Questions tagged [authorization]

Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Not to be confused with authentication.

Filter by
Sorted by
Tagged with
1
vote
0answers
395 views

Micro Service - Outh2 Workflow with a SPA, Facebook Login and JWT

Introduction We are currently trying to figure out a way to implement token based authentication and authorisation with Facebook Connect combined with maybe JWT within the micro service architecture. ...
1
vote
0answers
646 views

Is it safe to implement JWT auth with cookies, token versioning, and no refresh tokens?

I have some questions about my implementation of bearer token security (JWT to be specific) in an asp.net core 2.0 project that I'm working on. The bearer token is used when the frontend web app talks ...
12
votes
1answer
930 views

Separating “function” from “scope” in RBAC

I'm trying to formulate an RBAC permission model which allows separation between permissions and the scopes on which those permissions are applied. I have been unable to find a standard model which ...
3
votes
1answer
304 views

Access based on type of information requested and access grant

The simple solution to access restriction when number of users are small is Access Control Matrix. Here the rows are the users and columns are different types of asset. In my case, I have a document ...
1
vote
1answer
656 views

Is the OAuth 2 authorization code flow vulnerable to the Confused Deputy Problem?

Confused Deputy Problem (also known as 'The Devil Wears Prada') is an OAuth 2 vulnerability arising when the protocol is used for authentication. Essentially, a malicious client obtains a token for a ...
0
votes
1answer
56 views

Is the following scheme for Google OAuth2 authentication and authorization satisfactory and secure?

I have a users table in my SPA application (Phoenix API application) which contains the fields: name, email, registered_at, role_id. I use OAuth2 authentication by Google API. After the end-user ...
0
votes
0answers
72 views

Was the Huddle problem just a “bug” in the implementation of true two-factor authentication?

I've just read the BBC News item Huddle's 'highly secure' work tool exposed KPMG and BBC files. According to the article: How did this happen? During the Huddle sign-in process, the customer's device ...
0
votes
2answers
72 views

Authorization / Access control in a client-side-encryption environment

I'm thinking about a client-side encryption concept where only the client knows the master secret (a user password). A correct implementation assumed, with KDF and authenticated encryption solutions ...
6
votes
2answers
11k views

Will “Authorization: Bearer” in request header fix CSRF attacks? [duplicate]

I have been reading on fixing CSRF attacks. From some research I understand that checking for a non-standard header would prevent CSRF attacks since the browser will not automatically send such ...
0
votes
4answers
205 views

Protecting from console attacks

I am creating a web-app using PHP and jQuery Ajax for my client-side. When I was testing some security stuff, I thought of inserting a malicious user account with admin access in the database by ...
2
votes
1answer
60 views

Authorization expiration without reliable clock / time

I've been looking, but I think its impossible to find a pairing solution that has the benefits of authorization expiration and renewal (like x509 cert expiry and OAuth expires_in), but that works ...
5
votes
2answers
3k views

Fine grained authorization with OAuth2

In my understanding of OAuth2 the scope may be used to specify access to what is asked and granted by code owner. In most cases I encounters the scope list is closed and specify "kinds" of thing ...
69
votes
7answers
18k views

User can't navigate to webpage through the UI due to permissions, but are able to navigate to page by pasting the URL. How do I protect against this?

In my application, users have certain roles which have permissions. These permissions dictate which UI elements are available to them at the home screen. Many of the elements link to other pages, ...
2
votes
1answer
3k views

How to secure handshake system-to-system in RESTful API calls without user/pass?

I have system X from another department in our company that sends basic user info (not passwords) to my system using RESTful API. Both systems are using subdomains of the same domain but reside on ...
2
votes
1answer
81 views

Are There Any Standards for building pin code authorization?

We're going to add a pin authorization feature to our website. So, I'm wondering a question, how to make it secure? As I understand, Apple/Windows after first user login link pincode to a specific ...
1
vote
2answers
132 views

Self-Coded User Authentication Security

We are currently using Apache Shiro for our User Authentication needs. We have dynamic authorization\authentication needs, in some cases users will be authenticated using Active Directory while some ...
0
votes
1answer
403 views

How to store encrypted user's data on a server, decrypt only on the client, and store the key elsewhere?

Here's what I would like to do: have a client side that generates and processes the user's data, then encrypts it and stores in a database - in order to later retrieve, decrypt and process the data ...
1
vote
2answers
138 views

What should I check on temporarily lost computer?

I physically lost my laptop containing some sensitive information and it was picked up by a stranger. I was of course over confident and didn't have it password locked. He was very courteous in ...
2
votes
1answer
364 views

Do we need to maintain Authentication and Authorization Logic separately? [closed]

We are using Keycloak Identity server which will take care of Authentication and Authorization for our new Multi Level Marketing Website. There was a discussion going on within our team to maintain ...
2
votes
1answer
395 views

OAuth 2.0: Are refresh tokens still beneficial when all clients are public?

I'm designing a new REST API for a mobile app service, which is something I've not yet had to do from scratch. I decided to use OAuth 2.0 with the Resource Owner Password Credentials grant. Ideally, ...
0
votes
1answer
496 views

Where should the authorization logic go in an api based application?

I have a brand new Rails api based application, where i need to implement authorization. Overall Architecture: React frontend -> Rails API layer -> Rails model/server layer While exploring ...
2
votes
1answer
618 views

OAuth 2.0: What is the advantage of authorization_code grant flow over Implicit grant flow?

I'm not able to appreciate what is the advantage of having a autorization_code given to the client and then exchanging this for access token on webapp side. Instead why not just give access_token to ...
1
vote
2answers
128 views

We want to give an outside party access to a demo environment. How do we ensure only they get access to only their version of the environment?

We are currently setting up a system where we can create demo environments for prospective clients to use, where we host those demo environments in our own DMZ. The idea is that if a prospect wants to ...
3
votes
1answer
942 views

Using Simple JWT for Public Facing API Auth

I'm looking at security methods for APIs. Using JWT access tokens after client login with user/password will work well for internal web apps using our own APIs. However, I'm looking at how we should ...
3
votes
1answer
809 views

What is the need of “password” grant-type in OAuth 2.0?

The need of OAuth arose because we wanted to give access of some of our resources at the Resource Server (for example my Name/Email at Facebook) to the 3rd party apps. This justifies various grant-...
13
votes
3answers
2k views

2FA why not to ask the code before password

So in most websites on login page you have to input username and password for e.g. Facebook where you input username and password and then submit form. Other websites ask you each separately e.g. ...
6
votes
1answer
431 views

Chrome is storing login POST requests in its memory

I am logging in to my site using Chrome (on Ubuntu). Even if I logout and close my browser I can see the login POST request content (containing username and Password) using "Hexedit". I have seen a ...
6
votes
1answer
143 views

Verify that the leaves of a tree was created by a parent node?

I am looking for something like hash tree in a sense that leaves node can be verified to be part of the tree but the tree has to be able to built top down (from top node to leaves). I'm not sure ...
1
vote
1answer
83 views

Risks of using GET param for Auth

I am currently developing a tiny web app. Since username/password would be too much of a overhead I am thinking of a GET param for authorization and authentication. Example: funnydomain.rocks/lol?...
37
votes
11answers
11k views

Returning the wrong HTTP response code on purpose?

I'm writing a simple REST API, and I want to restrict access to my mobile-client only. In other words, I'm trying to prevent a malicious user from e.g. using curl to make an unauthorized POST request. ...
2
votes
2answers
207 views

How to protect an application from attackers with full read-access to the db?

I work on a web application with the client side being a single-page Javascript application and the server side being a REST service. This application manages sensitive user data which must not be ...
1
vote
1answer
263 views

When does OpenID Connect return JSON?

Whereas OAuth2 doesn't explicitly define which token type to use, OpenID Connect defines an API and data format to perform OAuth2 authorization flows. What are the occasions in which a JWT is ...
1
vote
1answer
179 views

Basic authentication portected page accessible without header but not from different IP

I'm looking at a website uses basic authentication to authorise users. When I look at the request, once authenticated, it appends the header Authorization: Basic cm9vdDpwYXNzd29yZA== (I'm aware that ...
2
votes
0answers
471 views

OpenID Connect Standard: Authorized Party azp Contradiction

In the OpenID Connect spec the azp (authorized party) claim seems to have a contradiction. In the ID token definition section 2 it says: azp OPTIONAL. Authorized party - the party to which the ID ...
4
votes
1answer
3k views

Is my passwordless auth (magic link OTPW) system secure? [duplicate]

I've implemented a passwordless auth system (where the users only login using a 'magic link' sent to their email) on my own. I know designing security systems without experience is really bad, so I'm ...
7
votes
3answers
949 views

Staged Authentication

Would anyone happen to know the terminology for using "multi-staged authentication", where each stage grants a specific level of authorization? The concept is that you for instance browse a web page, ...
2
votes
1answer
600 views

What is the meaning of 'Default to Zero' that must be keep in mind in Authorization?

I learned that in authorization there are somethings to keep in mind, there are: -Authorization Creep this happens when an employee switch roles and the previous authorization isnt removed. -Default ...
0
votes
5answers
2k views

Securing data and files so as they won't be openable anywhere else but your own server?

I know this question might seem a bit weird, but I believe there should be a way, at least to reduce the ability to download or use script to download files from storage. I tried a lot but found ...
13
votes
1answer
848 views

How much entropy does a smartphones' pattern lock have? [duplicate]

What's the entropy of smartphone "pattern passwords"? Through how many nodes do I have to go until I'm safe (say, a reasonable 42 bits of strength)?
0
votes
1answer
41 views

Reason to Require A VPN Client for Exchange 2010 and Newer?

Reading Microsoft's Publishing Exchange Server 2010 with Forefront Unified Access Gateway 2010 and Forefront Threat Management Gateway 2010, it looks like encryption is baked in for client access in ...
1
vote
2answers
1k views

Native app: login with username and password

I have web api, for now it uses oauth2 authorization code grant type to communicate with my native application. Web browser will be opened inside app to input username and password, open authorize ...
1
vote
1answer
230 views

ADFS claims consolidation from different issuers

I hope I understand the claims concept in general now after reading related articles on ADFS, certificates used for claims token signing etc. But here is what strange for me: Claims are so abstract ...
1
vote
1answer
5k views

What's the difference between DRM and CAS?

As I see it, both are used within the scope of content security, to restrict who has access to what. So what's the difference between a DRM system and a Conditional Access System? Is CAS a subset of ...
1
vote
2answers
928 views

Is it safe to use OAuth (Resource Owner Password Credentials Grant) for authentication?

Specifically, do I have to worry about the confused deputy problem if I'm just trying to authorize a user against a single API? For example: a basic messaging service will want to authenticate and ...
2
votes
1answer
186 views

Secure CDN content for a multi-tenant application

We have a multi-tenanted application that has sensitive content behind a secure login. We'd like to host that content on a CDN but prevent unauthorised users from accessing it. What are the best ways ...
4
votes
1answer
251 views

Client identity other than URL/DNS name in certificate

I am currently working on a project where nearly whole communication is done using HTTPS and ActiveMQ. Servers and clients are physically in different places, different organizations and in different ...
2
votes
2answers
2k views

How do OTT providers protect LIVE streams?

For Video on Demand, DRM seems the way to go. I've been told that providers might be using a token-based system, but I haven't found any provider so far that uses token, just DRM (except Akamai, ...
0
votes
2answers
644 views

3rd Party Mail Clients on iPhone/Android and Credential Storage

Normally when working with a user's credentials, i would store them locally on a device, never on a server because it creates unnecessary liability. For example, on iPhone we have Mail (default) ...
5
votes
4answers
2k views

Preventing tampering of ~/.ssh/authorized_keys

If a server is compromised, an attacker could add his own public key to authorized_keys. How is this prevented? Who should have what access to the file?
4
votes
1answer
982 views

HTTP authentication - the HTTP header name is Authorization - why?

Why by HTTP authentication the HTTP header which contains credentials is called "Authorization"? Any historical explanation? I am asking because I realized that some people mix authentication with ...

1 2 3
4
5
8