Questions tagged [oauth]

OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

Filter by
Sorted by
Tagged with
2
votes
1answer
38 views

OIDC/OAuth2 id_token and it's usage in the client application

I've recently migrated my application to use external provider for login so that my application doesn't have to deal with auth and storing user credentials. For this I'm using OpenID Connect (OIDC) ...
0
votes
1answer
57 views

OAuth2 - Sending a hash of your client_secret when using the client credentials grant instead of the secret

I'm working on an API that I'd like to be accessible internally by other servers as well as devices that I consider both as confidential private clients. Devices are considered private clients because ...
0
votes
0answers
53 views

How to ensure your own native app is talking to your own API [duplicate]

I'm developing an API and different apps to access to it, each with different scopes, including a native mobile app, and I'm wondering what would be a good strategy to authenticate my own native app ...
0
votes
0answers
55 views

Authorization Code Grant Flow for web-app with backend on separate domain (same origin)

We have had a security consultant make a recommendantion of an approach that does not follow the IEFF best-practice document (https://tools.ietf.org/html/draft-ietf-oauth-browser-based-apps-04#section-...
0
votes
1answer
51 views

Authentication for server to server api

I want to design an api which an organization is going to use to connect with my server. For a client-server application, a simple jwt-based authentication is done by verifying user credential and ...
0
votes
1answer
50 views

Combining User Context in Machine-2-Machine OAuth2 Client Credential Flow

I have a REST API that is used by 2 separate application and is authenticating them by M2M OAuth2 Client Credential Flow. One of the two application is an automation service without user context. The ...
0
votes
1answer
55 views

OAuth provider that authenticates only by phone? [closed]

I'm trying to find an OAuth provider that doesn't require a password but instead, it authenticates the user by sending a message to a phone number. I'm thinking that it would be using the phone the ...
0
votes
0answers
56 views

Google's “Cross-client identity” seems unsafe

From Google's Cross-client identity document: Cross-client access tokens [...] The effect is that if an Android app requests an access token for a particular scope, and the requesting ...
1
vote
2answers
74 views

What is the purpose of the OAuth2 client secret?

A typical OAuth2 Authorization Code Flow scenario looks like this: What I'm not understanding is the purpose of the client secret in steps 6 and 7. If the auth server is guaranteed to redirect back ...
0
votes
1answer
61 views

Is it secure to use only the access token?

I'm using JWTs for authenticating users for my mobile and web applications in the same API.Both access_token and refresh_token have same expiration Passport::tokensExpireIn(now()->addHours(1)); ...
1
vote
2answers
91 views

Anything wrong with using IMAP as authentication for a web app to achieve a kind of easy SSO?

The idea would be to wrap a server-side IMAP client in a wrapper that transforms IMAP authentication into a web API for authentication (maybe OAuth?). When the back-end application receives ...
0
votes
0answers
47 views

Inverse of Third Party Authentication

Consider this scenario. I have a file hosted on AWS with private access. I want the file to be accessible to several authorized users of a web applicaton that I have built. As I am the one ...
1
vote
4answers
195 views

Why is it (considered) more secure to enter a password in an authentication/identity service instead of custom app login?

I'm developing an app that will require users to authenticate via their Azure AD account. Customer would like a branded, custom UI, including the login screen. The current library for Azure AD ...
1
vote
1answer
173 views

Does OAuth 2 increase the risk for clients to expose their “client_secret”

Upon doing a bit of research about the OAuth protocol, I find it hard to avoid the glaring criticism of the OAuth 2 standard, and its supposedly inferior security. An answer on stackoverflow suggests,...
2
votes
1answer
87 views

What is the purpose of the authorization code in OAuth 2? [duplicate]

Why do we need to ask the authorization server for theAuthorization code and then exchange the Authorization code for anAccess token on the same server? Why not to return anAccess token directly, ...
3
votes
1answer
90 views

How exactly do mobile apps achieve authorization code flow with PKCE?

Let's imagine the following: I've developed a mobile app using Xamarin (iOS/Android compatible) I want it to support OAuth2 + OpenID connect's authorization code flow with PKCE, so that the user's ...
2
votes
0answers
49 views

Shopify OAuth: State parameter useful when the auth server also returns a signed shop id?

Background: I think I understand how the state parameter is used in oAuth to prevent CSFR attacks against the redirect_uri. Situation: I am looking at this in the context of implementing a Shopify ...
1
vote
1answer
43 views

When does OAuth re-authenticate users?

I assume OAuth protocol being something like this: user registers to Gitlab using Facebook (for example) Facebook asks if user accepts sharing profile info with Gitlab user accepts Gitlab receives ...
0
votes
0answers
52 views

SSO - How Auth Code flow with PKCE is secure?

I've run into this docs when I was studying some SSO concepts; This grant adds the concept of a code_verifier to the Authorization Code Grant. When the Client asks for an Authorization Code it ...
0
votes
1answer
292 views

Backend Authentication of Mobile App: Session ID vs. OAuth

Currently I am developing an iOS/Android app and a corresponding backend in PHP. In the last days I read a lot about user authentication and now I am a bit confused. For now I am using a session ID ...
6
votes
2answers
231 views

Usefulness of token sidejacking prevention mentioned by OWASP JWT Cheat Sheet

I was just reading through the "Token sidejacking" of the JWT Cheat Sheet of OWASP (https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet_for_Java.html#token-sidejacking) At the ...
1
vote
1answer
387 views

PKCE vs Client Secret

If I was developing a web app client that would be served statically, I would need to either use the implicit grant flow (which is no longer advisable) or use the authorization code grant flow with ...
1
vote
1answer
143 views

Is this private network authentication system secure?

I am building an authentication system to be used within a company's private network. I do not administer this network, and I know very little about the setup, but my basic understanding is you must ...
0
votes
1answer
49 views

What was the point of Implicit Grant Flow in OAuth 2.0?

I've read a lot about Implicit Grant Flow and when it should be used, but I can't wrap my head around a use case for where it would have made sense over the Authentication Code Grant Flow before PKCEs ...
3
votes
2answers
82 views

How do you know which site credentials are sent to when signing into Oauth site in native apps?

I sometimes use these features where I can use my Google account to sign in to different service providers. For example, the Postman app lets me sign in to it using either their own user store, or ...
1
vote
1answer
325 views

IN OAuth 2.0, how is the client secret supposed to be kept secret?

Using most OAuth 2.0 flows, a client application can identify itself to the authorization server by means of a "client id" and "client secret." The OAuth 2 specification says that the client secret ...
0
votes
1answer
246 views

Does PKCE replace state in the Authorization Code OAuth flow?

PKCE explanation: https://www.oauth.com/oauth2-servers/pkce/ OAuth Flow example: https://developer.okta.com/docs/guides/implement-auth-code-pkce/use-flow/ My question is more specifically: Is there ...
1
vote
1answer
61 views

Secure REST API that only works for users authenticated by App with SSO (OAuth?)

I somehow need to accomplish the following: User accesses a application written in JavaScript. Application uses SSO to identify the user who is logged into Windows. Application obtains the access ...
1
vote
1answer
430 views

What are the security implications using a Refresh Token in a SPA using Authorisation Code Flow + PKCE

I am considering moving my SPA from Implicit flow to Authorization Code + PKCE extension. This new flow will provide the SPA with a Refresh Token that doesn't expire. Let's say a malicious user on ...
0
votes
0answers
40 views

OAauth - Authorize Vs Token Routes

Although I read about the differences between the token route and the authorized route I am not sure exactly when I need to use them. If I understand correctly the /authorize will be used for clients ...
0
votes
0answers
34 views

OAauth - When To User Refresh Token?

I understand the role of refresh token but I'm not sure when it is enough to provide only access token and when need to provide both access token and refresh token? For example, if a user login to my ...
30
votes
6answers
5k views

The most secure way to handle someone forgetting to verify their account?

Suppose we send out email verification to new subscribers that where they have to click on a link to verify their account. Suppose they forget to verify it, and later try to login. Should the error ...
4
votes
3answers
708 views

Should a logout request be authenticated?

I have implemented access tokens and refresh tokens, without an auth server (my API server also does authentication). Access tokens: stored in the client (localstorage). Expire in 20 minutes. Refresh ...
0
votes
1answer
54 views

Why do we need token authentication?

If I'm creating an authorization service for my application, why can't I just hash the password and save the the username and hashed password in my User table? Why should I use a token authentication ...
1
vote
1answer
73 views

Which grant type : Implicit or Auth code (with No secret key) is suitable for Single Page Application(SPA)?

I went thru multiple posts saying how implicit grant is a security risk and why auth code grant with AJAX request to Authorization server should be used after redirecting to application (without ...
1
vote
3answers
121 views

Is it wise to completely rely OAuth2 for new users and not have our own login(with username and password) system

My question is: Is it fine to build applications where the user login is completely handled by OAuth2 and services like that. That way we do not have to have our own password database for the users. ...
1
vote
1answer
48 views

Securing implicit tokens (Example: Moltin)

I'm fairly new to security but I'm trying to understand how companies have their APIs set. One such case is Moltin's Implicit Token. Basically they provide you with a read-only (for the most part) ...
0
votes
2answers
137 views

How client-side OAuth is secure?

I want to make a static webpage, but secure it with a login. In order to do this, I looked at this link. Basically, I want users to log in their Google account to be able to view the webpage. But I ...
3
votes
1answer
365 views

Client id and secret as part of query parameter

In CA SSO client_id and Client_secret are passed as part of query parameter. is it secured to pass as part of query parameters? even though it's https my research on internet says it's not best ...
0
votes
0answers
198 views

OpenId Connect Authorization Code Flow in Microservice Scenario (API-Gateway?)

Im building a SPA with a couple of backend-microservices and i want to authenticate using OIdC. I'm aware of the fact that the implicit flow is not recommended anymore for this. So the recommended ...
5
votes
1answer
229 views

Can websites detect if visitors are logged in to mainstream ID providers and collect their IDs?

Logging in to websites using mainstream IDs (Google/Facebook/Github etc.) by means of OAuth (or similar) has nowadays become a feature that people expect. Not that long ago the corresponding user ...
2
votes
1answer
212 views

Why is there a redirect to the native app in PKCE?

Why even have a redirect or even use the browser? Wouldn't just a normal TLS/HTTPS request/response in the app protect the requests and token? The one argument I have heard against solely relying on ...
1
vote
1answer
429 views

How to get access token programatically when we try to authorize by grand_type auth-code in the OAuth 2.0 like a user?

There is a bank service that provides API to do some operations with bank accounts. To perform a request to all endpoints of this service I, first of all, need to get auth token via grand_type=...
1
vote
1answer
91 views

what is the scope of google drive's OAuth credentials?

I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
0
votes
0answers
78 views

How to prevent fake OAuth consent screens?

I can't find an answer to this simple question about delegated authorisation: When using a mobile app, how can a user be sure that a consent screen (let's say Google or Facebook) is a real one? The ...
0
votes
0answers
50 views

Does an OAuth1.0a HTTP GET endpoint in my API present a security vulnerability?

I'm building a hobby application, and I'd prefer it not end up on a cyber-security expert's list of insecure sites. My application can post to Twitter on behalf of a user. This required implementing ...
1
vote
2answers
291 views

Invalidate API tokens when LDAP user is invalid

I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below. User sends LDAP username and password (with password grand type) to the server. Server ...
2
votes
1answer
244 views

OAuth: how to prevent phishing with malicious redirect URIs

To quote the OAuth spec: If the resource owner denies the access request or if the request fails for reasons other than a missing or invalid redirection URI, the authorization server informs the ...
4
votes
0answers
57 views

Architecting a solution with native login and 3rd party login via OAuth/OpenID Connect using dotnet core

I am building an API driven application that will have a native login with username and password, and will also need to grant 3rd party access via OAuth/OpenID Connect in the near future. A pattern I ...
2
votes
1answer
285 views

Did I get it right? OAuth2, OpenID and OpenID Connect

After a lot of research about authentication and authorization, I reached the following but not sure if what I reached is the correct thing so please help me out: Authentication is who you are. ...

1
2 3 4 5
9