Questions tagged [oauth2]
OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
252
questions
0
votes
0answers
25 views
In memory local variables (javascript), OAuth token storage, and XSS
Quoting from a long-dead Auth0 forum post: https://community.auth0.com/t/why-is-storing-tokens-in-memory-recommended/17742
"Any values stored in memory are still vulnerable to XSS attacks since
...
0
votes
0answers
29 views
Handling of 3rd party OAuth2 tokens
after some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd ...
0
votes
1answer
51 views
OAuth provider that authenticates only by phone? [closed]
I'm trying to find an OAuth provider that doesn't require a password but instead, it authenticates the user by sending a message to a phone number. I'm thinking that it would be using the phone the ...
0
votes
0answers
36 views
May I use OAuth2 for non third-party applications?
I need some help to understand my problem.
I'm studying a way to provide authentication for my applications.
My scenario:
I've a set of APIs with restricted access and users that will be ...
1
vote
2answers
68 views
What is the purpose of the OAuth2 client secret?
A typical OAuth2 Authorization Code Flow scenario looks like this:
What I'm not understanding is the purpose of the client secret in steps 6 and 7. If the auth server is guaranteed to redirect back ...
2
votes
1answer
133 views
Can we prevent DDoS or spam form submission with client authentication?
There is a public query form in my web app, and architecture team asking to authenticate the web app with OAuth2 like this, but I don't believe it will be of any help.
I believe best way to protect ...
0
votes
1answer
81 views
Auth code grant /w PKCE for SPAs
I'm a security newb trying to find out how to secure my SPAs, and am totally lost in the forest of RFCs, BCPs, drafts and blog posts. If possible, I'd like to serve my SPAs statically from a cdn. At ...
0
votes
1answer
47 views
Differentiating Between First and Third Party Clients
I would like to know how auth services, such as OpenID Connect and OAuth, are able to distinguish between a first party application over a third party one - in particular for clients such as mobile ...
1
vote
1answer
95 views
OAuth2: Where should I store my refresh token in a stateless application?
In my current architecture I have an authentication server which provides a JWT token via OpenID Connect to any web application that uses the code flow I implemented.
I went to the hassle of ...
0
votes
0answers
23 views
OAuth native app without localhost redirect
Section 4.1 of RFC 8252 describes the OAuth authorization flow for native apps using the browser (i.e., external user-agent). In this flow, the native app receives the authorization code in step 4 by ...
0
votes
0answers
32 views
OAuth2 sent access token to server side after login
I am building an Ionic application that needs to have login buttons with major social sites and merge those accounts if that's the case (email or phone match). My concern is that by using the access ...
1
vote
1answer
106 views
Does OAuth 2 increase the risk for clients to expose their “client_secret”
Upon doing a bit of research about the OAuth protocol, I find it hard to avoid the glaring criticism of the OAuth 2 standard, and its supposedly inferior security. An answer on stackoverflow suggests,...
0
votes
0answers
42 views
How come RFC7636 (PKCE) stops malicous app doing the same code challenge and get legitimate access to API
As per the RFC7636 it stops malicious apps which pretend to be legitimate apps, gaining access to OAuth2.0 protected API's.
The flow suggests a method of having a runtime level secret which generated ...
2
votes
1answer
81 views
What is the purpose of the authorization code in OAuth 2? [duplicate]
Why do we need to ask the authorization server for theAuthorization code and then exchange the Authorization code for anAccess token on the same server? Why not to return anAccess token directly, ...
1
vote
1answer
56 views
Where to store pydrive secret?
Backstory: been toying with the idea of setting up some raspberry pi cctv cameras. originally I was going to store all footage for 31 days (complying with DPA) on a network drive but decided against ...
0
votes
0answers
23 views
Is the vulnerability described in rfc6749 10.16 for implicit Flow is comparable to “man in the middle”?
I'm trying to understand if the vulnerability described in the specification for implicit flow : link
is the same principle of a man in the middle attack. From what I understood, the malicious client ...
3
votes
0answers
64 views
Can Chrome Extensions steal OAuth tokens from redirect-uri? [duplicate]
This is a duplicate of a stack overflow question, since it might apply more to security and authentication best practices.
I'm working on auth between a Chrome Extension, Google Cloud Platform, and ...
2
votes
1answer
91 views
OAuth2 for first party web-app
I am building a web (also potentially mobile app) for a platform that allows plugins. We're using the OAuth2 Authorization Code grant type for third-party client plugins.
Which, if any, grant type ...
0
votes
1answer
47 views
OpenID Connect with Authorization code flow and PKCE - How shoud we get a new access token in a SPA application?
As answered in this question, Single Page Applications shouldn't be given a refresh token with the OIDC Authorization Code Flow.
Can you indicate some way of getting a new access token when it ...
0
votes
1answer
66 views
oidc authentication webapp REST api
So I have looked at the following client library, implementing the OpenID Connect spec:
https://github.com/IdentityModel/oidc-client-js
It works as expected, and I can now allow users to login with ...
2
votes
1answer
92 views
Is it necessary to protect the Oauth2 return URL
I am thinking to implement a REST service that needs to call another REST service that is protected by OAuth2.
My service is "always" called server to server by web applications.
The user interacts ...
3
votes
1answer
65 views
How exactly do mobile apps achieve authorization code flow with PKCE?
Let's imagine the following:
I've developed a mobile app using Xamarin (iOS/Android compatible)
I want it to support OAuth2 + OpenID connect's authorization code flow with PKCE, so that the user's ...
0
votes
0answers
33 views
Proper Passing of Oauth2 Key to RobinHood API
Original question is here https://stackoverflow.com/questions/59256905/r-and-shiny-app-secure-connection-to-third-party-robinhood-api
To summarise there is an R package that allows users to enter ...
3
votes
1answer
74 views
OAuth 2.0 authorization code flow vulnerable to “shoulder surfing”?
When using the OAuth authorization code flow in web applications, after successful authentication of the resource owner, the authorization server usually responds with a browser redirect to pass the ...
2
votes
1answer
43 views
Websockets: Is it safe to allow tokens in url parameters?
For an API, I know that passing tokens in the url has the following security implications:
They get saved in browser history
They’re probably saved in your server’s logs and memory
Users might post ...
2
votes
0answers
40 views
Shopify OAuth: State parameter useful when the auth server also returns a signed shop id?
Background: I think I understand how the state parameter is used in oAuth to prevent CSFR attacks against the redirect_uri.
Situation: I am looking at this in the context of implementing a Shopify ...
1
vote
0answers
65 views
Why does OAuth have two separate tokens (access and refresh)?
In the OAuth2 protocol, two kind of tokens are used:
access_token: Granted by authorization server, used by resources servers to decide whether access should be granted for the resource
...
1
vote
1answer
56 views
How verify id_token from the browser in OAuth2?
I have been dwelling into OAuth2 and and OpenID Connect for Authorization flow. And I'm still a bit confused.
I do understand that during the code exchange for an access token the user receives an ...
1
vote
1answer
70 views
Could Redirection URI be a Client URI in OAuth2 Autorization code flow?
For Authorization code grant flow, RFC says the authorization server will send back the code to the redirect_uri specified.
I believe it means the browser will recieve a URL like http://webapp/?code=...
4
votes
1answer
80 views
Does the browser get the access_token in OAuth2?
I've spent more than 10 days trying to understand the Authorization Code Flow for a web application where I'm supposed to implement OpenID Connect for a single sign on. It feels that there is a lot of ...
1
vote
0answers
67 views
API protection - JWT vs HMAC signing vs OAuth
Lets say you are designing a new API. The consumer of your API is a mobile app that periodically sends requests in the background, but you expect other consumers as well, such as web apps or servers.
...
1
vote
2answers
74 views
How to report error if redirect_uri doesn't match?
How should the auth server (IDP) report the error if the authorisation request redirect_uri doesn't match the configured redirect_uri for the given client?
Let's consider concrete example:
auth.com ...
1
vote
1answer
67 views
Carrying two authorization tokens in a request
In my group we have been asked to implement an authentication-authorization flow in a new web portal that lives in a complex infrastructure.
For historical reason the initial authentication of each ...
1
vote
0answers
2k views
how does logging into myaccount.google.com automatically log you into youtube.com
You sign into myaccount.google.com.
Somewhere along the line your browser is redirected to
https://accounts.youtube.com/accounts/SetSID?ssdc=1&sidt=<reallyLongBase64>&continue=https://...
4
votes
1answer
50 views
Do websites grant their own JWT token after successful OpenID/OAuth2 login?
I am looking at implementing an Authorization Code with PKCE grant on a mobile app to communicate to an API. What I am curious about is what applications currently do with the OpenID token that is ...
0
votes
0answers
5 views
share workbook with oauth client
sorry for the cross-posting with SO, I realized that information security would be more revelant in this case.
I set up a oAuth Client ID and authorized it to see and edit my google sheets.
This ...
1
vote
1answer
85 views
Securing API access. oAuth Client Credentials vs client ID and secret
I have a REST API that will be called by other external 3rd party servers over the internet and be used only for machine to machine communication. I am looking for mechanisms to secure this API such ...
1
vote
3answers
71 views
In OAuth2, is it acceptable not to use https for internal communication between resource server and authorization server?
I have a resource server (REST API) and an authorization server which are installed on the same server and behind a reverse proxy. All incoming external requests use https. Would it be acceptable not ...
0
votes
1answer
57 views
Using OAuth2 with JWT, should a client pass along unused refresh tokens on a logout call?
I have a system with an OAuth2 authorization server. It hands out JWT access tokens and refresh tokens (the latter only to the mobile app client).
We don't persist access tokens (as is normal with ...
0
votes
1answer
76 views
Is OpenID Connect implicit flow safe to use?
In researching OAuth 2.0, I see that implicit grant is no longer recommended:-
In order to avoid these issues, clients SHOULD NOT use the implicit
grant (response type "token") or any other ...
0
votes
1answer
34 views
Custom Access control using OAuth 2.0
I'm designing a enterprise infrastructure monitoring application which has customized needs of access control, beyond roles and authorities.
The architecture include multiple nodes of REST API being ...
1
vote
1answer
239 views
PKCE vs Client Secret
If I was developing a web app client that would be served statically, I would need to either use the implicit grant flow (which is no longer advisable) or use the authorization code grant flow with ...
0
votes
0answers
27 views
Apps removing their permissions in OAuth
We are designing a web application for a customer and the main use case is that users will be using the system for anywhere between a few days and a few months.
The customer would like to offer users ...
0
votes
2answers
118 views
Alternative to using Refresh Tokens?
I've been learning about OAuth2, JWT tokens, and refresh tokens.
My understanding of this is:
A user logs in using their credentials.
They are given back an access token (short-lived) and a refresh ...
1
vote
1answer
89 views
Authentication via HTTP on VPN
There is an authentication server (OAuth2) that is only accessible from private network.
A customer wants me to implement an app where users use VPN to authenticate themselves on such a server via ...
0
votes
2answers
62 views
Oauth2 PKCE - What security does “S256” provide over “plain”?
The Oauth PKCE protocol flow is as follows, as defined in RFC 7636:
+-------------------+
| Authz Server ...
1
vote
1answer
56 views
Is using an access token for authentication a bad idea
Is it right that if there is a malicious browser extension allowed to "Read and change all your data on the websites you visit." on the users's machine an access token can be potentially leaked no ...
0
votes
1answer
46 views
What was the point of Implicit Grant Flow in OAuth 2.0?
I've read a lot about Implicit Grant Flow and when it should be used, but I can't wrap my head around a use case for where it would have made sense over the Authentication Code Grant Flow before PKCEs ...
1
vote
3answers
378 views
What can someone do with a Google auth token?
I just received an email from "Have I been pwned" to say my credentials have been made public via a breach. The quoted text is:
"The exposed data included names, email addresses, genders, spoken
...
3
votes
2answers
149 views
Why does OAuth 2.0 RFC6749 disallow fragments in redirect URI?
I wasn't able to find a similar question explaining the considerations of the RFC6749 specification when it comes to redirecting the user from the authorization server to the client. In the RFC ...
