Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [oauth]

OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

1
vote
1answer
69 views
+50

Invalidate API tokens when LDAP user is invalid

I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below. User sends LDAP username and password (with password grand type) to the server. Server ...
0
votes
0answers
67 views

Alternative OAuth 2 flow?

I have an implementation of the OAuth 2.0 authorization code flow, but I'm wondering if I can securely introduce a new flow. I'd like a flow that doesn't require the resource owner to ever need to ...
2
votes
1answer
67 views

OAuth: how to prevent phishing with malicious redirect URIs

To quote the OAuth spec: If the resource owner denies the access request or if the request fails for reasons other than a missing or invalid redirection URI, the authorization server informs the ...
3
votes
0answers
36 views

Architecting a solution with native login and 3rd party login via OAuth/OpenID Connect using dotnet core

I am building an API driven application that will have a native login with username and password, and will also need to grant 3rd party access via OAuth/OpenID Connect in the near future. A pattern I ...
1
vote
0answers
29 views

Did I get it right? OAuth2, OpenID and OpenID Connect

After a lot of research about authentication and authorization, I reached the following but not sure if what I reached is the correct thing so please help me out: Authentication is who you are. ...
0
votes
1answer
52 views

Is it safe to just forget OAuth tokens, and not invalidate them in a mobile app?

I have a mobile application that a user signs into using OpenId Connect and OAuth 2.0. Currently when the user logs out, I open up a webpage to the end_session_endpoint (http://docs.identityserver.io/...
4
votes
0answers
44 views

Poor Man's OAuth Grant - Review

A 3rd party company has requested that we implement single sign-on with them using the below approach. I'm familiar with OAuth grants and OIDC flows but this seems rather odd to me. The user has ...
1
vote
2answers
105 views

How do I back up YubiKey-backed TOTP authentication?

I bought a YubiKey 5 NFC this week and have started using 2FA and U2F where I can but am deathly allergic to the idea of losing access. For backing up U2F access I'm going to buy a second U2F token (...
1
vote
0answers
76 views

Using Google Authentication with Lambda@Edge and S3 Static Sites

I am looking to set up authentication on an S3 hosted static site. The configuration is: S3 bucket configured to allow access via cloudfront AWS Cloudfront distribution with HTTPS configured and a ...
1
vote
1answer
56 views

OAuth 2 state token and protect CSRF

We are trying to build a set of REST APIs which will be authenticated by using attached ID token generated by an OAuth provider. I am trying to understand how to use the state token passed in with ...
1
vote
0answers
18 views

Securing internal API credentials on a public chrome extension

I've developed a Chrome extension that I plan to publish to the Chrome Web Store. On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...
1
vote
0answers
23 views

When is OAuth1 preferred over OAuth2

Scenario: I need to build a new API for a third party company who are building a tool to capture information of new users wishing to create accounts on our enterprise platform. -x- My preferred ...
1
vote
3answers
133 views

How Secure is OAuth2 for Web Applications?

Let’s consider a single page client side application, developed using HTML and Javascript. In this case, even if the implicit or authentication code flow is being used to request Access Tokes, still ...
1
vote
0answers
134 views

OpenID connect authentication with cookie authentication middleware [Asp.Net MVC ]

In my ASP.NET MVC based application I am using 'OpenID connect authentication' middleware with 'cookie authentication middleware' (session/transient cookie). While accessing the application I ...
2
votes
1answer
46 views

Is it secure to handle the OAuth 2 Authorization callback from a CDN?

This question is in the context of the OAuth 2.0 Authorization Framework. Consider a web application that is backed by a first-party API but relies on a third-party authorization server for SSO. Say ...
0
votes
0answers
17 views

implementing push api for files using oauth2

i want to implement a push api similar to Garmin Connect API. this api allows the clients to get the data of garmin users, as garmin will push to the clients the user's files whenever created. we ...
1
vote
1answer
90 views

JWT access tokens: Too much information?

I've recently encountered the practice of systems using JWTs as Access Tokens. I have a concern and I'm not sure if it's unfounded: I associate JWTs with the OpenID Connect protocol, where there are ...
2
votes
4answers
141 views

How can a OAuth2 resource server relate an access token to the user that authorized it to prevent unauthorized access to other user resources?

I'd appreciate if someone could clear up if, according to the OAuth2 RFC, the resource server could infer the user associated to an access token or not, or even if that is expected. Let’s assume the ...
4
votes
1answer
85 views

How do I implement a Microsoft Login into my own website? [closed]

I am trying to make a website, which hosts a form for employees to enter their shift details into. The website itself is pretty basic, meaning it is mostly just HTML and PHP code. Obviously I need to ...
1
vote
1answer
91 views

What are the risks of using OAuth for authentication when in control of both ends?

I recently discovered that the applications in our system used plain Oauth2 instead of OpenID Connect to authenticate users. The original use-case was to use OAuth to allow our users to authenticate ...
2
votes
0answers
147 views

How to provide granular API security using OAuth scopes and claims

I'm trying to work out how best to secure an API using oAuth scopes and/or claims. I'm unsure on which I should be using. My setup is as follows: All users sign in to signin.domain.com There are ...
4
votes
1answer
289 views

Can oauth2 “state” parameter be used to avoid using session cookies to identify user

https://tools.ietf.org/html/rfc6749#section-4.1.1 states: 4.1.1. Authorization Request" "state" RECOMMENDED. An opaque value used by the client to maintain state between the ...
2
votes
1answer
114 views

Is OAuth appropriate for a private API to be used by registered customers?

I am developing a private API that will be used by pre-registered clients to access information on our website. We will be storing their login credentials on our server. When looking into how to ...
0
votes
2answers
66 views

App hosted Oauth login pages: what stops forgery?

I've been thinking about Oauth login which works wonderfully for websites in general. However these login types are becoming more prevalent in apps, both desktop and mobile. In these situations often ...
1
vote
1answer
306 views

OAuth 2 Implicit grant type for first party SPA - Most secure and sensible way

My aim is to secure my stateless API and only allow the registered first-party clients (SPA) to consume my resources. There is not going to be any third party clients in my scenario. I know Oauth 2 ...
0
votes
1answer
57 views

Where to save the token information?

I'm currently working on an end user Windows 10 application using the Microsoft UWP platform. Within this application the end user will be able to authenticate themselves using an oauth2 SSO service. ...
2
votes
1answer
70 views

How to properly deal with different user-facing login mechanisms?

I'm wondering if it's possible to deal with a login mechanism that is dependent on the user identifier. For example, the user can have access using OpenId, OAuth or token. But how can we "help" the ...
0
votes
1answer
214 views

What are the risks in specifying localhost as an “Authorized Javascript origin” in an OAuth configuration

My application uses Google's OAuth for authenticating users. For development/debugging purposes I want to be able to run it locally (on my dev. machine). To have the OAuth login functionality work in ...
3
votes
1answer
94 views

Google login button - what prevents an rogue app from stealing a token?

Here are steps to setup a Google login button on a web client: https://developers.google.com/identity/sign-in/web/sign-in When click on the Google login button this pops up: All the interactions are ...
1
vote
1answer
283 views

How to store an user access token on a third party site in the front end

I am working on a wordpress plugin that provides a comment thread system kind of like disqus (but different). In order to login (to post comments) the workflow is like this : User clicks on log-in ...
0
votes
1answer
77 views

Why should I trust the OAuth Providers? [duplicate]

I am trying to understand how OAuth really works. So far I understood the workflow of the authentication process, but I don't get why it is that safe to use a third party OAuth provider. I mean they ...
1
vote
0answers
46 views

Single-Page Application authentication and ISO 27001

I have a single-page javascript application that communicates with a .NET API running in IIS. Authentication is done after loading the application frontend, using an OAuth token from Office 365, ...
1
vote
0answers
44 views

Parent domain cookies for Single Sign on

Typically Single Sign On is implemented with existing protocols like SAML or OAuth. If all the sites belongs to the same parent domain such as a.example.com and b.example.com, we can also set a ...
2
votes
1answer
88 views

Is it safe to keep a hardcoded oAuth token on an app built solely for personal use?

I've built an android app that is only ever going to be used by me. It's not deployed to the store or anything - I download it to my phone with HockeyApp. However, this app has an oAuth token ...
0
votes
0answers
22 views

Why is auth_code server over redirect URI than on a webpage in OAuth 2.0?

Per three-legged OAuth standard, an auth_code is served as an URL parameter, while the URL being the redirect_uri specified during client registration. I guess it's an HTTP 302 response sent by the ...
2
votes
2answers
1k views

OAuth - How does the Resource Server validate the access token is not for any other Resource Server?

Let's take an example where there are two resource servers - RS1 and RS2 and there is one authorization server - AS. Both resource servers - RS1 and RS2 use authorization server - AS If a client ...
0
votes
1answer
460 views

Avoid brute force attacks on oAuth authorization server

I've been looking into the oAuth 2 authorization framework for a while now. Yesterday I started wondering how to prevent a brute force attack during the Authorization Code Grant flow (https://tools....
5
votes
1answer
265 views

Need of scope in OAuth Client Credentials Flow

For me, Client Credential flow is like client is asking access token for itself - not on behalf of some user. Then, why would client like to limit its own scope? What is the benefit of scopes in ...
2
votes
1answer
434 views

Why CORS preflight is not available for POST requests when Content-Type is application/x-www-form-urlencoded

In oauth2 for single page application(SPA), we can revoke the access tokens of the implicit grant type by using an ajax request(this is not recommended now). I tried to do a request like below from ...
0
votes
0answers
211 views

oAuth vs. Basic Authentication to connect to Azure AD backed services via Daemon/Service Application

I'm creating app that will run as an automated service with no user interaction to process to connect to a mailbox and process emails (download attachments, move emails to a "processed" folder, etc.). ...
2
votes
1answer
90 views

Why can't the client server speak directly to an identity provider like Facebook in OAauth 2.0

OAuth 2.0 used for authentication by Google makes sense given that the server and client both trust Google but not each other. As I understand the authorization code is passed back to the server (in ...
1
vote
1answer
699 views

OAuth2 for mobile apps with confidential backend client (Is PKCE required?)

I'm wondering why neither rfc6749 nor rfc8252 seem to consider the case where the mobile app does not make protected resource requests (and is therefore not a client) but instead relies on a backend ...
1
vote
0answers
300 views

machine to machine authentication secret

For machine to machine communication (embedding other applications in applications etc.) we often face the problem that the site we're embedding requires a username and a password to authenticate. The ...
0
votes
1answer
81 views

Do I need to create a user in my database?

I am building a web app, which uses a backend WebApi (requiring authorized users). The system simply stores some input from the user similar to a post on facebook. The front end (Angular) allows only ...
3
votes
1answer
56 views

How does security work in a cloud-to-cloud backup scenario?

I'm thinking of using Spinbackup which is a cloud-to-cloud backup of gmail, but I was resistant to the idea of telling Spinbackup my gmail password for obvious reasons. However, on the Spinbackup ...
3
votes
0answers
2k views

Are JWT refresh tokens in browser really that bad?

Note: I fully acknowledge there may be something I'm missing in the picture, which is part of my reason for posting. I'd like to get the opinion of people more experienced than I am on authN/Z related ...
1
vote
1answer
185 views

Why using oAuth2 refresh token is more secure then regenerate an access_token?

I'm implementing an oAuth2 authentification to secure my REST Api. As I am implementing oAuth2, I need to generate an access_token which will give me a temporary access to my REST datas. To do it, I ...
2
votes
1answer
145 views

Why was pseudo-authentication using OAuth more successful than actual authentication using OpenID?

A few years ago, OpenID was nearly everywhere, with support from what are currently the major OAuth providers -- Google, Facebook, and even Yahoo all provided OpenID authentication. Since then though,...
18
votes
3answers
4k views

Why isn't PKCE encouraged for Single-Page Apps?

A lot of services today still recommend the implicit flow for an OpenID Connect/Oauth2 token exchange when developing Single-Page Apps. (See Okta, Google, Auth0) Some newer guidance out there points ...
0
votes
1answer
52 views

Creating a 3rd party tool that requires a user's auth token for the service

I want to scrape data from Fanball.com to keep track of the fantasy football players that I have drafted, and create a visualization of my exposure to different players. This is a tool that I have ...