Questions tagged [authorization]
Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Not to be confused with authentication.
36
questions
153
votes
7answers
94k views
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
13
votes
3answers
2k views
2FA why not to ask the code before password
So in most websites on login page you have to input username and password for e.g. Facebook where you input username and password and then submit form. Other websites ask you each separately e.g. ...
68
votes
1answer
63k views
What is the difference between RBAC and DAC/ACL?
What are the benefits of each, and when should I choose one over the other? Are there situations where these should be merged?
Do you have examples of common usages?
And what about MAC, where ...
11
votes
1answer
1k views
If I misuse OAuth 2.0 to do authentication, am I at risk?
I understand that OAuth is not an authentication protocol, but an authorization one (even if the first paragraph on Google's OAuth 2.0 page disagrees), as well as that:
[...] authorization can be ...
121
votes
6answers
86k views
Why use OpenID Connect instead of plain OAuth2?
I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user.
Now I read about ...
49
votes
3answers
30k views
OAuth2 Cross Site Request Forgery, and state parameter
http://tools.ietf.org/html/draft-ietf-oauth-v2-30#section-10.12 says:
The client MUST implement CSRF protection [...] typically accomplished by requiring any request sent to the redirection URI ...
99
votes
5answers
119k views
Should we store accesstoken in our database for oauth2?
I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list.
I have gone through the complete OAuth2 documentation of ...
22
votes
4answers
8k views
Role Based Access Control + Data Ownership based permissions
Is there a common system or pattern that combines the permissions given by a role in a RBAC-system with permissions in relation to data ownership?
For example:
Bob is a doctor and has the role ...
30
votes
1answer
5k views
How does a refresh token help? [duplicate]
I have a basic doubt or apparently am missing out on something fundamental.
When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
6
votes
5answers
2k views
How can two-man control be implemented efficiently?
Two-man control can be a strong defence, but the overhead is a concern, as discussed previously.
How can two-man control be implemented with minimal overhead?
I would be most interested in a ...
5
votes
1answer
725 views
Security protocol for NFC stickers/cards
Lets say I'm using NFC cards for access control. NFC cards/stickers are easily readable and writable, so my worry is that the data on them could easily be cloned onto another card/sticker and bypass ...
47
votes
6answers
20k views
How secure is NOPASSWD in passwordless sudo mode?
On all our boxes we have ssh access via keys. All keys are password protected. At this moment the sudo mode is not passwordless. Because the number of VMs are growing in our setup, we investigate the ...
18
votes
2answers
5k views
OAuth2 and Authentication
I see a lot of confusion about OAuth2 and Authentication so I created this question in the hope to clear some of the confusion. So, let's talk about the following points :
What is the difference ...
37
votes
2answers
21k views
Role Based Authorization vs. Claim Based Authorization
What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
11
votes
1answer
10k views
Looking for approach to implement attribute based access control (ABAC)
We are looking to implement Attribute-Based Access Control. While we are sold on the philosophy, there are two topics that seem to crop up:
Will it lead to significant performance issues? Especially ...
6
votes
2answers
1k views
Decide to REST API Security
I've developed an API. I got confused and I've been reading articles for days.
Actually my question is close to these but not exact (maybe a combination of them);
Securing REST API that will ...
12
votes
5answers
859 views
How should I tell an organisation that they are vulnerable when I wasn't given permission to check?
I was recently at a village hall (in the UK), some distance from where I live, for a party. I noticed that they had unsecured wi-fi with an SSID of NETGEAR. I assumed it was free wi-fi for users of ...
12
votes
2answers
3k views
Public API with authorization token — is it possible to protect the demo token?
I have a REST API for running some calculations and returning the result, with a very simple token system where only authorized users can use the API.
The user adds their token to the query like this:...
6
votes
2answers
11k views
Will “Authorization: Bearer” in request header fix CSRF attacks? [duplicate]
I have been reading on fixing CSRF attacks. From some research I understand that checking for a non-standard header would prevent CSRF attacks since the browser will not automatically send such ...
6
votes
4answers
5k views
encryption vs access control comparison
I have a very basic and simple question about two security concepts.
Both encryption and access control are used for privacy and to prevent unauthorized users from accessing some object (eg. files, ...
3
votes
1answer
2k views
Risk of keeping OAuth2 client_secret in application
As an exercise, I'm developing a desktop application with which users need to log in to a web service. A logical use-case for OAuth2 one would say, but I'm beginning to doubt its usefulness. I am ...
10
votes
2answers
6k views
Claim Based Authorization vs Attribute Based Access Control
Is there a difference between Attribute Based Access Control which is usually associated with XACML and Claim Based Authorization which seems to be a term coined by Microsoft?
Is the latter simply ...
12
votes
1answer
7k views
CSRF with OAuth or Bearer Authorization headers
I am designing a RESTful API which is to be accessible from a web browser. The API is protected by Basic authentication.
I understand the concept of CSRF, and the mitigations proposed (I found both ...
7
votes
1answer
3k views
Hotspot with same SSID, how does authorization work?
My university has a wireless network I log into with my username and password. It's using PEAP. My phone and laptop automatically connect to this SSID when they detect the network.
If someone sets up ...
6
votes
1answer
1k views
Can oauth2 “state” parameter be used to avoid using session cookies to identify user
https://tools.ietf.org/html/rfc6749#section-4.1.1 states:
4.1.1. Authorization Request"
"state"
RECOMMENDED. An opaque value used by the client to maintain
state between the ...
5
votes
1answer
5k views
WCF - Is this a good security Architecture?
I am building an information recording system (WCF based) for a business that is accessible by staff over the internet. This software will not be distributed and there will only be a handful of users ...
4
votes
3answers
3k views
3rd party API access: Is OAuth really required?
Having a web application with a REST API (say, our-app.com), we want to open our API to 3rd party web applications (say, their-app.com). After some research, having read about OAuth, OpenID Connect, ...
4
votes
2answers
591 views
Does providing OAuth for mobile apps pose a security threat?
Let's take a look at the basic OAuth workflow:
The basic idea is that the Consumer (App) asks the user to grant him access to the Service Provider. The service protects the user by asking him each ...
3
votes
3answers
500 views
How webmail's authorisation should work?
I'm building a webmail client (like gmail). It allows the user to browse emails and send them. Under the hood, php uses IMAP and SMTP to talk with email server.
user->webserver->mailserver
When user ...
2
votes
1answer
7k views
How WEP/WPA authentication works in a WiFi environment?
I'm looking on a clear schema that would explain how a computer connect to an WiFi access point (WEP or WPA in any version (1,2)).
The basic schema would be :
Computer looks which AP are available
...
0
votes
2answers
346 views
Is sending authorizing links through e-mail a vulnerability?
I am not sure if my wording is right, but if I attach a unique token inside email links which will authorize the user if clicked, would you consider this a vulnerability?
Password-reset partly ...
5
votes
2answers
803 views
Facebook iOS SDK Authentication
The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app.
If I find out an app's app ID, can't I just create another iOS app with that app's ...
3
votes
2answers
333 views
2-step authorization (using SMS) is less secure than having 2-factor disabled at all!
I've been thinking about this subject, and found paradoxical fact.
Having a service that has 2-step authorization using SMS might become more harmful and open vulnerability hole (read SMS can be ...
3
votes
1answer
305 views
Access based on type of information requested and access grant
The simple solution to access restriction when number of users are small is Access Control Matrix. Here the rows are the users and columns are different types of asset.
In my case, I have a document ...
1
vote
1answer
266 views
Protecting data on an embedded device
I am to release a system-on-chip device that, during its lifetime, will come to store sensitive data. I want to make that data hard to extract or duplicate.
Encrypting is good for dealing with MiTM, ...
0
votes
2answers
648 views
3rd Party Mail Clients on iPhone/Android and Credential Storage
Normally when working with a user's credentials, i would store them locally on a device, never on a server because it creates unnecessary liability.
For example, on iPhone we have
Mail (default)
...
