Questions tagged [oauth2]
OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
181 questions
1
vote
0answers
26 views
Oauth2/OIDC: I know the address of a resource server, is there a standard for querying which authorization servers it accepts?
I have a bunch of what are essentially IOT devices that will authenticate connections using oauth 2 tokens and/or openid connect (depending on use-case). Each IOT device is individually configurable ...
0
votes
0answers
21 views
Implementing OAuth 2 refresh token rotation on web clients
I'm looking to implement refresh token rotation for unauthenticated clients of my OAuth 2 provider.
Things are all implemented on the server side, but I'm concerned that web clients will be unable to ...
2
votes
0answers
45 views
OAuth2: what to return when revoking a token which is not the client's? RFC7009
In RFC7009 - section 2.1, it is stated that:
The authorization server first validates the client credentials (in
case of a confidential client) and then verifies whether the token
was ...
0
votes
0answers
25 views
OpenId Connect Authorization Code Flow in Microservice Scenario (API-Gateway?)
Im building a SPA with a couple of backend-microservices and i want to authenticate using OIdC.
I'm aware of the fact that the implicit flow is not recommended anymore for this. So the recommended ...
4
votes
1answer
206 views
+50
Can websites detect if visitors are logged in to mainstream ID providers and collect their IDs?
Logging in to websites using mainstream IDs (Google/Facebook/Github etc.) by means of OAuth (or similar) has nowadays become a feature that people expect.
Not that long ago the corresponding user ...
1
vote
1answer
44 views
Why is there a redirect to the native app in PKCE?
Why even have a redirect or even use the browser? Wouldn't just a normal TLS/HTTPS request/response in the app protect the requests and token?
The one argument I have heard against solely relying on ...
2
votes
1answer
54 views
What are the security risks associated with leaking client_secret in OAuth2?
There is an API that openly returns client_secret for each existing user, as long as you pass an email address.
Is that a vulnerability?
What are the risks?
0
votes
1answer
35 views
what is the scope of google drive's OAuth credentials?
I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
0
votes
1answer
15 views
Can a service be Oauth2 provider and Oauth2 client at the same time?
Let's say a new application X is an Oauth2 client and allows it's user to signup/login with other Oauth2 providers like Google. So a user U signs up using Google and regularly logins using Google to ...
0
votes
0answers
23 views
OAuth M2M Security Practices
For M2M communication,
I thought of implementing Client Credentials OAuth 2 flow, Client credentials depends mainly on client Id and Client Secret.
if Client credential is exposed, it will expose ...
0
votes
0answers
20 views
OIDC Protocol :: Different OIDC Server End points
OIDC Specifications:
Authorization Code Grant Flow.
As OIDC Server is shall list the various end points (Auth EP, Token EP, Token validation EP etc.)
In this scenario, Can Auth End Point and Token End ...
0
votes
1answer
69 views
OAuth2 Client Credentials Flow with assertion JWT: How to share the client's public key?
I'm having a deeper look into OAuth 2.0 and especially the Client Credentials Flow that is intended to authenticate a client application or device without user interaction (the client is accessing its ...
1
vote
0answers
51 views
Is it secure to expose OAuth2 credentials for a test application
I have created an application in which it is possible to login using GitLab. This requires an OAuth2 app id and secret.
I created a test application in GitLab UI with the redirect set to https://...
1
vote
1answer
108 views
Why is PKCE secure against man-in-the-middle attacks?
In attempting to implement OAuth2 into a natively installed client application, we face the problem that we cannot securely store the pre-shared client secret. After doing some research, I came across ...
2
votes
1answer
84 views
Microservices and RBAC using OIDC
I am currently working on migrating our users from an internal DB to an OIDC service (considering Cognito/Auth0/etc.), and I am trying to implement RBAC.
Our backend is basically a bunch of ...
0
votes
0answers
63 views
Using Cognito access token to pass claims
I am working on migrating all our users from our DB to a managed service, and we're considering AWS Cognito.
We want to use Cognito for Authentication and Access Control.
For access control, we're ...
1
vote
1answer
158 views
OpenID Connect: Is storing access token in browser secure?
I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
0
votes
0answers
79 views
OAuth2 refresh token flow with mobile app
I'm having some issue with an access token not being refreshed in my mobile application. I'm trying to figure out what would be the best approach to fix it.
This is the scenario faced by some mobile ...
0
votes
0answers
37 views
Is it ok to forward a JWT between two custom services?
I'm using Azure AD Implicit Flow for authentication between a SPA and a WebApi.
I want to know if it would be ok/save to redirect from the SPA to a intermediary service of my own as well with the ...
0
votes
0answers
19 views
How does access delegation work - Access Token work?
I'm trying to understand how do access tokens work. What is the mechanism used to generate access tokens similar to AWS Secure Token Service or OAuth Tokens.
I am assuming the algorithm is as follows:...
1
vote
2answers
149 views
Invalidate API tokens when LDAP user is invalid
I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below.
User sends LDAP username and password (with password grand type) to
the server.
Server ...
0
votes
0answers
110 views
Alternative OAuth 2 flow?
I have an implementation of the OAuth 2.0 authorization code flow, but I'm wondering if I can securely introduce a new flow. I'd like a flow that doesn't require the resource owner to ever need to ...
2
votes
1answer
33 views
OAuth2 - Obtaining Refresh Tokens
Given a valid access token alone (you don't know username+password), should you be able to get a refresh token?
2
votes
1answer
103 views
OAuth: how to prevent phishing with malicious redirect URIs
To quote the OAuth spec:
If the resource owner denies the access request or if the request fails for reasons other than a missing or invalid redirection URI, the authorization server informs the ...
0
votes
0answers
33 views
Do I have to use two OAuth/OpenIdConnect bearer token with PKCE?
We have some REST APIs exposed to public applications. Those applications are registered with an (application protocol scheme) redirect URL and we provide to the developer a client secret and client ...
3
votes
0answers
40 views
Architecting a solution with native login and 3rd party login via OAuth/OpenID Connect using dotnet core
I am building an API driven application that will have a native login with username and password, and will also need to grant 3rd party access via OAuth/OpenID Connect in the near future.
A pattern I ...
0
votes
1answer
64 views
capture authorization code programmatically in OAuth 2.0
In a standard OAuth auth code Grant flow, user is redirected to authorization server page where he provides consent to allow the requesting app to perform some actions on his behalf, after which a ...
0
votes
2answers
178 views
Does an authorization code grant rely on sessions?
It's my (possibly flawed) understanding that the authorisation code grant is attractive because it keeps access tokens away from a potentially insecure user agent. I understand how this would work ...
0
votes
0answers
30 views
What's the attack vector for authenticated wildcard CORS origin for a public API?
I have
a public API (intended to be used by third-party websites)
authentication only via JWT bearer tokens (no cookie authentication). SPAs have to add the Authorization header for every API request....
0
votes
1answer
55 views
Is it safe to just forget OAuth tokens, and not invalidate them in a mobile app?
I have a mobile application that a user signs into using OpenId Connect and OAuth 2.0. Currently when the user logs out, I open up a webpage to the end_session_endpoint (http://docs.identityserver.io/...
0
votes
0answers
67 views
Node.js Cookies/Tokens (Access & Refresh) - OAUTH2 - How to store tokens and time/function refreshing
1) I am currently building a RESTful API which acts as a middleman between clients and an authentication server. A client gives me some account details and my server passes them to the auth server who ...
1
vote
2answers
49 views
Is it dangerous not to verify the signature of an id token issued by an external authorization server?
I need to retrieve some values from an id token issued by an external authorization server inside a private network.
I asked for the certificate used to sign the jwt in order to verify it but I've ...
4
votes
0answers
48 views
Poor Man's OAuth Grant - Review
A 3rd party company has requested that we implement single sign-on with them using the below approach. I'm familiar with OAuth grants and OIDC flows but this seems rather odd to me.
The user has ...
1
vote
0answers
38 views
Is the OAuth implicit flow too insecure for serverless single page web applications?
Assuming the need for OAuth
Imagine an application that is:
A single page web application hosted on S3
Authenticated using implicit OAuth flow implicit
Have the web application access resources ...
0
votes
0answers
41 views
Is Oauth2 Implicit grant two-legged or three-legged?
In implicit grant, the resource owner has to provide consent to allow the application to access the resources on user's behalf. Doesn't this make Implicit grant a 3-legged flow?
This video states ...
1
vote
1answer
163 views
How can I securely disable CSRF validation for native clients when browser clients access the same API?
I have an API endpoint that is accessible by both native (console, mobile apps) and Javascript based clients.
How do I ensure that the CSRF AntiForgeryToken is only invoked during Javascript calls?
...
1
vote
0answers
215 views
Using Google Authentication with Lambda@Edge and S3 Static Sites
I am looking to set up authentication on an S3 hosted static site. The configuration is:
S3 bucket configured to allow access via cloudfront
AWS Cloudfront distribution with HTTPS configured and a ...
0
votes
0answers
26 views
How does SupportsCredentials, Access-Control-Allow-Credentials, and CORS Origin=* relate?
I'm investigating CSRF implementations in ASP.NET, MVC, WebAPI the relationship between the headers that are sent:
A Javascript client call of XMLHttpRequest.withCredentials
A server response of ...
1
vote
1answer
118 views
OAuth 2.0 when and how to use the client id and secret
The OAuth 2.0 protocol uses the client id and secret. It considers the client id to be public while the secret is private. Anyway it also considers to generate the client id randomly with a certain ...
2
votes
2answers
87 views
Why refresh token if I can reauthenticate?
So I have a backend service (batch service, no user access), everytime I make a request I need to call the token endpoint and send my username/password in the header then it returns an access token ...
0
votes
1answer
58 views
Mobile apps that use OAuth2 to offload authentication to a 3rd party: are they misusing OAuth2?
I have been tasked with building a mobile app that requires users to login to a 3rd party service via OAuth2 to obtain some data about them. This mobile app also requires its own backend database ...
0
votes
1answer
123 views
Should I use TOTP when using OAuth2
I'm implementing TOTP in my application to allow users to use two factor authentication with Google authenticator and the like.
However I've also implemented "social login" using OAuth, should the ...
1
vote
0answers
24 views
When is OAuth1 preferred over OAuth2
Scenario:
I need to build a new API for a third party company who are building a tool to capture information of new users wishing to create accounts on our enterprise platform.
-x-
My preferred ...
2
votes
3answers
272 views
How Secure is OAuth2 for Web Applications?
Let’s consider a single page client side application, developed using HTML and Javascript.
In this case, even if the implicit or authentication code flow is being used to request Access Tokes, still ...
1
vote
1answer
75 views
Is it a good idea to notify a user that they signed up with a social-login account?
Say my website provides three main ways to signup/signin: Google, Facebook and typical username/password. Is it a good idea to flash "Please login using your Google account" if a user tries to login ...
0
votes
1answer
34 views
Revoke OAuth2 Token For Mobile App
When a user logs into my mobile app it uses OAuth to authenticate them and generates a token. The token is then checked against each subsequent request. Each user account in my application has an ...
2
votes
1answer
80 views
Is it secure to handle the OAuth 2 Authorization callback from a CDN?
This question is in the context of the OAuth 2.0 Authorization Framework.
Consider a web application that is backed by a first-party API but relies on a third-party authorization server for SSO.
Say ...
1
vote
0answers
51 views
Tunelling an Authenticated User Across Microservices Securely
On a platform which follows the OAuth 2.0 framework for authorization and a microserivce based architecture, what is a secure way to pass a user from one microservice to another on the same platform ...
1
vote
0answers
125 views
How to properly store OAuth 2.0 client_id and client_secret in a web application?
In the PoC (Proof of Concept) that I'm currently developing, data from an API is consumed and OAuth 2.0 is required for authentication. The application is already working as expected, the users are ...
0
votes
0answers
18 views
implementing push api for files using oauth2
i want to implement a push api similar to Garmin Connect API.
this api allows the clients to get the data of garmin users, as garmin will push to the clients the user's files whenever created.
we ...
