Questions tagged [authorization]

Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Not to be confused with authentication.

68 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
1answer
836 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
4
votes
0answers
177 views

Deauthorization Bug in messenger application - How serious is this?

My question refers to a behavior on a production system with more than 100 million chat users. Some time ago I changed my account password and removed all devices connected to my account. The next day ...
3
votes
0answers
87 views

How does “Fides” from the German Bundesdruckerei work?

I'm no security or cryptographic expert, just an interested computer scientist - so this question may be at the wrong place, or contain wrong assumptions. Nevertheless: The German Bundesdruckerei ...
3
votes
0answers
130 views

How can an organization manage permissions in a centralized way?

Almost all applications mantain the permissions with the application and have no way of having at least the roles outside the application. Is the only way to have centralized authentication but ...
3
votes
0answers
430 views

Is passing claims about the user in an access token “abusing” OpenID Connect?

First, let me assure you that I have read a number of posts on the topic before asking this question, but I am still confused and would appreciate more insights. So, here's the premise: There is a ...
3
votes
0answers
82 views

Could this authentication/authorization flow be attacked without compromising the Authority Server?

I am trying to come up with (at this time) server-to-server distributed authorization/authentication that would have (near) the same advantages as OAuth2 but without it's drawbacks. Is there any ...
2
votes
0answers
153 views

Does my app need authentication in addition to Spotify authorization?

I have an app that revolves entirely around Spotify. I have followed the authorization guide from Spotify and am using the Authorization Code Flow so the access token can be refreshed. My thinking was ...
2
votes
0answers
36 views

Authentication and authorization of a subrequest

A user sends a request to a system A. The request is signed with a digital signature, so the system A can authenticate and authorize the user. Then the system A creates a series of sub-requests to ...
2
votes
1answer
707 views

OAuth2 for first party web-app

I am building a web (also potentially mobile app) for a platform that allows plugins. We're using the OAuth2 Authorization Code grant type for third-party client plugins. Which, if any, grant type ...
2
votes
0answers
179 views

How are github personal access tokens and other github auth for 3rd parties not a securty issue?

Many services integrate with github. Some of them seem to require a personal access token with "repo" permission. Personal access tokens are global across all projects. In other words you may want to ...
2
votes
0answers
534 views

How to create an anonymous user account like the app Day-One does?

A new iOS app should be able to connect to a web service to sync data across devices. I like the way the diary app Day One solved this by offering "real" user accounts and automatically generated "...
2
votes
1answer
369 views

Did I get it right? OAuth2, OpenID and OpenID Connect

After a lot of research about authentication and authorization, I reached the following but not sure if what I reached is the correct thing so please help me out: Authentication is who you are. ...
2
votes
0answers
34 views

How to update authorization information in a KDC dynamically?

I wish to add Kerberos authentication and authorization into a project that has a service server that interacts with a Hadoop cluster that has some users and permissions. As far as I know, the KDC ...
2
votes
0answers
520 views

Web app access control system design

I am having trouble finding a scalable way to create a access control system which both follows best practices and can scale well. I have looked at various approaches like RBAC and ABAC. For the ...
2
votes
0answers
471 views

OpenID Connect Standard: Authorized Party azp Contradiction

In the OpenID Connect spec the azp (authorized party) claim seems to have a contradiction. In the ID token definition section 2 it says: azp OPTIONAL. Authorized party - the party to which the ID ...
2
votes
0answers
34 views

Secure userserver authentication with authserver

So, lets say we have Bob, Alice and Peter. Peter is trusted by Bob and Peter has an authserver. Bob hosts a userserver and Alice wants to connect to Bob over an insecure channel. But Bob needs to know ...
2
votes
0answers
2k views

Token-based SSO for multiple domains for backend API requests

I’m in the process of setting up SSO for a service I’m creating. After looking at solutions, I’ve found nothing to fit exactly what we need. I’m looking to make sure from a security standpoint what we ...
2
votes
0answers
175 views

Combining id_tokens and access_tokens for new auth spec

A common misuse of OAuth2 is as a strict authentication protocol. OpenID Connect addresses this by extending OAuth2 to include an id_token. Implementing clients for OAuth2 and OpenID Connect is a ...
2
votes
0answers
389 views

Security token in android and embedded system

I have an embedded board with a very limited processing and memory resource. I would like to control the board using an android app. The users are categorized into 3 groups: owner of the board. ...
2
votes
0answers
1k views

NFS IP spoofing

I am using VirtualBox: where the guest is an Arch ISO and the host Windows/Cygwin or a generic Linux. For sharing host folders, VB native shared folders is not an option (since the setup requires ...
2
votes
0answers
487 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
2
votes
0answers
78 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
2
votes
0answers
137 views

In U-Prove, what is the purpose of “Pseudonyms”, “Committed”, and “Scope” values and how are they used?

U-Prove allows for anonymous authentication and authorization without the involvement of an IdP. When a client generates a presentation proof 3 values can be optionally included, but I can't find ...
2
votes
1answer
188 views

Secure CDN content for a multi-tenant application

We have a multi-tenanted application that has sensitive content behind a secure login. We'd like to host that content on a CDN but prevent unauthorised users from accessing it. What are the best ways ...
1
vote
0answers
49 views

What is the optimal authorization flow for this usecase?

Imagine that I'm building a server that provides useful APIs for web chat development. I want it to be accessible only to registered developer accounts. A developer registers and builds a chat that ...
1
vote
0answers
32 views

Why do some “OAuth” providers ask for personal info?

I don't mean to start another OAuth vs OpenID discussion, but I want to share the underlying cause of my confusion. When I want a Client to process my google docs for something, I have to go through ...
1
vote
1answer
54 views

How to implement MySQL query fo RBAC authorization with fine grained business restrictions in role?

When implementing an authorization system like RBAC/DAC, or XACML, or the AWS IAM authorization model, I see that I can't totally decouple business logic from authorization when there are fine-grained ...
1
vote
0answers
212 views

AWS Appsync authorization - why is IAM authorization safer than API Key based approach

We are currently evaluating which authorization type to use for our production AppSync APIs. As per AWS docs(https://docs.aws.amazon.com/appsync/latest/devguide/security.html, https://aws.amazon.com/...
1
vote
1answer
274 views

What is delegation, identity delegation, and delegated authorization, and what are the differences among them?

I've been writing up a guide to OAuth 2.0, OpenID Connect, and Identity Server 4 mostly for my own learning, drawing on several sources such as OAuth2 In Action, OAuth 2.0 Simplified, and CISSP: A ...
1
vote
0answers
61 views

Is this a good approach to safely authorize requests to a SPA from an external website?

I developed an Angular app for a manufacturer that allows their customers to place orders for their products. The app uses a web service that is made available by the manufacturer's software, so it ...
1
vote
0answers
80 views

Designing distributed authentication/authorisation system

I'm trying to design a system that has the following elements: the main backend REST API (currently one, probably multiple in the future) front-channel client(s) -- JS-based single-page app(s) back-...
1
vote
0answers
69 views

Abusively? repurposing authorization token handler

Background I have an authorization handler of the form: Auth(AllowedGroups, Token) -> [Allow/Deny] Where the Token consist of the following tuple and its MAC tag. TbsToken := (userid, ...
1
vote
0answers
73 views

What is a gain from storing jws token in database

Recently someone mentioned he is using JWS token for authorisation, but JWS tokens received via API calls are validated against active ones stored in database. (EDIT he also checks signature). In my ...
1
vote
0answers
301 views

Securing RESTful APIs with Private Keys

I'm currently working on building a rest service that other applications which we create will utilize (from backend application servers). My current process uses a single private key value for ...
1
vote
2answers
156 views

Encrypted log entries authorization

We have a database table of encrypted log entries, each encrypted entry containing information about the user who created the entry. The entry is encrypted with the encryption key of the particular ...
1
vote
0answers
395 views

Micro Service - Outh2 Workflow with a SPA, Facebook Login and JWT

Introduction We are currently trying to figure out a way to implement token based authentication and authorisation with Facebook Connect combined with maybe JWT within the micro service architecture. ...
1
vote
0answers
647 views

Is it safe to implement JWT auth with cookies, token versioning, and no refresh tokens?

I have some questions about my implementation of bearer token security (JWT to be specific) in an asp.net core 2.0 project that I'm working on. The bearer token is used when the frontend web app talks ...
1
vote
1answer
230 views

ADFS claims consolidation from different issuers

I hope I understand the claims concept in general now after reading related articles on ADFS, certificates used for claims token signing etc. But here is what strange for me: Claims are so abstract ...
1
vote
0answers
635 views

SAML, OAUTH, XACML oh my (Authorization)!

Unfortunately, after using several SSO/IAM products at a 'lite touch' to 'deep integration' level, I'm still left unsatisfied, so going to ask the most basic question I can: Given multiple ...
1
vote
0answers
66 views

Is there a “smart cache” device which provides cache if authorized?

Is there an implementation of a HTTP (or decoded HTTPS) optimization device which would allow for "smart caching" - i.e. the ability to release some cached content (initially transferred by someone ...
1
vote
0answers
468 views

JWT for User Authentication + Client App Authentication + User Claims Holder?

I would like to switch the security layer of my API from Basic Auth over HTTPS + claims-based infrastructure (w/ claims populated in a delegatinghandler) to a more robust mechanism and support client ...
1
vote
0answers
1k views

Using email to authorize access to a user's account

would greatly appreciate some advice from the experts here on this stackexchange. I'm building an application that requires access to a user's resources from a 3rd party application. This 3rd party ...
1
vote
0answers
30 views

IdM on apps we host for a client

We're looking at hosting some of a client's existing applications in our environment. My current thinking is we will have an encrypted channel back to the client's network over which authentication ...
1
vote
0answers
815 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
1
vote
0answers
1k views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...
0
votes
0answers
57 views

JWT refresh tokens and Double Submit Cookies

I am struggling to implement JWT refresh tokens with the Double Submit Cookies method. My current set up for a browser based webapp without refresh tokens looks like this: Upon successful login, API ...
0
votes
2answers
49 views

Approach to authorizing users and X.509 certificates

I have a system where I'm using X.509 certificates to authenticate the client to the server. The certificate is sent to an HSM to be signed. When it is returned it is used as part of a TLS connection. ...
0
votes
0answers
41 views

Is there a good reason not to track valid JWTs in a key value store like redis?

I use Redis to track valid JWTs by saving the JTI (uuid-v4) mapped to the users id in Redis. If the JTI can not be found in Redis or the user id in Redis does not match the user id in the JWT the ...
0
votes
0answers
35 views

Providing shared access to a single machine without a shared account

In our factory we have a "Big Machine" which runs 24/7 and requires input and monitoring from different operators across various shifts. Every operator needs to be able to stop/start/control ...
0
votes
0answers
104 views

Is this HTTP authorization token secure?

I am new to backend development and read about Authorization methods such as Basic, Bearer and OAuth 2.0. I haven't use any of these directly, but used a token based implementation. User logs in with ...