Questions tagged [authorization]
Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Not to be confused with authentication.
389
questions
1
vote
0answers
395 views
Micro Service - Outh2 Workflow with a SPA, Facebook Login and JWT
Introduction
We are currently trying to figure out a way to implement token based authentication and authorisation with Facebook Connect combined with maybe JWT within the micro service architecture.
...
1
vote
0answers
646 views
Is it safe to implement JWT auth with cookies, token versioning, and no refresh tokens?
I have some questions about my implementation of bearer token security (JWT to be specific) in an asp.net core 2.0 project that I'm working on. The bearer token is used when the frontend web app talks ...
12
votes
1answer
930 views
Separating “function” from “scope” in RBAC
I'm trying to formulate an RBAC permission model which allows separation between permissions and the scopes on which those permissions are applied. I have been unable to find a standard model which ...
3
votes
1answer
304 views
Access based on type of information requested and access grant
The simple solution to access restriction when number of users are small is Access Control Matrix. Here the rows are the users and columns are different types of asset.
In my case, I have a document ...
1
vote
1answer
656 views
Is the OAuth 2 authorization code flow vulnerable to the Confused Deputy Problem?
Confused Deputy Problem (also known as 'The Devil Wears Prada') is an OAuth 2 vulnerability arising when the protocol is used for authentication. Essentially, a malicious client obtains a token for a ...
0
votes
1answer
56 views
Is the following scheme for Google OAuth2 authentication and authorization satisfactory and secure?
I have a users table in my SPA application (Phoenix API application) which contains the fields: name, email, registered_at, role_id. I use OAuth2 authentication by Google API. After the end-user ...
0
votes
0answers
72 views
Was the Huddle problem just a “bug” in the implementation of true two-factor authentication?
I've just read the BBC News item Huddle's 'highly secure' work tool exposed KPMG and BBC files. According to the article:
How did this happen?
During the Huddle sign-in process, the customer's device ...
0
votes
2answers
72 views
Authorization / Access control in a client-side-encryption environment
I'm thinking about a client-side encryption concept where only the client knows the master secret (a user password). A correct implementation assumed, with KDF and authenticated encryption solutions ...
6
votes
2answers
11k views
Will “Authorization: Bearer” in request header fix CSRF attacks? [duplicate]
I have been reading on fixing CSRF attacks. From some research I understand that checking for a non-standard header would prevent CSRF attacks since the browser will not automatically send such ...
0
votes
4answers
205 views
Protecting from console attacks
I am creating a web-app using PHP and jQuery Ajax for my client-side. When I was testing some security stuff, I thought of inserting a malicious user account with admin access in the database by ...
2
votes
1answer
60 views
Authorization expiration without reliable clock / time
I've been looking, but I think its impossible to find a pairing solution that has the benefits of authorization expiration and renewal (like x509 cert expiry and OAuth expires_in), but that works ...
5
votes
2answers
3k views
Fine grained authorization with OAuth2
In my understanding of OAuth2 the scope may be used to specify access to what is asked and granted by code owner.
In most cases I encounters the scope list is closed and specify "kinds" of thing ...
69
votes
7answers
18k views
User can't navigate to webpage through the UI due to permissions, but are able to navigate to page by pasting the URL. How do I protect against this?
In my application, users have certain roles which have permissions. These permissions dictate which UI elements are available to them at the home screen. Many of the elements link to other pages, ...
2
votes
1answer
3k views
How to secure handshake system-to-system in RESTful API calls without user/pass?
I have system X from another department in our company that sends basic user info (not passwords) to my system using RESTful API. Both systems are using subdomains of the same domain but reside on ...
2
votes
1answer
81 views
Are There Any Standards for building pin code authorization?
We're going to add a pin authorization feature to our website. So, I'm wondering a question, how to make it secure? As I understand, Apple/Windows after first user login link pincode to a specific ...
1
vote
2answers
132 views
Self-Coded User Authentication Security
We are currently using Apache Shiro for our User Authentication needs. We have dynamic authorization\authentication needs, in some cases users will be authenticated using Active Directory while some ...
0
votes
1answer
403 views
How to store encrypted user's data on a server, decrypt only on the client, and store the key elsewhere?
Here's what I would like to do: have a client side that generates and processes the user's data, then encrypts it and stores in a database - in order to later retrieve, decrypt and process the data ...
1
vote
2answers
138 views
What should I check on temporarily lost computer?
I physically lost my laptop containing some sensitive information and it was picked up by a stranger. I was of course over confident and didn't have it password locked. He was very courteous in ...
2
votes
1answer
364 views
Do we need to maintain Authentication and Authorization Logic separately? [closed]
We are using Keycloak Identity server which will take care of Authentication and Authorization for our new Multi Level Marketing Website.
There was a discussion going on within our team to maintain ...
2
votes
1answer
395 views
OAuth 2.0: Are refresh tokens still beneficial when all clients are public?
I'm designing a new REST API for a mobile app service, which is something I've not yet had to do from scratch. I decided to use OAuth 2.0 with the Resource Owner Password Credentials grant.
Ideally, ...
0
votes
1answer
496 views
Where should the authorization logic go in an api based application?
I have a brand new Rails api based application, where i need to implement authorization.
Overall Architecture:
React frontend -> Rails API layer -> Rails model/server layer
While exploring ...
2
votes
1answer
618 views
OAuth 2.0: What is the advantage of authorization_code grant flow over Implicit grant flow?
I'm not able to appreciate what is the advantage of having a autorization_code given to the client and then exchanging this for access token on webapp side. Instead why not just give access_token to ...
1
vote
2answers
128 views
We want to give an outside party access to a demo environment. How do we ensure only they get access to only their version of the environment?
We are currently setting up a system where we can create demo environments for prospective clients to use, where we host those demo environments in our own DMZ. The idea is that if a prospect wants to ...
3
votes
1answer
942 views
Using Simple JWT for Public Facing API Auth
I'm looking at security methods for APIs. Using JWT access tokens after client login with user/password will work well for internal web apps using our own APIs. However, I'm looking at how we should ...
3
votes
1answer
809 views
What is the need of “password” grant-type in OAuth 2.0?
The need of OAuth arose because we wanted to give access of some of our resources at the Resource Server (for example my Name/Email at Facebook) to the 3rd party apps. This justifies various grant-...
13
votes
3answers
2k views
2FA why not to ask the code before password
So in most websites on login page you have to input username and password for e.g. Facebook where you input username and password and then submit form. Other websites ask you each separately e.g. ...
6
votes
1answer
431 views
Chrome is storing login POST requests in its memory
I am logging in to my site using Chrome (on Ubuntu). Even if I logout and close my browser I can see the login POST request content (containing username and Password) using "Hexedit".
I have seen a ...
6
votes
1answer
143 views
Verify that the leaves of a tree was created by a parent node?
I am looking for something like hash tree in a sense that leaves node can be verified to be part of the tree but the tree has to be able to built top down (from top node to leaves).
I'm not sure ...
1
vote
1answer
83 views
Risks of using GET param for Auth
I am currently developing a tiny web app. Since username/password would be too much of a overhead I am thinking of a GET param for authorization and authentication.
Example: funnydomain.rocks/lol?...
37
votes
11answers
11k views
Returning the wrong HTTP response code on purpose?
I'm writing a simple REST API, and I want to restrict access to my mobile-client only. In other words, I'm trying to prevent a malicious user from e.g. using curl to make an unauthorized POST request.
...
2
votes
2answers
207 views
How to protect an application from attackers with full read-access to the db?
I work on a web application with the client side being a single-page Javascript application and the server side being a REST service. This application manages sensitive user data which must not be ...
1
vote
1answer
263 views
When does OpenID Connect return JSON?
Whereas OAuth2 doesn't explicitly define which token type to use, OpenID Connect defines an API and data format to perform OAuth2 authorization flows.
What are the occasions in which a JWT is ...
1
vote
1answer
179 views
Basic authentication portected page accessible without header but not from different IP
I'm looking at a website uses basic authentication to authorise users.
When I look at the request, once authenticated, it appends the header Authorization: Basic cm9vdDpwYXNzd29yZA== (I'm aware that ...
2
votes
0answers
471 views
OpenID Connect Standard: Authorized Party azp Contradiction
In the OpenID Connect spec the azp (authorized party) claim seems to have a contradiction.
In the ID token definition section 2 it says:
azp
OPTIONAL. Authorized party - the party to which the ID ...
4
votes
1answer
3k views
Is my passwordless auth (magic link OTPW) system secure? [duplicate]
I've implemented a passwordless auth system (where the users only login using a 'magic link' sent to their email) on my own. I know designing security systems without experience is really bad, so I'm ...
7
votes
3answers
949 views
Staged Authentication
Would anyone happen to know the terminology for using "multi-staged authentication", where each stage grants a specific level of authorization?
The concept is that you for instance browse a web page, ...
2
votes
1answer
600 views
What is the meaning of 'Default to Zero' that must be keep in mind in Authorization?
I learned that in authorization there are somethings to keep in mind, there are:
-Authorization Creep
this happens when an employee switch roles and the previous authorization isnt removed.
-Default ...
0
votes
5answers
2k views
Securing data and files so as they won't be openable anywhere else but your own server?
I know this question might seem a bit weird, but I believe there should be a way, at least to reduce the ability to download or use script to download files from storage. I tried a lot but found ...
13
votes
1answer
848 views
How much entropy does a smartphones' pattern lock have? [duplicate]
What's the entropy of smartphone "pattern passwords"? Through how many nodes do I have to go until I'm safe (say, a reasonable 42 bits of strength)?
0
votes
1answer
41 views
Reason to Require A VPN Client for Exchange 2010 and Newer?
Reading Microsoft's Publishing Exchange Server 2010 with Forefront Unified Access Gateway 2010 and Forefront Threat Management Gateway 2010, it looks like encryption is baked in for client access in ...
1
vote
2answers
1k views
Native app: login with username and password
I have web api, for now it uses oauth2 authorization code grant type to communicate with my native application. Web browser will be opened inside app to input username and password, open authorize ...
1
vote
1answer
230 views
ADFS claims consolidation from different issuers
I hope I understand the claims concept in general now after reading related articles on ADFS, certificates used for claims token signing etc. But here is what strange for me:
Claims are so abstract ...
1
vote
1answer
5k views
What's the difference between DRM and CAS?
As I see it, both are used within the scope of content security, to restrict who has access to what.
So what's the difference between a DRM system and a Conditional Access System? Is CAS a subset of ...
1
vote
2answers
928 views
Is it safe to use OAuth (Resource Owner Password Credentials Grant) for authentication?
Specifically, do I have to worry about the confused deputy problem if I'm just trying to authorize a user against a single API?
For example: a basic messaging service will want to authenticate and ...
2
votes
1answer
186 views
Secure CDN content for a multi-tenant application
We have a multi-tenanted application that has sensitive content behind a secure login. We'd like to host that content on a CDN but prevent unauthorised users from accessing it.
What are the best ways ...
4
votes
1answer
251 views
Client identity other than URL/DNS name in certificate
I am currently working on a project where nearly whole communication is done using HTTPS and ActiveMQ. Servers and clients are physically in different places, different organizations and in different ...
2
votes
2answers
2k views
How do OTT providers protect LIVE streams?
For Video on Demand, DRM seems the way to go. I've been told that providers might be using a token-based system, but I haven't found any provider so far that uses token, just DRM (except Akamai, ...
0
votes
2answers
644 views
3rd Party Mail Clients on iPhone/Android and Credential Storage
Normally when working with a user's credentials, i would store them locally on a device, never on a server because it creates unnecessary liability.
For example, on iPhone we have
Mail (default)
...
5
votes
4answers
2k views
Preventing tampering of ~/.ssh/authorized_keys
If a server is compromised, an attacker could add his own public key to authorized_keys. How is this prevented? Who should have what access to the file?
4
votes
1answer
982 views
HTTP authentication - the HTTP header name is Authorization - why?
Why by HTTP authentication the HTTP header which contains credentials is called "Authorization"? Any historical explanation?
I am asking because I realized that some people mix authentication with ...
