Questions tagged [oauth]

OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

Filter by
Sorted by
Tagged with
0 votes
0 answers
19 views

OAuth1 tokens: Is consumerToken and ConsumerSecret considered a secret value

I am using Oauth1 to connect to NetSuite Restlet API for multiple customers. To do so I make use of these values to authenticate and sign the request API URL (unique per customer) Realm (unique per ...
  • 119
0 votes
1 answer
196 views

Why do big sites use cookies and not OpenID connect?

As I understand it, OAuth is the natural evolution of authentication protocols I understand in a general way that evolution is as follows: basic authentication cookies tokens, at this point you want ...
  • 167
3 votes
0 answers
98 views

Would refresh tokens have prevented the GitHub stolen OAuth token attack?

In April 2022, GitHub suffered an attack involving stolen OAuth tokens: https://github.blog/2022-04-15-security-alert-stolen-oauth-user-tokens/ https://www.theregister.com/2022/04/21/github-stolen-...
0 votes
0 answers
16 views

Act as another google cloud platform user in a web app

I want to set up an OAuth2.0 flow on a web application for users that have access to GCP. The user will login to a web app. Then, the OAuth2.0 flow will need to ask for the consent that will allow the ...
  • 103
0 votes
2 answers
54 views

Is it safe to use email from OAuth for authentication?

I am implementing OAuth (more specifically "Sign in with Google") for a website that has been using only email and password for years. Now the guide that I'm reading suggests to read the uid ...
0 votes
0 answers
15 views

Can I store subject from a JWT from an external auth server in my DB?

We are retrieving external users using OpenID with the PKCE flow. We are using the JWT returned from the auth server to authenticate the user. If it is valid, we extract the subject field from the ...
  • 101
0 votes
0 answers
130 views

Oauth 2.0 current best practice for SPA and backends

I want to build a application which having following architecture: According to the BCP, I am going to implement Authorization Code Flow with PKCE. I am wondering: Do I need to implement a separate ...
3 votes
1 answer
153 views

Adding SSO to an existing website - should SSO login link to matching email address?

I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and ...
0 votes
2 answers
99 views

Revoke all refresh tokens when account locked?

Scenario: a user enters his password incorrectly x times, so his account is locked for y minutes. Should I revoke all his refresh tokens? Problems: user is logged out of all devices, not just the one ...
  • 363
1 vote
2 answers
271 views

Refresh token replay detection

I'm trying to detect refresh token reuse / replay. A typical approach: send refresh token (on login or refresh) create refresh token as opaque value (e.g. buffer from a CSPRNG) base64 encode value ...
  • 363
1 vote
1 answer
174 views

Should refresh tokens be signed?

I'm not using an identity provider. I have a small system with access and refresh tokens and it works well. Assume the system follows the "typical" approach: when user authenticates or ...
  • 363
0 votes
0 answers
40 views

Why can't an email or profile scope used to authenticate in OAuth?

I am trying to learn OAuth and I keep reading that "OAuth is only used for authorization." However, if you add an email or profile scope, doesn't that identify who the user is? So can it be ...
0 votes
0 answers
123 views

Good practice for generating opaque access-token

Restrictions: Access token will be short lived (2 minutes) Access token will be one-time use only. Given a strong random algorithm, would it be considered good practice to generate an opaque access-...
0 votes
0 answers
51 views

Is it ok to store user Refresh Tokens in Firestore?

I'm working with the Strava API, which uses OAuth. When the user authenticates my third party app, they are redirected to my application with a code querystring, which I can exchange with the Strava ...
  • 101
0 votes
0 answers
43 views

Would having two identity providers prevent the theoretical possibility of impersonation by an IdP?

I am slowly accepting that OAuth2 is quite amazing, but I'm still worried about the fact that an IdP could theoretically impersonate me as discussed in Can an identity provider impersonate me? (Can ...
  • 707
0 votes
0 answers
90 views

When using a cookie to header CSRF protection with JWTs, how to implement refresh tokens?

Scenario I'm working in the oAuth flow for a new app, which is currently laid out like this A React web App A Rails backend FusionAuth as an Authorization server We are using the oAuth2.0 ...
0 votes
1 answer
86 views

Should a website ask me for my TOTP code, if I auth using OAuth?

I recently signed into an account on a website using my Google account. I already have an username+password account on the website, where I have also enabled 2FA with a TOTP code. Upon signing in with ...
0 votes
0 answers
108 views

GitLab with api scope and confidentiality unchecked. What are the privacy risks?

I just created a GitLab application to connect it with StackEdit.io. I created it by following the instructions on this GitLab docs page. I had to create the GitLab application with api scope and I ...
  • 101
0 votes
0 answers
56 views

Native client OAuth without API supporting PKCE

I have a native windows app that can connect to multiple external API's using OAuth (Authorization Code + PKCE). I store the refresh tokens locally encrypted with the Windows Data Protection Api. Now ...
  • 101
0 votes
0 answers
163 views

Refresh token rotation or Authorization Code Flow with PKCE

In a new project, we try to clarify how authorization should look like. I've been reading up on this for days, but it's not really clear to me which solution would be the right one to use. Some ...
  • 101
0 votes
0 answers
62 views

Working Code for Grant Negotiation and Authorization Protocol (gnap) for evaluation? Performance vs OAuth/OIDC

Understand that Grant Negotiation and Authorization Protocol (gnap) is still in draft status at the IETF. I am looking to evaluate GNAP and be the first to put in production. Are there any working ...
1 vote
1 answer
375 views

Is OAuth2.0 Authorization Code Grant flow with PKCE really secure?

CONTEXT There is a SPA that uses Authorization Code Grant flow with PKCE to get info from an API all the info is highly sensitive RESEARCH Here is what I found of how Authorization Code Grant flow ...
  • 143
2 votes
0 answers
227 views

Is it a good practice to store both the Google Oauth2 access token and the refresh token in the database un hashed?

I recently came across a source code where they save a user's refresh token and the access token upon sign in through Google into the database. This is done to access the Google APIs later on through ...
  • 121
0 votes
0 answers
86 views

How to authenticate OAuth2 confidential client is making a REST call?

We are looking to implement some REST services to be called from partner servers (not end users via a browser). The out-of-the-box implementation seems to flow thusly: Partner server passes a client ...
0 votes
1 answer
1k views

Implications of using a self-signed certificate to sign JWT tokens in OAuth

I'm looking to setup an integration between GitHub and Service Now and I can use OAuth2 using JWT Tokens, the steps to take can be found here. There is a specific step that states: Create a CA signed ...
1 vote
0 answers
136 views

Where should I store an OAuth refresh token for a third party?

I am connecting to a third party which authenticates with OAuth2. Once the user has logged in, I want to store the access & refresh tokens for the user. Which is more secure & proper - to save ...
  • 111
0 votes
1 answer
1k views

How is pop token more secure than bearer token?

I tried reading few articles, however I'm not able to understand the merit of POP over Bearer token. Bearer token if lost (during transit over the wire) can give the holder of the token same ...
  • 141
1 vote
1 answer
115 views

Whose fault/bug is it in the below case?

Say there are 2 servers a.example and b.example. b.example uses 3rd party authentication from a.example via OAuth or other protocols. Now a user user1 with account xyz@a.example logs in and sets up a ...
1 vote
0 answers
116 views

Guessable oauth client id and phishing

OAuth manual advises that the client ID should not be easily guessable to decrease phishing attacks. https://www.oauth.com/oauth2-servers/client-registration/client-id-secret/ Is it still the case ...
3 votes
0 answers
234 views

Should I build my own login functionality? [closed]

I've looked at various ways of logging in users and I'm wondering if I should write my own. There are a lot of third party solutions that make it easy and cheap to get started, like Amazon Cognito and ...
4 votes
1 answer
347 views

Security risks of OAuth vs a password manager

Of the following two approaches, which is "more secure", under which circumstances, and why? In other words, please compare the security risks of these two approaches: Log in to an OAuth ...
  • 201
2 votes
0 answers
76 views

Entering password on third party websites to enable integrations

I've got a third party service that I want to integrate with various other websites/applications, the third party service says they support this however rather than using an API key or OAuth to ...
  • 121
1 vote
3 answers
299 views

Is OAuth more secure compared to API Keys

I have worked on many API integrations scenarios and I used 2 approaches to authenticate the API calls: Using API Keys For example inside Hubspot integration I use this web call to get all the ...
  • 131
2 votes
0 answers
186 views

OAuth for command line application

I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
1 vote
0 answers
74 views

Isolating permissions available to browser JS via oauth and referer

This proposal concerns a strategy for isolating the permissions given to plugins in a plugin architecture. I'm looking for insight into whether this design can succeed in isolating those permissions. ...
5 votes
2 answers
5k views

What are the advantages of using JWT over Basic Auth with Https?

As per my understanding both JWT and Basic Auth used to store login credentials on client side and avoid sessions for better scalability. I understand with Basic Auth login credentials will be sent ...
  • 151
0 votes
1 answer
411 views

Is PKCE really protecting public facing clients? Can't a rogue app steal the ClientID and Secret and make a AuthCode request of its own?

From what I have understood, for public facing clients such as JavaScript apps that run on the browser or mobile apps which have no backend there is no secure place to store client id and secret. ...
1 vote
1 answer
197 views

What are the best practices to create a safe and performant user registration and validation with Nodejs and Postgres? [closed]

I've been asked to write an app with registration and login systems. In essence, I've already wrote the first version of their app using PHP, some javascript/jquery and storing data in MySQL. It ...
  • 111
2 votes
2 answers
149 views

Does signing in via OAuth 2.0 compromise account security if the OAuth 2.0 service decides to become malicious?

Say we signup and login to an OAuth 2.0 enabled security application called "AI Car Command Center" via Google OAuth 2.0 We then logout. Does Google then have the capability to then grant ...
5 votes
2 answers
721 views

Why not use PKCE for backend apps, too?

So for SPA/frontend apps, you should be using PKCE these days for OAuth flow. But the backend apps have this additional complexity of having to have a secret key and use that key to talk to the token ...
  • 171
0 votes
0 answers
129 views

Delegating to multiple auth providers from a single page application

Consider a use-case in which a single page application using an OAuth identity flow has to use one of many possible identity providers, as determined by what user is logged in. More specifically, I ...
  • 123
1 vote
0 answers
84 views

Should I consider migrating away from OAuth 2.0 Implicit Flow for an internal application relying on Azure AD?

I have recently migrated an internal application (API + SPA) security from Windows Authentication (done by IIS) to Azure A/D authentication using the implicit flow. Now, every user must enter an e-...
  • 2,183
1 vote
0 answers
71 views

Why do some "OAuth" providers ask for personal info?

I don't mean to start another OAuth vs OpenID discussion, but I want to share the underlying cause of my confusion. When I want a Client to process my google docs for something, I have to go through ...
2 votes
2 answers
698 views

How could a server to server rest api communication be more secure, by using OAuth 2?

I created a large backend+frontend project for a client. They recently started a different project, and contracted an other company to develop and host it. Since they need some of the data from my ...
  • 183
0 votes
2 answers
247 views

I found that I could delete the state parameter in an OAuth request and the response was validated and e-mail was still verified

I was fiddling around with an OAuth2.0 request on burpsuite and I found that it validated the account even after I deleted the state parameter completely and forwarded the request through burpsuite. I ...
3 votes
1 answer
1k views

Propagating user context between microservices secured with M2M JWT tokens

We have a current microservice architecture where we secure communication between microservices via Machine-To-Machine access tokens (these tokens are obtained using the Client Credentials grant flow)....
  • 151
2 votes
0 answers
564 views

Keycloak and Open ID Connect best practices

I'm a bit lost as to the best practice surrounding a production-ready access management based on keycloak and open id connect. My understanding is that if you use Keycloak's provided adapters, instead ...
  • 21
0 votes
1 answer
152 views

Benefits of Token Exchange protocol

Beginner question here, I don't seem to be able to wrap my head around the security benefits of the token exchange protocol as specified by RFC8693. To me it seems like a delegation pattern where a ...
  • 101
0 votes
1 answer
321 views

Logout on OIDC Provider Refresh Token validity in comparison to OAuth

I have an Relying Party that has obtained an Access Token and Refresh Token (as well as an ID Token) from an OpenID Provider (not an offline token). In all cases I have seen, the Refresh Token is ...
  • 492
4 votes
1 answer
1k views

Why is SAML still used for enterprise SSO instead of OIDC?

Im trying to wrap my head around the difference between SAML/OIDC/and OAuth Is the only reason SAML is the most popular choice for enterprise SSO that its been around much longer? Is it expected to ...

1
2 3 4 5
11