ...
0
votes
2
answers
2k
views
Is there any additional overhead over using Oauth vs Client Certificates?
I have a requirement to add security between service to API communication. The current implementation is client certificates. The client gets a certificate and just sends it in a cookie to the API. ...
0
votes
1
answer
308
views
Is it a security risk to expose some authorization roles to the user over an API
I have an API (in this case GraphQL) and an accompanying app. My server is already censoring any data that the user is not authorized to see, so forget the risk of leaking any data.
There are certain ...
0
votes
0
answers
282
views
Is there a good reason not to track valid JWTs in a key value store like redis?
I use Redis to track valid JWTs by saving the JTI (uuid-v4) mapped to the users id in Redis.
If the JTI can not be found in Redis or the user id in Redis does not match the user id in the JWT
the ...
0
votes
1
answer
110
views
Should access control be managed from inside application?
I am a developer who's just starting to learn about authorization and authentication for web apps. I am bit unclear on the concept of managing access control to parts of the app, and where is the best ...
0
votes
1
answer
1k
views
How an IDP sends SAML assertion to an SP?
I'm new to security concepts. I am studying how SAML works and I'm confused about how IDP sends SAML assertion to SP. I searched on the internet and I found out two scenarios are possible.
First is ...
3
votes
1
answer
2k
views
Is oauth client credentials flow safer than basic authentication with preshared secret?
Assuming that both travel over the latest version of TLS, why should I use client credentials?
The obvious answer is:
The access token will expire at some point
The client id and secret will travel ...
2
votes
2
answers
372
views
Placing authorization data on JWT claims
I am an application developer and am building a token-based auth mechanism for my application. Essentially, the user will log in with username+password, if the credentials are valid, my code will ...
1
vote
1
answer
1k
views
Multiple "Bearer" keywords in single Authorization header
I have recently seen a web application that, while using Authorization header, accepted multiple Bearer keywords followed by a valid JWT token. For example, all of the following headers would result ...
0
votes
2
answers
327
views
Role-based authorisation and TLS
I want to implement role based authorisation in my TLS connections. I.e. when my client authenticates with the server I want them to have certain privileges based on their role.
Are there any ...
2
votes
1
answer
4k
views
How to properly invalidate JWT tokens and sessions in this use case?
I am building a web app, which is made of a Node.js Backend and Angular (NOT AngularJS!!! I only used the tag, because Angular was not available..) Frontend.
How do I properly secure this app? I ...
9
votes
5
answers
1k
views
How to share passwords *only* after death?
I am looking for a modern, password manager-based way to share my passwords with certain parties (partner, executor of my will) within a week or so of my death, but no sooner.
The scenario I wish to ...
0
votes
0
answers
87
views
Providing shared access to a single machine without a shared account
In our factory we have a "Big Machine" which runs 24/7 and requires input and monitoring from different operators across various shifts. Every operator needs to be able to stop/start/control ...
0
votes
0
answers
909
views
Is this HTTP authorization token secure?
I am new to backend development and read about Authorization methods such as Basic, Bearer and OAuth 2.0.
I haven't use any of these directly, but used a token based implementation.
User logs in with ...
2
votes
1
answer
251
views
How to implement MySQL query fo RBAC authorization with fine grained business restrictions in role?
When implementing an authorization system like RBAC/DAC, or XACML, or the AWS IAM authorization model, I see that I can't totally decouple business logic from authorization when there are fine-grained ...
0
votes
0
answers
138
views
Can a secure key-exchange algorithm replace hashing for password authentication?
Over the weekend I was thinking about the problem of scaling various web services. One common practice to scale authorization is to use cryptographically signed tokens. This way when a request comes ...
0
votes
4
answers
157
views
Restricting authorization on a web app based on certain criteria
For a web app, we are authenticating and authorizing users. There is no Sign-up option, but rather these users are provisioned into the system explicitly and are given certain permissions based on ...
0
votes
2
answers
333
views
Is it safe to use a JWT as an Authorization Code?
I'm implementing an OAuth 2.0 Authorization Code grant type flow and considering to use a very short-lived JWT as the authorization code so this step doesn't require a database.
I understand that this ...
0
votes
1
answer
1k
views
Trusting CA Certificates by Thumbprint
Id like to create an application which trusts certificates issued from specific CAs.
My ideas is to have a list of thumbprints for CA certificates I trust. Then whenever my app receives a certificate ...
0
votes
0
answers
120
views
How to prevent horizontal escalation attacks when a centralized authorization service as gateway is used?
Say I have a gateway which provides authorization mechanisms by validating a JWT, behind an api-gateway there are different micro-services but only the gateway port is public. As a software designer ...
3
votes
0
answers
243
views
Deauthorization Bug in messenger application - How serious is this?
My question refers to a behavior on a production system with more than 100 million chat users.
Some time ago I changed my account password and removed all devices connected to my account.
The next day ...
1
vote
2
answers
6k
views
Authorization Header in dev tools
My web application need to make call to 3rd party REST API which is protected by Basic authentication on some user click. We are planning to use a technical user for the call.
This will expose the ...
3
votes
1
answer
725
views
Is it safe to make every resource public in a Google Cloud Storage bucket?
I'm developing a business web application for my client, in which he can upload images (e.g. floor plans, photos of object etc.) and documents of different objects (word, excel etc.).
The images ...
2
votes
2
answers
1k
views
Is autologin dangerous? (Debian/Linux)
If I use only a computer, can I disable the password when I log in? That is, the user account has a password, but in the settings I turn on autologin:
/etc/lightdm/lightdm.conf
[Seat:*]
autologin-...
8
votes
3
answers
838
views
Zero Knowledge Proof of ownership of an email address
Let's say that we want to develop a blogging service where only people with an @example.com email can contribute.
Prior to post submission, the user requests that a large random token be generated by ...
1
vote
1
answer
345
views
Why to use username and password instead of just a long password? [duplicate]
Why do most websites use the pair of username and password as we can just use a long password like a token to identify a user?
A simple example: On the server, we create a JSON file with user data ...
1
vote
1
answer
507
views
What is the best form of authorization for captive portal WiFi
I've been looking into captive portal WiFi implementations and on a few I'be been able to easily bypass their login with the following steps:
1) Open Wireshark and run a report getting the most used ...
1
vote
1
answer
96
views
Should OAuth2 proprietary client authorization prompt a confirmation window?
Given a company named X.
X has an OAuth 2 API available for its proprietary clients and also for 3rd party clients.
When a user P enters the process of authorizing a client, it is prompted with a ...
1
vote
2
answers
274
views
How to establish a secure channel with authenticated and authorized access to a remote entity
I have the following problem:
There are 3 parties A, B and X.
X is holding 2 entities on behalf of A and B.
A communicates with X to operate it's own entity. B also communicates with X to operate ...