Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [oauth]

OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

Filter by
Sorted by
Tagged with
0 votes
0 answers
11 views

Can I store subject from a JWT from an external auth server in my DB?

We are retrieving external users using OpenID with the PKCE flow. We are using the JWT returned from the auth server to authenticate the user. If it is valid, we extract the subject field from the ...
user avatar
  • 101
0 votes
0 answers
17 views

Oauth 2.0 current best practice for SPA and backends

I want to build a application which having following architecture: According to the BCP, I am going to implement Authorization Code Flow with PKCE. I am wondering: Do I need to implement a separate ...
user avatar
0 votes
1 answer
58 views

Voice input as security measures for system authentication

Can voice input as password could be a useful security measure aa a alternative for strong password (Keyboard characters complex), biometric (face, thumb, signature etc)? The voice inputted as a ...
user avatar
3 votes
1 answer
122 views

Adding SSO to an existing website - should SSO login link to matching email address?

I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and ...
user avatar
0 votes
2 answers
51 views

Revoke all refresh tokens when account locked?

Scenario: a user enters his password incorrectly x times, so his account is locked for y minutes. Should I revoke all his refresh tokens? Problems: user is logged out of all devices, not just the one ...
user avatar
  • 333
0 votes
2 answers
105 views

Refresh token replay detection

I'm trying to detect refresh token reuse / replay. A typical approach: send refresh token (on login or refresh) create refresh token as opaque value (e.g. buffer from a CSPRNG) base64 encode value ...
user avatar
  • 333
1 vote
1 answer
66 views

Should refresh tokens be signed?

I'm not using an identity provider. I have a small system with access and refresh tokens and it works well. Assume the system follows the "typical" approach: when user authenticates or ...
user avatar
  • 333
0 votes
0 answers
25 views

Why can't an email or profile scope used to authenticate in OAuth?

I am trying to learn OAuth and I keep reading that "OAuth is only used for authorization." However, if you add an email or profile scope, doesn't that identify who the user is? So can it be ...
user avatar
0 votes
0 answers
71 views

Good practice for generating opaque access-token

Restrictions: Access token will be short lived (2 minutes) Access token will be one-time use only. Given a strong random algorithm, would it be considered good practice to generate an opaque access-...
user avatar
0 votes
0 answers
36 views

Is it ok to store user Refresh Tokens in Firestore?

I'm working with the Strava API, which uses OAuth. When the user authenticates my third party app, they are redirected to my application with a code querystring, which I can exchange with the Strava ...
user avatar
  • 101
0 votes
0 answers
38 views

Would having two identity providers prevent the theoretical possibility of impersonation by an IdP?

I am slowly accepting that OAuth2 is quite amazing, but I'm still worried about the fact that an IdP could theoretically impersonate me as discussed in Can an identity provider impersonate me? (Can ...
user avatar
  • 695
0 votes
0 answers
71 views

When using a cookie to header CSRF protection with JWTs, how to implement refresh tokens?

Scenario I'm working in the oAuth flow for a new app, which is currently laid out like this A React web App A Rails backend FusionAuth as an Authorization server We are using the oAuth2.0 ...
user avatar
0 votes
1 answer
72 views

Should a website ask me for my TOTP code, if I auth using OAuth?

I recently signed into an account on a website using my Google account. I already have an username+password account on the website, where I have also enabled 2FA with a TOTP code. Upon signing in with ...
user avatar
0 votes
0 answers
69 views

GitLab with api scope and confidentiality unchecked. What are the privacy risks?

I just created a GitLab application to connect it with StackEdit.io. I created it by following the instructions on this GitLab docs page. I had to create the GitLab application with api scope and I ...
user avatar
  • 101
0 votes
0 answers
54 views

Native client OAuth without API supporting PKCE

I have a native windows app that can connect to multiple external API's using OAuth (Authorization Code + PKCE). I store the refresh tokens locally encrypted with the Windows Data Protection Api. Now ...
user avatar
  • 101
0 votes
0 answers
99 views

Refresh token rotation or Authorization Code Flow with PKCE

In a new project, we try to clarify how authorization should look like. I've been reading up on this for days, but it's not really clear to me which solution would be the right one to use. Some ...
user avatar
  • 101
0 votes
0 answers
58 views

Working Code for Grant Negotiation and Authorization Protocol (gnap) for evaluation? Performance vs OAuth/OIDC

Understand that Grant Negotiation and Authorization Protocol (gnap) is still in draft status at the IETF. I am looking to evaluate GNAP and be the first to put in production. Are there any working ...
user avatar
1 vote
1 answer
269 views

Is OAuth2.0 Authorization Code Grant flow with PKCE really secure?

CONTEXT There is a SPA that uses Authorization Code Grant flow with PKCE to get info from an API all the info is highly sensitive RESEARCH Here is what I found of how Authorization Code Grant flow ...
user avatar
  • 143
2 votes
0 answers
154 views

Is it a good practice to store both the Google Oauth2 access token and the refresh token in the database un hashed?

I recently came across a source code where they save a user's refresh token and the access token upon sign in through Google into the database. This is done to access the Google APIs later on through ...
user avatar
  • 121
0 votes
0 answers
83 views

How to authenticate OAuth2 confidential client is making a REST call?

We are looking to implement some REST services to be called from partner servers (not end users via a browser). The out-of-the-box implementation seems to flow thusly: Partner server passes a client ...
user avatar
0 votes
1 answer
757 views

Implications of using a self-signed certificate to sign JWT tokens in OAuth

I'm looking to setup an integration between GitHub and Service Now and I can use OAuth2 using JWT Tokens, the steps to take can be found here. There is a specific step that states: Create a CA signed ...
user avatar
1 vote
0 answers
83 views

Where should I store an OAuth refresh token for a third party?

I am connecting to a third party which authenticates with OAuth2. Once the user has logged in, I want to store the access & refresh tokens for the user. Which is more secure & proper - to save ...
user avatar
  • 111
0 votes
1 answer
929 views

How is pop token more secure than bearer token?

I tried reading few articles, however I'm not able to understand the merit of POP over Bearer token. Bearer token if lost (during transit over the wire) can give the holder of the token same ...
user avatar
  • 141
1 vote
1 answer
115 views

Whose fault/bug is it in the below case?

Say there are 2 servers a.example and b.example. b.example uses 3rd party authentication from a.example via OAuth or other protocols. Now a user user1 with account xyz@a.example logs in and sets up a ...
user avatar
0 votes
0 answers
159 views

Redirection from backend with frontend using OAuth token with Cookie

Currently, Can you provide your suggestion, whether my below approach is good with security perspective. User clicks on login button which calls backend/api/login Step1 triggers the oauth flow and ...
user avatar
  • 101
1 vote
0 answers
103 views

Guessable oauth client id and phishing

OAuth manual advises that the client ID should not be easily guessable to decrease phishing attacks. https://www.oauth.com/oauth2-servers/client-registration/client-id-secret/ Is it still the case ...
user avatar
3 votes
0 answers
218 views

Should I build my own login functionality? [closed]

I've looked at various ways of logging in users and I'm wondering if I should write my own. There are a lot of third party solutions that make it easy and cheap to get started, like Amazon Cognito and ...
user avatar
4 votes
1 answer
299 views

Security risks of OAuth vs a password manager

Of the following two approaches, which is "more secure", under which circumstances, and why? In other words, please compare the security risks of these two approaches: Log in to an OAuth ...
user avatar
  • 181
2 votes
0 answers
75 views

Entering password on third party websites to enable integrations

I've got a third party service that I want to integrate with various other websites/applications, the third party service says they support this however rather than using an API key or OAuth to ...
user avatar
  • 121
1 vote
3 answers
259 views

Is OAuth more secure compared to API Keys

I have worked on many API integrations scenarios, and I used 2 approaches to authenticate the API calls, as follow:- Using API Keys For example inside hubspot integration i use this web call to get ...
user avatar
  • 131
1 vote
0 answers
133 views

OAuth for command line application

I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
user avatar
1 vote
0 answers
74 views

Isolating permissions available to browser JS via oauth and referer

This proposal concerns a strategy for isolating the permissions given to plugins in a plugin architecture. I'm looking for insight into whether this design can succeed in isolating those permissions. ...
user avatar
3 votes
2 answers
3k views

What are the advantages of using JWT over Basic Auth with Https?

As per my understanding both JWT and Basic Auth used to store login credentials on client side and avoid sessions for better scalability. I understand with Basic Auth login credentials will be sent ...
user avatar
  • 131
0 votes
1 answer
332 views

Is PKCE really protecting public facing clients? Can't a rogue app steal the ClientID and Secret and make a AuthCode request of its own?

From what I have understood, for public facing clients such as JavaScript apps that run on the browser or mobile apps which have no backend there is no secure place to store client id and secret. ...
user avatar
1 vote
1 answer
167 views

What are the best practices to create a safe and performant user registration and validation with Nodejs and Postgres? [closed]

I've been asked to write an app with registration and login systems. In essence, I've already wrote the first version of their app using PHP, some javascript/jquery and storing data in MySQL. It ...
user avatar
  • 111
2 votes
2 answers
146 views

Does signing in via OAuth 2.0 compromise account security if the OAuth 2.0 service decides to become malicious?

Say we signup and login to an OAuth 2.0 enabled security application called "AI Car Command Center" via Google OAuth 2.0 We then logout. Does Google then have the capability to then grant ...
user avatar
5 votes
2 answers
562 views

Why not use PKCE for backend apps, too?

So for SPA/frontend apps, you should be using PKCE these days for OAuth flow. But the backend apps have this additional complexity of having to have a secret key and use that key to talk to the token ...
user avatar
  • 171
0 votes
0 answers
113 views

Delegating to multiple auth providers from a single page application

Consider a use-case in which a single page application using an OAuth identity flow has to use one of many possible identity providers, as determined by what user is logged in. More specifically, I ...
user avatar
  • 123
1 vote
0 answers
70 views

Should I consider migrating away from OAuth 2.0 Implicit Flow for an internal application relying on Azure AD?

I have recently migrated an internal application (API + SPA) security from Windows Authentication (done by IIS) to Azure A/D authentication using the implicit flow. Now, every user must enter an e-...
user avatar
  • 2,183
1 vote
0 answers
71 views

Why do some "OAuth" providers ask for personal info?

I don't mean to start another OAuth vs OpenID discussion, but I want to share the underlying cause of my confusion. When I want a Client to process my google docs for something, I have to go through ...
user avatar
2 votes
2 answers
555 views

How could a server to server rest api communication be more secure, by using OAuth 2?

I created a large backend+frontend project for a client. They recently started a different project, and contracted an other company to develop and host it. Since they need some of the data from my ...
user avatar
  • 183
0 votes
2 answers
183 views

I found that I could delete the state parameter in an OAuth request and the response was validated and e-mail was still verified

I was fiddling around with an OAuth2.0 request on burpsuite and I found that it validated the account even after I deleted the state parameter completely and forwarded the request through burpsuite. I ...
user avatar
3 votes
1 answer
1k views

Propagating user context between microservices secured with M2M JWT tokens

We have a current microservice architecture where we secure communication between microservices via Machine-To-Machine access tokens (these tokens are obtained using the Client Credentials grant flow)....
user avatar
  • 151
2 votes
0 answers
519 views

Keycloak and Open ID Connect best practices

I'm a bit lost as to the best practice surrounding a production-ready access management based on keycloak and open id connect. My understanding is that if you use Keycloak's provided adapters, instead ...
user avatar
  • 21
0 votes
1 answer
101 views

Benefits of Token Exchange protocol

Beginner question here, I don't seem to be able to wrap my head around the security benefits of the token exchange protocol as specified by RFC8693. To me it seems like a delegation pattern where a ...
user avatar
  • 101
0 votes
1 answer
255 views

Logout on OIDC Provider Refresh Token validity in comparison to OAuth

I have an Relying Party that has obtained an Access Token and Refresh Token (as well as an ID Token) from an OpenID Provider (not an offline token). In all cases I have seen, the Refresh Token is ...
user avatar
  • 502
4 votes
1 answer
1k views

Why is SAML still used for enterprise SSO instead of OIDC?

Im trying to wrap my head around the difference between SAML/OIDC/and OAuth Is the only reason SAML is the most popular choice for enterprise SSO that its been around much longer? Is it expected to ...
user avatar
0 votes
0 answers
90 views

Twitter OAuth signing process explanation

I was going through this process https://developer.twitter.com/en/docs/authentication/oauth-1-0a/obtaining-user-access-tokens and there are two points that do not make clear sense to me: Step 1: POST ...
user avatar
0 votes
1 answer
158 views

Best practices for generating and storing authorization codes and access tokens in OAuth server

I've recently implemented an OAuth server functionality to our service. I've consulted OAuth 2.0 Threat Model and Security Considerations and addressed most of the concerns. I am curious about any ...
user avatar
0 votes
0 answers
95 views

Oauth2: should I increase the refresh token expiring date?

I want my clients to be able to schedule a purchase for a given date. When they perform this scheduling action, they are authenticated with an oauth2 token. However the date could be so far from now ...
user avatar
  • 21

1
2 3 4 5
11