Skip to main content

Questions tagged [oauth]

OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

Filter by
Sorted by
Tagged with
1 vote
1 answer
131 views

Security doubts around the refresh token and how it works

I am trying to understand how refresh tokens and access tokens works, and I ready several threads and documentations. It seems that I am not the only one confused around this topic. Based on this ...
anonymous's user avatar
0 votes
0 answers
55 views

Saving access and refresh tokens securely

I have a mobile and backend applications. And I am trying to communicate with Microsoft Graph API and I obtain access and refresh tokens through their OAuth. I get these tokens from my mobile app at ...
wasilikoslow's user avatar
1 vote
0 answers
75 views

Risks with having a "localhost" service configured on a production SAML/OAuth/OIDC Identity Provider

To help developers with integrating with our SAML/OAuth/OIDC Identity Provider on their local dev environments, I'm thinking about configuring a demo client/app in our production IdP that has ...
xsrf's user avatar
  • 178
0 votes
0 answers
83 views

Is the OAuth client secret sent for every API call along with the access token?

Does the OAuth client attach the client secret along with the access token for each API call to the resource server ?
termcap's user avatar
  • 31
1 vote
2 answers
883 views

Do we really need refresh tokens?

I have read a number of posts of many people expressing their confusion around the extra security gained from using an access token and a refresh token to control access to a resource API. Picking up ...
ASP's user avatar
  • 119
1 vote
1 answer
182 views

why was implicit flow conceived?

The OAuth2.0 Implicit Flow allows to obtain an Access Token directly with just one call to the Authorization Server (AS), without the need of a second POST request to the same AS. According to this ...
zer0uno's user avatar
  • 113
0 votes
2 answers
506 views

can we use access token as session cookie in browser? and how to protect it?

The scenario is: you have refresh token that is valid for a longer period of time and an access token that is valid for a shorter period of time. The setup: There is a client, application server and ...
Illakiya 's user avatar
1 vote
0 answers
88 views

Can OpenID session_state be sent on POST? [closed]

We have a situation of the session_state param on an OpenID Connect/Oauth app is sent on GET. We asked the developers to send it on POST. Developers claim that because standard OIDC/OAuth use 302 ...
ZDD's user avatar
  • 11
0 votes
0 answers
145 views

Mtls in Google Cloud pub/sub oauth 2.0

I am trying to ascertain if Google Cloud Pub/Sub supports OAuth 2.0 with Mutual TLS (mTLS). Despite conducting an internet search, I couldn't find any pertinent information regarding mTLS support (it ...
SempriGno's user avatar
0 votes
1 answer
111 views

Isn't there a critical built-in vulnerability in OAuth's Implicit flow?

I've read some blogs and did some labs regarding OAuth's implicit flow, but it seems to me everyone just turn a blind eye to a very critical point in the flow. Assuming that site A uses the implicit ...
Trigosin Darom's user avatar
-2 votes
2 answers
131 views

Should standard OAuth endpoints/configuration files be kept private?

Considering an attacker may be able to leverage the information gathered from standard endpoints/configuration files such as /.well-known/oauth-authorization-server and /.well-known/openid-...
registry4059's user avatar
0 votes
0 answers
127 views

URLs in JWT scope

During a pentest I have found a JWT that seems to be a refresh-token issued by some IAM software. The scope field in the JWT lists all the applications as URLs that this token can be used to obtain ...
John Nemo's user avatar
1 vote
1 answer
339 views

Why don't bank verification services use OAuth

I'm going off of this answer, but asking a new question since that's quite old. It seems to be becoming more common for banks or other "legitimate" institutions to want your banking username ...
Silvio Mayolo's user avatar
0 votes
0 answers
67 views

How can client credential authorisation work for multiple clients in an IAM system?

I have an IAM system where each entity entry for client credential flow will be associated with a tenant. I have two scenarios: one client app that can access target entity to access only client ...
rishi s's user avatar
0 votes
0 answers
190 views

Is there a benefit to validate the signature in an OAuth Authorization Code Flow?

We're utilising OAuth's Authorization Code Flow to authorize the user for an internal action within the application, as opposed to handing off the access token to a separate API. Under normal ...
dlanod's user avatar
  • 101
0 votes
0 answers
1k views

Strong reason to not send refresh token on every request?

I'm creating a backend that supports authentication with JWT tokens. I'm using the classic access token / refresh token combo. the access token is valid for 5 minutes and allows the users to perform ...
Rififi's user avatar
  • 157
1 vote
3 answers
189 views

Security implications of using the current session to mint new access tokens

I saw a setup recently where frontend and resource servers were hosted on subdomains of the same second level domain. E.g. ui.example.com and api.example.com. It had an interesting authentication flow ...
Packager's user avatar
0 votes
1 answer
253 views

What does it mean if StackOverflow received OAUTH to access my GitHub account through the GitHub API?

I did not personally authorize StackOverflow to access my personal GitHub account through GitHub API, so what could this possibly mean?
EricBalingit's user avatar
0 votes
1 answer
440 views

Bearer JWT client authentication and access token issued by authorization server

An authorization server issues an access token with issuer details which are exposed in a well-known API of that server. This server uses client authentication JWT tokens with clients configured. ...
user890234's user avatar
1 vote
1 answer
399 views

How do I best share a shared account's private key?

I made a website which among other things allows users to sign up to events. The HTML form is filled out and submitted, which automatically updates a google spreadsheet with all applications. This of ...
RattatAndyGo's user avatar
3 votes
1 answer
302 views

Oauth: redirect uri validation [duplicate]

As per the below resource: https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uri-validation/ we should validate the redirect url at 3 points: at time of app registration when the auth flow ...
gaurav5430's user avatar
2 votes
2 answers
856 views

Oauth: native UI for internal / first party apps

We have an oauth implementation, which was chosen because of the following reasons: session sharing across different applications easy to reason about the security considerations as oauth is well ...
gaurav5430's user avatar
2 votes
1 answer
1k views

Using CSRF token as state parameter for OAuth request

I recently completed Azure OAuth2 integration with my existing web application. Upon user's successful login into my application user can configure multiple outlook accounts using OAuth2 flow. As for ...
Amogh's user avatar
  • 123
1 vote
0 answers
106 views

SSO and/or JWT: make sure web app's endpoints are protected

Let's say I'm building a web application (let's focus on the backend side) that is B2C. Users should be able to register with my application, using a SSO provider like Google or Facebook. Once they're ...
Rififi's user avatar
  • 157
1 vote
2 answers
416 views

If I login to a mobile/web app with a Google account, what stops the developer also using that account?

I have an admittedly-vague understanding of how OAUTH works, but I recently went through the rigmarole of installing rclone and having it sync some files from my Google Drive to my Linux laptop. As ...
jimbobmcgee's user avatar
0 votes
0 answers
415 views

Personal Access Tokens vs OAuth

We want users of our service to be able to write programs/scripts that act on their (i.e. the user's) behalf. I've seen various services (github, digital ocean, gitlab) use Personal Access Tokens (...
Sam's user avatar
  • 1
0 votes
1 answer
715 views

OAuth2: Is PKCE required if the callback is located in the backend?

This is the architecture I want to follow Source: https://stackoverflow.com/questions/73075156/what-exactly-is-redirect-uri-in-google-oauth2-request-for-getting-authorization I'm using a backend to ...
MrRobot9's user avatar
  • 103
2 votes
1 answer
551 views

How does microsoftonline.com know which device I am on, and whether it is a registered device?

Most of the webprogramming and IT security I know is from ten years ago. I'm far from being a pro, so please keep my ignorance in mind when answering. Back then, browsers sometimes sent details about ...
Mads Skjern's user avatar
0 votes
0 answers
595 views

Oauth: Authorizing multiple clients at once

I have an application where the frontend app talks to 2 set of API servers: be1.domain.com and be2.domain.com both these servers are independent entities (they do share the same top level domain, in ...
gaurav5430's user avatar
0 votes
0 answers
92 views

How to handle the Oath2.0 credentials in the APK files

These days, mobile apps commonly leverage Oauth /OpenIdConnect-based authentication and authorization frameworks. To achieve this, the Oauth clients (the App running on android/IOS) must have a few ...
user1493834's user avatar
2 votes
2 answers
720 views

OAuth2 public clients cant use client secret and still achieve a secure workflow, why is it used for confidential clients?

In an OAuth2 authorization flow, if I understand correctly the request made to receive a token with PCKE is almost identical between that of a public client and that of a confidential client. The only ...
Jeremy F's user avatar
  • 121
1 vote
2 answers
207 views

Using oauth for authentication

I understand that oauth is an Authorization protocol, but it is possible to use it for authentication when clubbed with something like open ID Connect. I am trying to understand why do we need an ...
gaurav5430's user avatar
2 votes
1 answer
4k views

Why do big sites use cookies and not OpenID connect?

As I understand it, OAuth is the natural evolution of authentication protocols I understand in a general way that evolution is as follows: basic authentication cookies tokens, at this point you want ...
user60108's user avatar
  • 187
4 votes
1 answer
489 views

Would token expiry have prevented the GitHub stolen OAuth token attack?

In April 2022, GitHub suffered an attack involving stolen OAuth tokens: Security alert stolen oauth user tokens. Github stolen oauth tokens used in breaches. Interestingly, GitHub OAuth tokens have ...
Colonel Panic's user avatar
1 vote
2 answers
1k views

Is it safe to use email from OAuth for authentication?

I am implementing OAuth (more specifically "Sign in with Google") for a website that has been using only email and password for years. Now the guide that I'm reading suggests to read the uid ...
collimarco's user avatar
6 votes
2 answers
992 views

Adding SSO to an existing website - should SSO login link to matching email address?

I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and ...
Jordan Rieger's user avatar
0 votes
2 answers
383 views

Revoke all refresh tokens when account locked?

Scenario: a user enters his password incorrectly x times, so his account is locked for y minutes. Should I revoke all his refresh tokens? Problems: user is logged out of all devices, not just the one ...
lonix's user avatar
  • 445
1 vote
2 answers
1k views

Refresh token replay detection

I'm trying to detect refresh token reuse / replay. A typical approach: send refresh token (on login or refresh) create refresh token as opaque value (e.g. buffer from a CSPRNG) base64 encode value ...
lonix's user avatar
  • 445
1 vote
1 answer
995 views

Should refresh tokens be signed?

I'm not using an identity provider. I have a small system with access and refresh tokens and it works well. Assume the system follows the "typical" approach: when user authenticates or ...
lonix's user avatar
  • 445
0 votes
0 answers
135 views

Why can't an email or profile scope used to authenticate in OAuth?

I am trying to learn OAuth and I keep reading that "OAuth is only used for authorization." However, if you add an email or profile scope, doesn't that identify who the user is? So can it be ...
user1164937's user avatar
0 votes
0 answers
458 views

Good practice for generating opaque access-token

Restrictions: Access token will be short lived (2 minutes) Access token will be one-time use only. Given a strong random algorithm, would it be considered good practice to generate an opaque access-...
MatthewAws's user avatar
1 vote
1 answer
178 views

Should a website ask me for my TOTP code, if I auth using OAuth?

I recently signed into an account on a website using my Google account. I already have an username+password account on the website, where I have also enabled 2FA with a TOTP code. Upon signing in with ...
MortenMoulder's user avatar
5 votes
1 answer
1k views

Is OAuth2.0 Authorization Code Grant flow with PKCE really secure?

CONTEXT There is a SPA that uses Authorization Code Grant flow with PKCE to get info from an API all the info is highly sensitive RESEARCH Here is what I found of how Authorization Code Grant flow ...
Ger's user avatar
  • 193
2 votes
0 answers
540 views

Is it a good practice to store both the Google Oauth2 access token and the refresh token in the database un hashed?

I recently came across a source code where they save a user's refresh token and the access token upon sign in through Google into the database. This is done to access the Google APIs later on through ...
THpubs's user avatar
  • 121
0 votes
0 answers
127 views

How to authenticate OAuth2 confidential client is making a REST call?

We are looking to implement some REST services to be called from partner servers (not end users via a browser). The out-of-the-box implementation seems to flow thusly: Partner server passes a client ...
Matthew McPeak's user avatar
0 votes
1 answer
3k views

Implications of using a self-signed certificate to sign JWT tokens in OAuth

I'm looking to setup an integration between GitHub and Service Now and I can use OAuth2 using JWT Tokens, the steps to take can be found here. There is a specific step that states: Create a CA signed ...
user1876202's user avatar
1 vote
0 answers
244 views

Where should I store an OAuth refresh token for a third party?

I am connecting to a third party which authenticates with OAuth2. Once the user has logged in, I want to store the access & refresh tokens for the user. Which is more secure & proper - to save ...
be2213444's user avatar
  • 111
0 votes
1 answer
4k views

How is pop token more secure than bearer token?

I tried reading few articles, however I'm not able to understand the merit of POP over Bearer token. Bearer token if lost (during transit over the wire) can give the holder of the token same ...
Gopal's user avatar
  • 141
1 vote
1 answer
149 views

Whose fault/bug is it in the below case?

Say there are 2 servers a.example and b.example. b.example uses 3rd party authentication from a.example via OAuth or other protocols. Now a user user1 with account [email protected] logs in and sets up a ...
Aditya Jha's user avatar
2 votes
0 answers
198 views

Guessable oauth client id and phishing

OAuth manual advises that the client ID should not be easily guessable to decrease phishing attacks. https://www.oauth.com/oauth2-servers/client-registration/client-id-secret/ Is it still the case ...
Stanislav Berkov's user avatar

1
2 3 4 5
11