Questions tagged [oauth2]

OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0

Filter by
Sorted by
Tagged with
0
votes
0answers
25 views

In memory local variables (javascript), OAuth token storage, and XSS

Quoting from a long-dead Auth0 forum post: https://community.auth0.com/t/why-is-storing-tokens-in-memory-recommended/17742 "Any values stored in memory are still vulnerable to XSS attacks since ...
0
votes
0answers
29 views

Handling of 3rd party OAuth2 tokens

after some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd ...
0
votes
1answer
51 views

OAuth provider that authenticates only by phone? [closed]

I'm trying to find an OAuth provider that doesn't require a password but instead, it authenticates the user by sending a message to a phone number. I'm thinking that it would be using the phone the ...
0
votes
0answers
36 views

May I use OAuth2 for non third-party applications?

I need some help to understand my problem. I'm studying a way to provide authentication for my applications. My scenario: I've a set of APIs with restricted access and users that will be ...
1
vote
2answers
68 views

What is the purpose of the OAuth2 client secret?

A typical OAuth2 Authorization Code Flow scenario looks like this: What I'm not understanding is the purpose of the client secret in steps 6 and 7. If the auth server is guaranteed to redirect back ...
2
votes
1answer
133 views

Can we prevent DDoS or spam form submission with client authentication?

There is a public query form in my web app, and architecture team asking to authenticate the web app with OAuth2 like this, but I don't believe it will be of any help. I believe best way to protect ...
0
votes
1answer
81 views

Auth code grant /w PKCE for SPAs

I'm a security newb trying to find out how to secure my SPAs, and am totally lost in the forest of RFCs, BCPs, drafts and blog posts. If possible, I'd like to serve my SPAs statically from a cdn. At ...
0
votes
1answer
47 views

Differentiating Between First and Third Party Clients

I would like to know how auth services, such as OpenID Connect and OAuth, are able to distinguish between a first party application over a third party one - in particular for clients such as mobile ...
1
vote
1answer
95 views

OAuth2: Where should I store my refresh token in a stateless application?

In my current architecture I have an authentication server which provides a JWT token via OpenID Connect to any web application that uses the code flow I implemented. I went to the hassle of ...
0
votes
0answers
23 views

OAuth native app without localhost redirect

Section 4.1 of RFC 8252 describes the OAuth authorization flow for native apps using the browser (i.e., external user-agent). In this flow, the native app receives the authorization code in step 4 by ...
0
votes
0answers
32 views

OAuth2 sent access token to server side after login

I am building an Ionic application that needs to have login buttons with major social sites and merge those accounts if that's the case (email or phone match). My concern is that by using the access ...
1
vote
1answer
106 views

Does OAuth 2 increase the risk for clients to expose their “client_secret”

Upon doing a bit of research about the OAuth protocol, I find it hard to avoid the glaring criticism of the OAuth 2 standard, and its supposedly inferior security. An answer on stackoverflow suggests,...
0
votes
0answers
42 views

How come RFC7636 (PKCE) stops malicous app doing the same code challenge and get legitimate access to API

As per the RFC7636 it stops malicious apps which pretend to be legitimate apps, gaining access to OAuth2.0 protected API's. The flow suggests a method of having a runtime level secret which generated ...
2
votes
1answer
81 views

What is the purpose of the authorization code in OAuth 2? [duplicate]

Why do we need to ask the authorization server for theAuthorization code and then exchange the Authorization code for anAccess token on the same server? Why not to return anAccess token directly, ...
1
vote
1answer
56 views

Where to store pydrive secret?

Backstory: been toying with the idea of setting up some raspberry pi cctv cameras. originally I was going to store all footage for 31 days (complying with DPA) on a network drive but decided against ...
0
votes
0answers
23 views

Is the vulnerability described in rfc6749 10.16 for implicit Flow is comparable to “man in the middle”?

I'm trying to understand if the vulnerability described in the specification for implicit flow : link is the same principle of a man in the middle attack. From what I understood, the malicious client ...
3
votes
0answers
64 views

Can Chrome Extensions steal OAuth tokens from redirect-uri? [duplicate]

This is a duplicate of a stack overflow question, since it might apply more to security and authentication best practices. I'm working on auth between a Chrome Extension, Google Cloud Platform, and ...
2
votes
1answer
91 views

OAuth2 for first party web-app

I am building a web (also potentially mobile app) for a platform that allows plugins. We're using the OAuth2 Authorization Code grant type for third-party client plugins. Which, if any, grant type ...
0
votes
1answer
47 views

OpenID Connect with Authorization code flow and PKCE - How shoud we get a new access token in a SPA application?

As answered in this question, Single Page Applications shouldn't be given a refresh token with the OIDC Authorization Code Flow. Can you indicate some way of getting a new access token when it ...
0
votes
1answer
66 views

oidc authentication webapp REST api

So I have looked at the following client library, implementing the OpenID Connect spec: https://github.com/IdentityModel/oidc-client-js It works as expected, and I can now allow users to login with ...
2
votes
1answer
92 views

Is it necessary to protect the Oauth2 return URL

I am thinking to implement a REST service that needs to call another REST service that is protected by OAuth2. My service is "always" called server to server by web applications. The user interacts ...
3
votes
1answer
65 views

How exactly do mobile apps achieve authorization code flow with PKCE?

Let's imagine the following: I've developed a mobile app using Xamarin (iOS/Android compatible) I want it to support OAuth2 + OpenID connect's authorization code flow with PKCE, so that the user's ...
0
votes
0answers
33 views

Proper Passing of Oauth2 Key to RobinHood API

Original question is here https://stackoverflow.com/questions/59256905/r-and-shiny-app-secure-connection-to-third-party-robinhood-api To summarise there is an R package that allows users to enter ...
3
votes
1answer
74 views

OAuth 2.0 authorization code flow vulnerable to “shoulder surfing”?

When using the OAuth authorization code flow in web applications, after successful authentication of the resource owner, the authorization server usually responds with a browser redirect to pass the ...
2
votes
1answer
43 views

Websockets: Is it safe to allow tokens in url parameters?

For an API, I know that passing tokens in the url has the following security implications: They get saved in browser history They’re probably saved in your server’s logs and memory Users might post ...
2
votes
0answers
40 views

Shopify OAuth: State parameter useful when the auth server also returns a signed shop id?

Background: I think I understand how the state parameter is used in oAuth to prevent CSFR attacks against the redirect_uri. Situation: I am looking at this in the context of implementing a Shopify ...
1
vote
0answers
65 views

Why does OAuth have two separate tokens (access and refresh)?

In the OAuth2 protocol, two kind of tokens are used: access_token: Granted by authorization server, used by resources servers to decide whether access should be granted for the resource ...
1
vote
1answer
56 views

How verify id_token from the browser in OAuth2?

I have been dwelling into OAuth2 and and OpenID Connect for Authorization flow. And I'm still a bit confused. I do understand that during the code exchange for an access token the user receives an ...
1
vote
1answer
70 views

Could Redirection URI be a Client URI in OAuth2 Autorization code flow?

For Authorization code grant flow, RFC says the authorization server will send back the code to the redirect_uri specified. I believe it means the browser will recieve a URL like http://webapp/?code=...
4
votes
1answer
80 views

Does the browser get the access_token in OAuth2?

I've spent more than 10 days trying to understand the Authorization Code Flow for a web application where I'm supposed to implement OpenID Connect for a single sign on. It feels that there is a lot of ...
1
vote
0answers
67 views

API protection - JWT vs HMAC signing vs OAuth

Lets say you are designing a new API. The consumer of your API is a mobile app that periodically sends requests in the background, but you expect other consumers as well, such as web apps or servers. ...
1
vote
2answers
74 views

How to report error if redirect_uri doesn't match?

How should the auth server (IDP) report the error if the authorisation request redirect_uri doesn't match the configured redirect_uri for the given client? Let's consider concrete example: auth.com ...
1
vote
1answer
67 views

Carrying two authorization tokens in a request

In my group we have been asked to implement an authentication-authorization flow in a new web portal that lives in a complex infrastructure. For historical reason the initial authentication of each ...
1
vote
0answers
2k views

how does logging into myaccount.google.com automatically log you into youtube.com

You sign into myaccount.google.com. Somewhere along the line your browser is redirected to https://accounts.youtube.com/accounts/SetSID?ssdc=1&sidt=<reallyLongBase64>&continue=https://...
4
votes
1answer
50 views

Do websites grant their own JWT token after successful OpenID/OAuth2 login?

I am looking at implementing an Authorization Code with PKCE grant on a mobile app to communicate to an API. What I am curious about is what applications currently do with the OpenID token that is ...
0
votes
0answers
5 views

share workbook with oauth client

sorry for the cross-posting with SO, I realized that information security would be more revelant in this case. I set up a oAuth Client ID and authorized it to see and edit my google sheets. This ...
1
vote
1answer
85 views

Securing API access. oAuth Client Credentials vs client ID and secret

I have a REST API that will be called by other external 3rd party servers over the internet and be used only for machine to machine communication. I am looking for mechanisms to secure this API such ...
1
vote
3answers
71 views

In OAuth2, is it acceptable not to use https for internal communication between resource server and authorization server?

I have a resource server (REST API) and an authorization server which are installed on the same server and behind a reverse proxy. All incoming external requests use https. Would it be acceptable not ...
0
votes
1answer
57 views

Using OAuth2 with JWT, should a client pass along unused refresh tokens on a logout call?

I have a system with an OAuth2 authorization server. It hands out JWT access tokens and refresh tokens (the latter only to the mobile app client). We don't persist access tokens (as is normal with ...
0
votes
1answer
76 views

Is OpenID Connect implicit flow safe to use?

In researching OAuth 2.0, I see that implicit grant is no longer recommended:- In order to avoid these issues, clients SHOULD NOT use the implicit grant (response type "token") or any other ...
0
votes
1answer
34 views

Custom Access control using OAuth 2.0

I'm designing a enterprise infrastructure monitoring application which has customized needs of access control, beyond roles and authorities. The architecture include multiple nodes of REST API being ...
1
vote
1answer
239 views

PKCE vs Client Secret

If I was developing a web app client that would be served statically, I would need to either use the implicit grant flow (which is no longer advisable) or use the authorization code grant flow with ...
0
votes
0answers
27 views

Apps removing their permissions in OAuth

We are designing a web application for a customer and the main use case is that users will be using the system for anywhere between a few days and a few months. The customer would like to offer users ...
0
votes
2answers
118 views

Alternative to using Refresh Tokens?

I've been learning about OAuth2, JWT tokens, and refresh tokens. My understanding of this is: A user logs in using their credentials. They are given back an access token (short-lived) and a refresh ...
1
vote
1answer
89 views

Authentication via HTTP on VPN

There is an authentication server (OAuth2) that is only accessible from private network. A customer wants me to implement an app where users use VPN to authenticate themselves on such a server via ...
0
votes
2answers
62 views

Oauth2 PKCE - What security does “S256” provide over “plain”?

The Oauth PKCE protocol flow is as follows, as defined in RFC 7636: +-------------------+ | Authz Server ...
1
vote
1answer
56 views

Is using an access token for authentication a bad idea

Is it right that if there is a malicious browser extension allowed to "Read and change all your data on the websites you visit." on the users's machine an access token can be potentially leaked no ...
0
votes
1answer
46 views

What was the point of Implicit Grant Flow in OAuth 2.0?

I've read a lot about Implicit Grant Flow and when it should be used, but I can't wrap my head around a use case for where it would have made sense over the Authentication Code Grant Flow before PKCEs ...
1
vote
3answers
378 views

What can someone do with a Google auth token?

I just received an email from "Have I been pwned" to say my credentials have been made public via a breach. The quoted text is: "The exposed data included names, email addresses, genders, spoken ...
3
votes
2answers
149 views

Why does OAuth 2.0 RFC6749 disallow fragments in redirect URI?

I wasn't able to find a similar question explaining the considerations of the RFC6749 specification when it comes to redirecting the user from the authorization server to the client. In the RFC ...

1 2 3 4 5 6