Questions tagged [oauth]
OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.
519
questions
0
votes
1
answer
52
views
Isn't there a critical built-in vulnerability in OAuth's Implicit flow?
I've read some blogs and did some labs regarding OAuth's implicit flow,
but it seems to me everyone just turn a blind eye to a very critical point in the flow.
Assuming that site A uses the implicit ...
-2
votes
2
answers
58
views
Should standard OAuth endpoints/configuration files be kept private?
Considering an attacker may be able to leverage the information gathered from standard endpoints/configuration files such as /.well-known/oauth-authorization-server and /.well-known/openid-...
- 11
0
votes
0
answers
64
views
URLs in JWT scope
During a pentest I have found a JWT that seems to be a refresh-token issued by some IAM software.
The scope field in the JWT lists all the applications as URLs that this token can be used to obtain ...
- 98
1
vote
1
answer
150
views
Why don't bank verification services use OAuth
I'm going off of this answer, but asking a new question since that's quite old.
It seems to be becoming more common for banks or other "legitimate" institutions to want your banking username ...
- 111
0
votes
0
answers
20
views
How can client credential authorisation work for multiple clients in an IAM system?
I have an IAM system where each entity entry for client credential flow will be associated with a tenant.
I have two scenarios:
one client app that can access target entity to access only client ...
- 1
0
votes
0
answers
53
views
Is there a benefit to validate the signature in an OAuth Authorization Code Flow?
We're utilising OAuth's Authorization Code Flow to authorize the user for an internal action within the application, as opposed to handing off the access token to a separate API.
Under normal ...
- 101
0
votes
0
answers
45
views
Must the refresh_token request come from the same URI origin as in the original redirect_uri?
I've been playing around with Oauth 2.0 Playground to understand Google's Oauth implementation and Oauth in general.
And, I had an idea. I generated an access token running under user_A. Then, I took ...
- 1
0
votes
0
answers
485
views
Strong reason to not send refresh token on every request?
I'm creating a backend that supports authentication with JWT tokens. I'm using the classic access token / refresh token combo.
the access token is valid for 5 minutes and allows the users to perform ...
- 157
0
votes
2
answers
94
views
Security implications of using the current session to mint new access tokens
I saw a setup recently where frontend and resource servers were hosted on subdomains of the same second level domain. E.g. ui.example.com and api.example.com.
It had an interesting authentication flow ...
- 1
0
votes
1
answer
171
views
What does it mean if StackOverflow received OAUTH to access my GitHub account through the GitHub API?
I did not personally authorize StackOverflow to access my personal GitHub account through GitHub API, so what could this possibly mean?
0
votes
1
answer
260
views
Bearer JWT client authentication and access token issued by authorization server
An authorization server issues an access token with issuer details which are exposed in a well-known API of that server. This server uses client authentication JWT tokens with clients configured. ...
- 101
1
vote
1
answer
172
views
How do I best share a shared account's private key?
I made a website which among other things allows users to sign up to events. The HTML form is filled out and submitted, which automatically updates a google spreadsheet with all applications. This of ...
- 13
0
votes
0
answers
84
views
Is it worth replacing session based traditional auth with OpenID-Connect?
Details: traditional web-application with react frontend & nodejs API backend. FE & BE served on the same domain. FE -> example.com, API -> example.com/api
We have users and some of the ...
- 141
2
votes
1
answer
220
views
Oauth: redirect uri validation [duplicate]
As per the below resource: https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uri-validation/
we should validate the redirect url at 3 points:
at time of app registration
when the auth flow ...
- 283
2
votes
2
answers
699
views
Oauth: native UI for internal / first party apps
We have an oauth implementation, which was chosen because of the following reasons:
session sharing across different applications
easy to reason about the security considerations as oauth is well ...
- 283
1
vote
1
answer
367
views
Using CSRF token as state parameter for OAuth request
I recently completed Azure OAuth2 integration with my existing web application. Upon user's successful login into my application user can configure multiple outlook accounts using OAuth2 flow.
As for ...
- 113
1
vote
0
answers
48
views
SSO and/or JWT: make sure web app's endpoints are protected
Let's say I'm building a web application (let's focus on the backend side) that is B2C. Users should be able to register with my application, using a SSO provider like Google or Facebook. Once they're ...
- 157
1
vote
2
answers
228
views
If I login to a mobile/web app with a Google account, what stops the developer also using that account?
I have an admittedly-vague understanding of how OAUTH works, but I recently went through the rigmarole of installing rclone and having it sync some files from my Google Drive to my Linux laptop.
As ...
- 418
0
votes
0
answers
180
views
Personal Access Tokens vs OAuth
We want users of our service to be able to write programs/scripts that act on their (i.e. the user's) behalf.
I've seen various services (github, digital ocean, gitlab) use Personal Access Tokens (...
- 1
0
votes
1
answer
471
views
OAuth2: Is PKCE required if the callback is located in the backend?
This is the architecture I want to follow
Source:
https://stackoverflow.com/questions/73075156/what-exactly-is-redirect-uri-in-google-oauth2-request-for-getting-authorization
I'm using a backend to ...
- 103
2
votes
1
answer
360
views
How does microsoftonline.com know which device I am on, and whether it is a registered device?
Most of the webprogramming and IT security I know is from ten years ago. I'm far from being a pro, so please keep my ignorance in mind when answering.
Back then, browsers sometimes sent details about ...
- 131
0
votes
0
answers
398
views
Oauth: Authorizing multiple clients at once
I have an application where the frontend app talks to 2 set of API servers: be1.domain.com and be2.domain.com
both these servers are independent entities (they do share the same top level domain, in ...
- 283
0
votes
0
answers
43
views
How to handle the Oath2.0 credentials in the APK files
These days, mobile apps commonly leverage Oauth /OpenIdConnect-based authentication and authorization frameworks. To achieve this, the Oauth clients (the App running on android/IOS) must have a few ...
- 177
2
votes
2
answers
473
views
OAuth2 public clients cant use client secret and still achieve a secure workflow, why is it used for confidential clients?
In an OAuth2 authorization flow, if I understand correctly the request made to receive a token with PCKE is almost identical between that of a public client and that of a confidential client. The only ...
- 121
1
vote
2
answers
147
views
Using oauth for authentication
I understand that oauth is an Authorization protocol, but it is possible to use it for authentication when clubbed with something like open ID Connect.
I am trying to understand why do we need an ...
- 283
1
vote
1
answer
3k
views
Why do big sites use cookies and not OpenID connect?
As I understand it, OAuth is the natural evolution of authentication protocols
I understand in a general way that evolution is as follows:
basic authentication
cookies
tokens, at this point you want ...
- 177
4
votes
1
answer
421
views
Would token expiry have prevented the GitHub stolen OAuth token attack?
In April 2022, GitHub suffered an attack involving stolen OAuth tokens:
Security alert stolen oauth user tokens.
Github stolen oauth tokens used in breaches.
Interestingly, GitHub OAuth tokens have ...
- 2,144
0
votes
2
answers
733
views
Is it safe to use email from OAuth for authentication?
I am implementing OAuth (more specifically "Sign in with Google") for a website that has been using only email and password for years.
Now the guide that I'm reading suggests to read the uid ...
- 133
3
votes
2
answers
637
views
Adding SSO to an existing website - should SSO login link to matching email address?
I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and ...
- 131
0
votes
2
answers
264
views
Revoke all refresh tokens when account locked?
Scenario: a user enters his password incorrectly x times, so his account is locked for y minutes.
Should I revoke all his refresh tokens?
Problems:
user is logged out of all devices, not just the one ...
- 435
1
vote
2
answers
976
views
Refresh token replay detection
I'm trying to detect refresh token reuse / replay.
A typical approach:
send refresh token (on login or refresh)
create refresh token as opaque value (e.g. buffer from a CSPRNG)
base64 encode value ...
- 435
1
vote
1
answer
736
views
Should refresh tokens be signed?
I'm not using an identity provider. I have a small system with access and refresh tokens and it works well.
Assume the system follows the "typical" approach:
when user authenticates or ...
- 435
0
votes
0
answers
90
views
Why can't an email or profile scope used to authenticate in OAuth?
I am trying to learn OAuth and I keep reading that "OAuth is only used for authorization." However, if you add an email or profile scope, doesn't that identify who the user is? So can it be ...
- 141
0
votes
0
answers
289
views
Good practice for generating opaque access-token
Restrictions:
Access token will be short lived (2 minutes)
Access token will be one-time use only.
Given a strong random algorithm, would it be considered good practice to generate an opaque access-...
1
vote
1
answer
131
views
Should a website ask me for my TOTP code, if I auth using OAuth?
I recently signed into an account on a website using my Google account. I already have an username+password account on the website, where I have also enabled 2FA with a TOTP code. Upon signing in with ...
- 175
3
votes
1
answer
999
views
Is OAuth2.0 Authorization Code Grant flow with PKCE really secure?
CONTEXT
There is a SPA that uses Authorization Code Grant flow with PKCE to get info from an API all the info is highly sensitive
RESEARCH
Here is what I found of how Authorization Code Grant flow ...
- 173
2
votes
0
answers
446
views
Is it a good practice to store both the Google Oauth2 access token and the refresh token in the database un hashed?
I recently came across a source code where they save a user's refresh token and the access token upon sign in through Google into the database. This is done to access the Google APIs later on through ...
- 121
0
votes
0
answers
97
views
How to authenticate OAuth2 confidential client is making a REST call?
We are looking to implement some REST services to be called from partner servers (not end users via a browser).
The out-of-the-box implementation seems to flow thusly:
Partner server passes a client ...
- 101
0
votes
1
answer
2k
views
Implications of using a self-signed certificate to sign JWT tokens in OAuth
I'm looking to setup an integration between GitHub and Service Now and I can use OAuth2 using JWT Tokens, the steps to take can be found here.
There is a specific step that states:
Create a CA signed ...
- 159
1
vote
0
answers
207
views
Where should I store an OAuth refresh token for a third party?
I am connecting to a third party which authenticates with OAuth2. Once the user has logged in, I want to store the access & refresh tokens for the user. Which is more secure & proper - to save ...
- 111
0
votes
1
answer
3k
views
How is pop token more secure than bearer token?
I tried reading few articles, however I'm not able to understand the merit of POP over Bearer token. Bearer token if lost (during transit over the wire) can give the holder of the token same ...
- 141
1
vote
1
answer
121
views
Whose fault/bug is it in the below case?
Say there are 2 servers a.example and b.example.
b.example uses 3rd party authentication from a.example via OAuth or other protocols.
Now a user user1 with account [email protected] logs in and sets up a ...
- 11
2
votes
0
answers
162
views
Guessable oauth client id and phishing
OAuth manual advises that the client ID should not be easily guessable to decrease phishing attacks. https://www.oauth.com/oauth2-servers/client-registration/client-id-secret/
Is it still the case ...
- 121
3
votes
0
answers
316
views
Should I build my own login functionality? [closed]
I've looked at various ways of logging in users and I'm wondering if I should write my own.
There are a lot of third party solutions that make it easy and cheap to get started, like Amazon Cognito and ...
- 131
4
votes
1
answer
539
views
Security risks of OAuth vs a password manager
Of the following two approaches, which is "more secure", under which circumstances, and why? In other words, please compare the security risks of these two approaches:
Log in to an OAuth ...
- 201
2
votes
0
answers
83
views
Entering password on third party websites to enable integrations
I've got a third party service that I want to integrate with various other websites/applications, the third party service says they support this however rather than using an API key or OAuth to ...
- 121
2
votes
3
answers
1k
views
Is OAuth more secure compared to API Keys
I have worked on many API integrations scenarios and I used 2 approaches to authenticate the API calls:
Using API Keys
For example inside Hubspot integration I use this web call to get all the ...
3
votes
0
answers
457
views
OAuth for command line application
I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
- 1,495
1
vote
0
answers
81
views
Isolating permissions available to browser JS via oauth and referer
This proposal concerns a strategy for isolating the permissions given to plugins in a plugin architecture. I'm looking for insight into whether this design can succeed in isolating those permissions.
...
- 111
7
votes
2
answers
11k
views
What are the advantages of using JWT over Basic Auth with Https?
As per my understanding both JWT and Basic Auth used to store login credentials on client side and avoid sessions for better scalability. I understand with Basic Auth login credentials will be sent ...
- 171