Questions tagged [oauth2]

OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0

Filter by
Sorted by
Tagged with
0 votes
0 answers
16 views

OAuth2 - implicit flow sign-out

I'm using a service that implements OAuth2 Because of some network issues, I need to use OAuth implicit flow in a component I'm developing (I know, it's terrible - we are working on the way to ...
  • 101
0 votes
0 answers
21 views

Is it worth replacing session based traditional auth with OpenID-Connect?

Details: traditional web-application with react frontend & nodejs API backend. FE & BE served on the same domain. FE -> example.com, API -> example.com/api We have users and some of the ...
  • 141
0 votes
1 answer
24 views

Using id_token for all user data instead of userinfo endpoint in OIDC

I need to provide high security for user data. So I would have to encrypt userinfo_endpoint response (despite using TLS, these are the requirements I got). But encrypting userinfo_endpoint response ...
0 votes
1 answer
24 views

JWT and JWKS for server to server calls

I have an application that uses an OAUTH2 flow based on JWT and JWKS. JWT and JWKS are used for the "client authentication": when the application needs to call the endpoint to flip the ...
2 votes
1 answer
52 views

Oauth: redirect uri validation [duplicate]

As per the below resource: https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uri-validation/ we should validate the redirect url at 3 points: at time of app registration when the auth flow ...
1 vote
0 answers
36 views

Sign vs hash HTTP body request

I use OAuth2 private_key_jwt authentication scheme to authenticate clients. Also, I need to be sure that request body isn't modified. I see two ways: In token which I use to authenticate client I can ...
2 votes
2 answers
171 views

Encrypted instead of signed access tokens in OAuth2

In OAuth2 access token is typically JWT signed by authorization server. Assuming that we will use Ed25519 to sign the JWT, we will have 128 bits of security. But what about access tokens that would be ...
2 votes
2 answers
452 views

Oauth: native UI for internal / first party apps

We have an oauth implementation, which was chosen because of the following reasons: session sharing across different applications easy to reason about the security considerations as oauth is well ...
1 vote
1 answer
45 views

Using CSRF token as state parameter for OAuth request

I recently completed Azure OAuth2 integration with my existing web application. Upon user's successful login into my application user can configure multiple outlook accounts using OAuth2 flow. As for ...
  • 113
1 vote
1 answer
28 views

Using certificate-constrained access tokens created by private key used to authentication (with private_key_jwt)

I have a OIDC provider that can't use mutual TLS authentication due to mTLS problems like certificates expiration (what if client didn't rotate certificate and it's expired now? Client cant ...
0 votes
0 answers
20 views

OAuth Authorization Code for CLI

Trying to allow a CLI to "login" via web browser and obtain an access token for the user's account, similar to how gcloud and github's CLI do it. I realize it'll be using the OAuth ...
  • 1
0 votes
1 answer
67 views

OAuth2: Is PKCE required if the callback is located in the backend?

This is the architecture I want to follow Source: https://stackoverflow.com/questions/73075156/what-exactly-is-redirect-uri-in-google-oauth2-request-for-getting-authorization I'm using a backend to ...
  • 103
3 votes
1 answer
61 views

CSRF protection for oauth authorization

I've read a lot about the state parameter in oauth flow. But i cant quite understand if the state validation helps my use case. end to end flow: resource owner is redirected to service provider site(...
1 vote
0 answers
18 views

OAuth2/Cognito: Let trusted server act on behalf of user

I'm building a public HTTP JSON API using API Gateway with ID token authentication. I now need a server that acts on behalf of users. Users message that server using a third party (think Signal or ...
  • 11
0 votes
0 answers
104 views

Oauth: Authorizing multiple clients at once

I have an application where the frontend app talks to 2 set of API servers: be1.domain.com and be2.domain.com both these servers are independent entities (they do share the same top level domain, in ...
0 votes
0 answers
36 views

Is getting OAuth2 token safe to fetch client-side and pass to server-side?

I'm integrating my application with external service. My application will exchange data with the external service in context of some user. Data exchange will be done in background on server-side. User ...
1 vote
0 answers
36 views

Access token lifetime when tokens are client certificate constrained

When we use mTLS we can use access tokens constrained to client certificate that was sent to token endpoint to receive the access token. In this case, if only the client that send this request can use ...
21 votes
4 answers
7k views

If JWT tokens are stateless how does the auth server know a token is revoked?

I've read that JWT tokens are stateless and you don't need to store the tokens in the database and that this prevents a look up step. What I don't understand is that according to RFC 7009 you can ...
  • 615
1 vote
0 answers
30 views

Encrypting authorization response with state

Imagine a authorization_code flow which MUST use PAR and after succeded authorization at authorization_endpoint instead of returning code and state returns only code, but this response is encrypted ...
1 vote
0 answers
24 views

Migrate OAuth 2.0 to OAuth 2.1

I have a old Spring Cloud gateway working with Keyclock server. I don't have Web UI for login because the project is a Rest API. OAuth 2.0 is used with Grant type password. I want to migrate to OAuth ...
0 votes
0 answers
35 views

Why is there 2 separate, different endpoint in OAuth2? (/authorization and /token)

I know they both serve different purpose, but that does not answer why the need for 2 separate endpoint when it could have been done using just 1 endpoint? We pass different parameters when we request ...
0 votes
0 answers
24 views

Attack using the same scope names within differents api resources with OpenID Connect / OAuth2

Assume that we have a client X and client Y. There's also api resources: api-resource-1 and api-resource-2, and api scopes: test.read and test.write. Client X is allowed to test.read within api-...
1 vote
0 answers
39 views

Creating session based on Google sign in

Does it make sense to implement your own session management on top of the Google sign in? Scenario: I have a web app where I allow users to sign in with Google. I just need this sign in to verify the ...
2 votes
1 answer
65 views

Handle authorization_code flow with Pushed Authorization Requests

When we use PAR, I see some problems: When we redirect user to login page we have to store (while user is on the login page) the same data as contained in request object referenced by request_uri (...
1 vote
2 answers
90 views

OAuth2 public clients cant use client secret and still achieve a secure workflow, why is it used for confidential clients?

In an OAuth2 authorization flow, if I understand correctly the request made to receive a token with PCKE is almost identical between that of a public client and that of a confidential client. The only ...
  • 111
1 vote
0 answers
36 views

Use TOTP as client_secret with OAuth

Can we use 10 digital TOTP as client_secret? What security problems would this do, and maybe some benefits? After all, TOTP changes every 30 seconds, but you need to know e.g. a 32 byte secret (which ...
1 vote
0 answers
95 views

How does Oauth 2.0 for native applications protect against spoofed redirect urls?

In https://datatracker.ietf.org/doc/html/rfc8252 (summarised well in https://auth0.com/blog/oauth-2-best-practices-for-native-apps) it states that there are a number of options for a native ...
  • 111
1 vote
2 answers
79 views

Using oauth for authentication

I understand that oauth is an Authorization protocol, but it is possible to use it for authentication when clubbed with something like open ID Connect. I am trying to understand why do we need an ...
1 vote
1 answer
115 views

How to manage long-term access to profile data using OIDC?

I am designing an ecosystem of web applications that uses an Open ID Connect (OIDC) authorization server. The users authenticate to the authorization server using the Authorization Code Flow with ...
  • 107
0 votes
0 answers
89 views

OpenID Connect for authenticating a web-api

I want to accomplish the following: Having a web application or mobile app authenticating users using openid connect. Having a REST Api authenticated using openid connect using the same user as for ...
0 votes
1 answer
52 views

Is there a viable zero-knowledge approach for using oAuth to generate and manage private keys?

I've been doing a deep dive into how products like Web3Auth work under the hood and wonder if this is a viable approach to building applications where a user can have the convenience of using oAuth to ...
0 votes
0 answers
72 views

Azure AD has an "issuer" attribute on JWK keys in the JWK Set but Google ID does not, what is its purpose?

The Google Identity openid discovery url https://accounts.google.com/.well-known/openid-configuration, has a .jwks_uri of https://www.googleapis.com/oauth2/v3/certs. If we look at the first key in ...
0 votes
0 answers
44 views

oauth2 with additional secret

I'm using Spring boot to create an application that stores user secrets in a database (I have to store the secrets); each secret is stored in the database after being encrypted with the user's ...
  • 1
0 votes
0 answers
134 views

Are there security concerns with IMAP when used with OAuth2 and MFA?

Several organizations using Outlook365 (the hosted/managed MS Exchange service from Microsoft) seem to be disabling IMAP and SMTP entirely, forcing users to only use the Outlook client. I get that ...
user avatar
0 votes
1 answer
83 views

Fully Qualified Domain Name (FQDN) based authentication

IP addresses can change and the FQDN is slightly more constant. So I thought that FQDN based authentication instead of IP based authentication might be a good idea, but I didn't find any information ...
0 votes
1 answer
160 views

refresh token without client_id and client_secret

I was reading the OAuth protocol docs https://datatracker.ietf.org/doc/html/rfc6749#section-6 where it implies that you don't need a client_id and client_secret to refresh an access token, just a ...
  • 113
0 votes
0 answers
26 views

Using public OAuth tokens to authorize access to internal services

Here's the deal. This might probably be a known best practice, but I haven't been able to find anything on the matter. Suppose company X has a public facing web API server, and a public OAuth Identity ...
  • 23
0 votes
0 answers
22 views

Act as another google cloud platform user in a web app

I want to set up an OAuth2.0 flow on a web application for users that have access to GCP. The user will login to a web app. Then, the OAuth2.0 flow will need to ask for the consent that will allow the ...
  • 103
0 votes
1 answer
279 views

Is it acceptable to send an access token back to a browser client?

I am currently following the instructions for getting an access token on behalf of a Twilio user described here The part that is confusing me where it seems to generate an access token then proxy it ...
  • 211
0 votes
2 answers
173 views

Is it safe to use email from OAuth for authentication?

I am implementing OAuth (more specifically "Sign in with Google") for a website that has been using only email and password for years. Now the guide that I'm reading suggests to read the uid ...
0 votes
0 answers
396 views

Using `react-oidc-context` and storing the `access_token` and `refresh_token` together

I am looking for a "best practises" approach for creating SPAs protected using OIDC + PKCE. Most of our applications are hosted on two independent web servers with a load balancer routing ...
0 votes
0 answers
61 views

Why is OIDC more secure than oauth2?

If oauth2 is used with the state parameter (I know it's not required by the standard), wouldn't this ensure freshness, i.e. that authentication just happened? What additional security can OIDC bring?
0 votes
0 answers
22 views

What risks are there in using an OAuth2 access_token from an IdP that I do not control to secure an API that I do control?

Imagine I host some API. Its exact function is irrelevant to the question, but it needs to have some sort of authorization put in front of it. I want to call Google's APIs, so users can interact with ...
1 vote
2 answers
287 views

OAuth2 - What is the advantage of using certificate over client secret credentials? (Azure)

When using OAuth2 in Azure, why Certificates are more secure than using Secrets? The Secrets have expiration and are strong, and generated automatically. The application needs to send a JWT containing ...
  • 111
0 votes
1 answer
173 views

Validating CSRF state with an OAuth2 POST Callback

I am setting up OAuth2 for Apple, and it requires a POST response to the callback URL if certain scopes (e.g. email address) are included. My intended process for preventing CSRF: Set a cookie with a ...
1 vote
1 answer
152 views

OAuth 2.0 POST to Authorization Endpoint

The OAuth 2.0 specification states: The authorization server MUST support the use of the HTTP "GET" method [RFC2616] for the authorization endpoint and MAY support the use of the "POST&...
1 vote
0 answers
373 views

What are the risks of using wildcard in context path of OIDC/OAuth redirect_uri?

I'm using Keycloak for my authentication needs. It allows me to use * as wildcard when whitelisting redirect_uris for OIDC clients. What are the risks of using * in context path of redirect_uri? For ...
0 votes
0 answers
19 views

Safe way to allow authorized application to generate a new key after one is broken?

I've run into an OAuth issue where I received a key from the provider with an expiration that was literally set for the same moment I received it. The refresh token's expiration was also set for that ...
  • 181
0 votes
0 answers
25 views

What is the 'domain name' in PKCE Auth flow for mobile apps?

I'm interested in building a mobile app that authenticates with a service using OAuth2 so that my app can use their API's. Documentation To apply for an application key, I need to enter my application'...
-1 votes
1 answer
26 views

Definition of Authorization according to OAuth2

I am trying to understand OAuth2 and OIDC. The OIDC glossary is a good starting point, and while it defines "Authentication", but does not actually define "Authorization". I ...

1
2 3 4 5
9