Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [oauth2]

OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0

1
vote
0answers
4 views

How to provide granular API security using OAuth scopes and claims

I'm trying to work out how best to secure an API using oAuth scopes and/or claims. I'm unsure on which I should be using. My setup is as follows: All users sign in to signin.domain.com There are ...
0
votes
1answer
18 views

What is the example parameter in the OAuth 2.0 RFC

In section 4.1.4 of the OAuth 2.0 RFC, it gives an example of an access token response: An example successful response: HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 ...
0
votes
1answer
27 views

A Method for Generating Un-Guessable Client Identifiers

I am implementing an OAuth 2.0 authorisation server. As part of client registration process I want to generate the unique client identifier for this client. The method I have chosen is to take all ...
1
vote
0answers
21 views

Nested API security

What are best practices for securing nested APIs? Here is an example: User browser (Authenticated already) -> REST API A -> REST API B (internal and may or may not be exposed to internet) Typically,...
2
votes
1answer
48 views

What is the proper flow for authentication?

I'm tasked with migrating a group of .Net WebForms applications from a current custom username/password login scheme to an oauth2/openid connect based authentication and authorization. This specific ...
1
vote
1answer
76 views

Why do we use Oauth2 instead of Basic Auth in server to server communication using SSL?

Why do some API providers ask you to implement Oauth2 in server to server communication that's available only over HTTPS? In the frontend (app or webapp), Oauth2 is useful to protect the user ...
4
votes
1answer
53 views

Can oauth2 “state” parameter be used to avoid using session cookies to identify user

https://tools.ietf.org/html/rfc6749#section-4.1.1 states: 4.1.1. Authorization Request" "state" RECOMMENDED. An opaque value used by the client to maintain state between the ...
2
votes
1answer
31 views

Why should authorization servers document the size of client identifiers?

In section 2.1 of the OAuth2.0 RFC, it states the following regarding the client identifier: The authorization server SHOULD document the size of any identifier it issues. What is the point of ...
0
votes
1answer
72 views

What a malicious user could do with a refresh token that cannot be revoked and has 1 year expiry time?

In ADFS 4.0 a refresh token cannot be renowed without passing through an authorization request flow (asking the user again for credentials) and cannot be revoked. I'm forced to put a 1 year lifetime ...
0
votes
0answers
25 views

Oauth2 vulnerable authentication flow with state parameter

As per my understanding, this is the standard authentication flow to log in a user using auth service provider; But I've seen some framework and examples, where they build authentication URI at ...
0
votes
1answer
44 views

OAuth 2 Implicit grant type for first party SPA - Most secure and sensible way

My aim is to secure my stateless API and only allow the registered first-party clients (SPA) to consume my resources. There is not going to be any third party clients in my scenario. I know Oauth 2 ...
-1
votes
0answers
13 views

Microservices and ID token

In micro-services architecture, some articles suggest that ID token can be passed between clients in order to implement "distributed sessions". This way, clients use ID token during OAuth 2.0 dance to ...
1
vote
0answers
28 views

OAuth2.0 and RESTful API

So I'm creating some RESTful API endpoints which use Bearer tokens for authorization. I want to use OAuth2.0 to get the access tokens for these. But I can't get my head around how to get the OAuth2.0 ...
0
votes
0answers
26 views

OAuth 2 Client Credentials within Mobile App

I am currently developing a mobile app that communicates with an OAuth server. The server I am trying to access provides two grants: Authorisation Code and a device PIN grant (not sure if it's part of ...
0
votes
1answer
29 views

How does the authorization work after authentication using OpenID Connect

Suppose that a client gets an ID token and access token from the auth server after successful authentication. The client now sends a request to the application server (request contains access token ...
0
votes
0answers
32 views

What oauth grant type should I use after social sign in

I have an application which has its own oauth microservice to issue access tokens. The flow runs as below: User enters username and password to register, which makes api call to user-microservice ...
1
vote
2answers
192 views

Storing OAuth access and refresh tokens in non HttpOnly cookies

I am using OAuth auth code flow to generate access and refresh tokens and then I store them in two browser cookies that are not HttpOnly and send them back too the client. The cookies need to be non ...
3
votes
1answer
89 views

Google login button - what prevents an rogue app from stealing a token?

Here are steps to setup a Google login button on a web client: https://developers.google.com/identity/sign-in/web/sign-in When click on the Google login button this pops up: All the interactions are ...
1
vote
1answer
65 views

How to use Oauth2 and JWT to secure microservice architecture?

We have been investigating proper mechanism to secure microservises that we are going to provide as API endpoints via API manager application. Fundamentally we need stateless security mechanism like ...
0
votes
1answer
125 views

Reasons to transition Kerberos secured web applications to OAuth2/OpenId

We have five internal web applications written in Java / AngularJs that are secured via Kerberos/ Spnego ( Spring Security implementation) . We are looking to transition these apps to AWS ( EBS) . ...
1
vote
1answer
74 views

Is the OAuth2 authentication code long enough to be secure?

I have recently started working with the OAuth2 authentication flow. In using it, I see that in the authcode flow, the client allows the AuthServer to authenticate a user, and then returns an ...
1
vote
0answers
26 views

OAuth2 and linking resources of one owner to another person account

I'm implementing client side OAuth and I'm worried about the following scenario. There is application A registered with service B that is offering access to its user resources - authorized by OAuth (...
0
votes
0answers
37 views

Which OAuth 2 flow is used by larger companies like Twitter and Facebook and why did they choose it?

Based on the user experience it seems like Twitter and Facebook use the resource owner password credential flow. From what I've read authorization code flow is the most secure option for a standard ...
0
votes
0answers
282 views

Auth0 vs Firebase = oidc vs Firebase Tokens

I am trying to choose between Auth0 and Firebase as my identity provider. I am building a SPA with a Backend API and I would like to use Auth0 or Firebase for all the logic regarding users/passwords/...
0
votes
0answers
26 views

How to safely store OAuth2 credentials in a Desktop application

I've been searching for a good answer to this problem for a while now, and have seen questions that could be duplicates, but none of them seem to have good/definitive answers that work for my case. I ...
0
votes
0answers
101 views

In google OAuth callback, is providing redirect_uri by client a security risk?

for example, at callback url of google oauth,to convert 'code' to access_token, I need: Client side href: https://accounts.google.com/o/oauth2/auth?scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%...
0
votes
1answer
38 views

OIDC - what is the point of two separate tokens - access and id?

I struggle to understand why don't we just have a single token that serves both purposes - authorisation and authentication? In some sense, the access token does more than just authorisation. It also ...
5
votes
1answer
328 views

Do I need CSRF protection in this setup with a REST API backed with oauth2 and a basic auth SSO auth server?

I've seen the answer Is CSRF possible if I don't even use cookies? but there are 2 conflicting answers and the question itself doesn't provide that much information either. I am creating a REST ...
1
vote
0answers
276 views

Token Exchange at a REST API Gateway to federate authentication while maintaining detailed authorization (think ABAC) within the API?

I'm on the verge of creating a service within our resource server that would exchange an externally generated access token for an internally generated access token. However, this feels wrong. I have ...
0
votes
0answers
19 views

Why is auth_code server over redirect URI than on a webpage in OAuth 2.0?

Per three-legged OAuth standard, an auth_code is served as an URL parameter, while the URL being the redirect_uri specified during client registration. I guess it's an HTTP 302 response sent by the ...
0
votes
0answers
330 views

Should OAuth2 Access Token support multiple audiences?

I am considering a usecase where an OAuth2 client obtains an access token to access multiple resource servers. Based on spec, to protect against token redirect attack: to deal with token redirect,...
2
votes
2answers
515 views

OAuth - How does the Resource Server validate the access token is not for any other Resource Server?

Let's take an example where there are two resource servers - RS1 and RS2 and there is one authorization server - AS. Both resource servers - RS1 and RS2 use authorization server - AS If a client ...
4
votes
1answer
168 views

Need of scope in OAuth Client Credentials Flow

For me, Client Credential flow is like client is asking access token for itself - not on behalf of some user. Then, why would client like to limit its own scope? What is the benefit of scopes in ...
2
votes
1answer
242 views

How to get better IAM understanding

I'm getting interested in Identity and Access Management (IAM), but I find it hard to find complete and understandable explanations that suit me, surely because I started wrong. I began with ...
2
votes
1answer
230 views

Why CORS preflight is not available for POST requests when Content-Type is application/x-www-form-urlencoded

In oauth2 for single page application(SPA), we can revoke the access tokens of the implicit grant type by using an ajax request(this is not recommended now). I tried to do a request like below from ...
0
votes
1answer
122 views

What is the risk of sharing the client_secret.json in a public repo?

I have a python script which writes data into a public google sheets file and for using the google sheets API I need to have a user authorize my script. I want to share the script with others and thus ...
4
votes
1answer
84 views

Authorize transitive communication between applications on behalf of the user

I'm trying to wrap my head around to following web security question for a while now. Say we have a system set up as depicted in the picture below. There is one main application with which the user ...
2
votes
1answer
85 views

Why can't the client server speak directly to an identity provider like Facebook in OAauth 2.0

OAuth 2.0 used for authentication by Google makes sense given that the server and client both trust Google but not each other. As I understand the authorization code is passed back to the server (in ...
1
vote
1answer
436 views

OAuth2 for mobile apps with confidential backend client (Is PKCE required?)

I'm wondering why neither rfc6749 nor rfc8252 seem to consider the case where the mobile app does not make protected resource requests (and is therefore not a client) but instead relies on a backend ...
3
votes
1answer
52 views

How does security work in a cloud-to-cloud backup scenario?

I'm thinking of using Spinbackup which is a cloud-to-cloud backup of gmail, but I was resistant to the idea of telling Spinbackup my gmail password for obvious reasons. However, on the Spinbackup ...
0
votes
1answer
75 views

Best practice to share google drive API credentials for being used by a script?

In a nutshell: Shall I share oauth2-credentials in our source code with the scope of full write-access to a google drive from a dedicated single-purpose google-account? so, I've written a python ...
2
votes
0answers
88 views

Is passing claims about the user in an access token “abusing” OpenID Connect?

First, let me assure you that I have read a number of posts on the topic before asking this question, but I am still confused and would appreciate more insights. So, here's the premise: There is a ...
2
votes
1answer
380 views

How to prevent refreshing a stolen access token

The scenario is: you have refresh token that is valid for a longer period of time and an access token that is valid for a shorter period of time. The setup: There is a client, application server and ...
1
vote
1answer
149 views

Why using oAuth2 refresh token is more secure then regenerate an access_token?

I'm implementing an oAuth2 authentification to secure my REST Api. As I am implementing oAuth2, I need to generate an access_token which will give me a temporary access to my REST datas. To do it, I ...
0
votes
0answers
40 views

How to do authentication of SaaS implementation for uploading, processing, and retrieving documents

We would like to provide a B2B SaaS with the following flow: Our customer's end-users upload their document using our custom upload UI which should be embedded using an iframe Once the user finishes ...
0
votes
1answer
30 views

Non-standard OIDC flow: How safe is this?

I have been made aware of an application, at a client, that claims to use OIDC to authenticate users. This is however done via a non-standard flow that I find hard to assess from a security standpoint....
11
votes
1answer
2k views

Why isn't PKCE encouraged for Single-Page Apps?

A lot of services today still recommend the implicit flow for an OpenID Connect/Oauth2 token exchange when developing Single-Page Apps. (See Okta, Google, Auth0) Some newer guidance out there points ...
1
vote
1answer
66 views

OpenID Connect, OAuth2, and deleted accounts

If I use OpenID Connect or OAuth2 for authentication, and a customer deletes his/her OAuth2 provider (Facebook) account, how can I safely associate a new authentication with a different OAuth2 ...
0
votes
0answers
163 views

How to store `client_secret` privately on frontend applications?

I am trying to understand how authentication and authorization should work with a REST API given that the API will be available to be used by third-party applications. I realize that if we allow ...
3
votes
1answer
234 views

Is using OAuth2 services like Google or Facebook Single Sign-On a privacy concern?

With all the coverage of Cambridge Analytica scandal, it seems like this wasn't a data breach or hack, it was just that Cambridge Analytica did not properly disclose how they would use the data. Is ...