Questions tagged [oauth2]

OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0

Filter by
Sorted by
Tagged with
0 votes
0 answers
21 views

Is the OAuth client secret sent for every API call along with the access token?

Does the OAuth client attach the client secret along with the access token for each API call to the resource server ?
termcap's user avatar
  • 31
0 votes
1 answer
20 views

Best practises regarding authentication in SPA/API solutions with SSO

There is really not that great information on what the best practices are for auth in SPA/API solutions. Most of them just say use JWTs and auth code flow in the SPA. There is a ton of information ...
ryansan's user avatar
  • 101
0 votes
0 answers
28 views

OAuth2: Storing temp values in session vs database

I have implemented OAuth2 for a web app. Everything is stored in the session, and I am switching this to a database. This makes sense for the subject and roles, but it also includes the temporary ...
Ryan's user avatar
  • 101
0 votes
1 answer
62 views

Oauth2 without browser on native apps

All recommendations related to user authentication in mobile applications indicate that we should use oauth2 with pkce, in this case we have to use the custom tabs solution, but no browser redirection ...
Bera's user avatar
  • 101
0 votes
0 answers
44 views

How should the grant type of an oauth2 access token be preserved after refreshing it using refresh grant?

Let's say I got an access token of the "authorization code" grant type. After the expiration of it, I would refresh it using the refresh grant. Then I'll get a new token. Is the grant type ...
Agent47's user avatar
0 votes
0 answers
56 views

Does the New Google Session Hijacking Technique Require Access to my Computer

There is a new article explaining the details of the new Google OAuth2 exploit where a Google session can be restored using a Chrome token. But what I can't seem to find on Google or in the article ...
Dave's user avatar
  • 101
0 votes
1 answer
118 views

why was implicit flow conceived?

The OAuth2.0 Implicit Flow allows to obtain an Access Token directly with just one call to the Authorization Server (AS), without the need of a second POST request to the same AS. According to this ...
zer0uno's user avatar
  • 103
0 votes
2 answers
150 views

can we use access token as session cookie in browser? and how to protect it?

The scenario is: you have refresh token that is valid for a longer period of time and an access token that is valid for a shorter period of time. The setup: There is a client, application server and ...
Illakiya 's user avatar
2 votes
1 answer
225 views

OIDC with JWT in HTTP-only cookie instead of HTTP Authorization bearer header

I'm exploring the possibility of implementing OpenID Connect (OIDC) with an HTTP-only cookie to keep my frontend code completely authentication-agnostic, instead of passing the Authorization header ...
Luke 10X's user avatar
  • 121
0 votes
0 answers
71 views

Mtls in Google Cloud pub/sub oauth 2.0

I am trying to ascertain if Google Cloud Pub/Sub supports OAuth 2.0 with Mutual TLS (mTLS). Despite conducting an internet search, I couldn't find any pertinent information regarding mTLS support (it ...
SempriGno's user avatar
0 votes
0 answers
59 views

OAuth2 component scopes

I'm currently implementing a system which consists of a collection of apps. Similar to the way Microsoft 365 consists of Word, Excel, etc. Ideally I'd like to log in once, then navigate between apps. ...
Andy N's user avatar
  • 502
1 vote
0 answers
140 views

Hundreds of bots creating accounts using sign-in with Google

We are getting hundreds of bots creating accounts using sign-in with google, like this in this format: Colin Bush: [email protected] Tambra Lockett: [email protected] Marjorie ...
Zeone line's user avatar
0 votes
1 answer
84 views

Isn't there a critical built-in vulnerability in OAuth's Implicit flow?

I've read some blogs and did some labs regarding OAuth's implicit flow, but it seems to me everyone just turn a blind eye to a very critical point in the flow. Assuming that site A uses the implicit ...
Trigosin Darom's user avatar
-2 votes
2 answers
90 views

Should standard OAuth endpoints/configuration files be kept private?

Considering an attacker may be able to leverage the information gathered from standard endpoints/configuration files such as /.well-known/oauth-authorization-server and /.well-known/openid-...
registry4059's user avatar
0 votes
0 answers
115 views

Man in the Middle Attack for OAuth 2's Authorize endpoint

We all know that the /authorize endpoint is a standard endpoint of OAuth 2. Below is how it's commonly called: GET /oauth2/authorize?client_id={client_id}&redirect_uri={redirect_uri}&...
Joms DV's user avatar
0 votes
2 answers
162 views

OAuth2 authorization server dictating the resource server to the client

I am looking for any specifications, prior art, and known security considerations for a specific OAuth2 use case where: an authorization code grant is being performed. the client does not know the ...
Devin Ivy's user avatar
0 votes
1 answer
106 views

OAuth2 implicit flow - is it still possible to hijack the token with HTTPS?

The video from Okta says that it's possible to hijack the access token when on public wifi. But if HTTPS is used, the headers are encrypted. And therefore the Location returned by the Auth Server won'...
Stanislav Bashkyrtsev's user avatar
0 votes
0 answers
60 views

Why are Laravel's refresh tokens so big?

Laravel Passport implements OAuth2 flows and does the usual thing of issuing access tokens in JWT format, and an opaque random string as the refresh token. These refresh tokens are enormous - around ...
Synchro's user avatar
  • 717
0 votes
1 answer
98 views

Should I use separate OIDC clients for RFC-8252 (OIDC w/ PKCE) client and my HTTP API?

I have a non-browser client (Desktop app) that makes HTTP requests to my API. I have the desktop client configured to use RFC-8252 (spawn an ephemeral HTTP server to handle the auth code flow's HTTP ...
Jon Wolski's user avatar
0 votes
1 answer
1k views

OIDC + Authentik: Which token to give to user for authentication?

I am implementing a web service with a front end and back end. Everything but the login endpoint requires authentication. For authentication I use Authentik. However, I have trouble wrapping my head ...
Tim's user avatar
  • 1
0 votes
1 answer
72 views

Why oauth2 token refresh may issue new refresh token? (is this mitigation of some kind of threat)

During token refresh, the auth server may issue new refresh token. https://datatracker.ietf.org/doc/html/rfc6749#page-11 ... (H) The authorization server authenticates the client and validates ...
IndustryUser1942's user avatar
2 votes
1 answer
857 views

Re-authentication with biometrics in a mobile app using access token

My mobile app has this (fairly common) authentication user experience: user signs in with email and password user is prompted to enable biometrics for faster access next time when user returns to app ...
Tamlyn's user avatar
  • 175
0 votes
0 answers
74 views

Must the refresh_token request come from the same URI origin as in the original redirect_uri?

I've been playing around with Oauth 2.0 Playground to understand Google's Oauth implementation and Oauth in general. And, I had an idea. I generated an access token running under user_A. Then, I took ...
David Ho's user avatar
0 votes
1 answer
88 views

Using OpenID 2.0 to return an Oauth token

EDIT: I've looked into the issue more and I can find some documentation for getting an OAuth token with OpenID Connect but not with OpenID 2.0. Can it be done? We have a server application that is ...
Gilles's user avatar
  • 635
0 votes
0 answers
94 views

In OAuth 2.1, can the Access Token and Authorization Code be the same?

OAuth 2 supported a flow called the Implicit Flow where the authorization server on response just provided the access token directly to the browser without requiring a back-channel communication from ...
Evan Carroll's user avatar
  • 2,772
0 votes
0 answers
116 views

Is there any sense in use of Authorization Code Binding To DPoP Key when client is confidential and uses PKCE?

This spec defined DPoP mechanism to bind cryptographically bind access tokens. There is also mention about authorization code binding. But hey, do you see any sense in it? Ok, it obviously is a way to ...
Szyszka947's user avatar
0 votes
1 answer
227 views

Why doesn't client_secret prevent authorization code OAuth2 redirect attacks?

OAuth2 requires clients to register allowed values for redirect_uri. Otherwise, an attacker could receive the authorization code. For example: https://authorization.example/oauth/authorize ?client_id=...
Paul Draper's user avatar
  • 1,010
1 vote
0 answers
869 views

Use of nonce to prevent access token leakage in OIDC implicit flow?

Disclaimer: I know The OIDC implicit flow has been discouraged for a long time and I should use code flow on greenfields. Reasons include but are not limited to leakage of the authorization server ...
spinkus's user avatar
  • 111
0 votes
0 answers
68 views

Options for various auth strategies for express API

OK, I need some help with this: I am creating a Node express API, and I want to support the following auth strategies: Cookie or JWT based authentication that supports MFA (OTP, email, and SMS), for ...
prmph's user avatar
  • 227
1 vote
0 answers
82 views

RESTful API with Google API and OAuth2

As the title says, I want to create a RESTful API (stateless) that will access Google API endpoints. First I want to authenticate the user and then use that token provided by Google to access Google ...
ktop's user avatar
  • 11
0 votes
1 answer
212 views

Using id_token for all user data instead of userinfo endpoint in OIDC

I need to provide high security for user data. So I would have to encrypt userinfo_endpoint response (despite using TLS, these are the requirements I got). But encrypting userinfo_endpoint response ...
Szyszka947's user avatar
0 votes
1 answer
198 views

JWT and JWKS for server to server calls

I have an application that uses an OAUTH2 flow based on JWT and JWKS. JWT and JWKS are used for the "client authentication": when the application needs to call the endpoint to flip the ...
Marco Altieri's user avatar
3 votes
1 answer
259 views

Oauth: redirect uri validation [duplicate]

As per the below resource: https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uri-validation/ we should validate the redirect url at 3 points: at time of app registration when the auth flow ...
gaurav5430's user avatar
1 vote
0 answers
307 views

Sign vs hash HTTP body request

I use OAuth2 private_key_jwt authentication scheme to authenticate clients. Also, I need to be sure that request body isn't modified. I see two ways: In token which I use to authenticate client I can ...
Szyszka947's user avatar
2 votes
2 answers
961 views

Encrypted instead of signed access tokens in OAuth2

In OAuth2 access token is typically JWT signed by authorization server. Assuming that we will use Ed25519 to sign the JWT, we will have 128 bits of security. But what about access tokens that would be ...
Szyszka947's user avatar
2 votes
2 answers
780 views

Oauth: native UI for internal / first party apps

We have an oauth implementation, which was chosen because of the following reasons: session sharing across different applications easy to reason about the security considerations as oauth is well ...
gaurav5430's user avatar
1 vote
1 answer
500 views

Using CSRF token as state parameter for OAuth request

I recently completed Azure OAuth2 integration with my existing web application. Upon user's successful login into my application user can configure multiple outlook accounts using OAuth2 flow. As for ...
Amogh's user avatar
  • 113
1 vote
1 answer
149 views

Using certificate-constrained access tokens created by private key used to authentication (with private_key_jwt)

I have a OIDC provider that can't use mutual TLS authentication due to mTLS problems like certificates expiration (what if client didn't rotate certificate and it's expired now? Client cant ...
Szyszka947's user avatar
0 votes
0 answers
78 views

OAuth Authorization Code for CLI

Trying to allow a CLI to "login" via web browser and obtain an access token for the user's account, similar to how gcloud and github's CLI do it. I realize it'll be using the OAuth ...
Sam's user avatar
  • 1
0 votes
1 answer
605 views

OAuth2: Is PKCE required if the callback is located in the backend?

This is the architecture I want to follow Source: https://stackoverflow.com/questions/73075156/what-exactly-is-redirect-uri-in-google-oauth2-request-for-getting-authorization I'm using a backend to ...
MrRobot9's user avatar
  • 103
3 votes
2 answers
402 views

CSRF protection for oauth authorization

I've read a lot about the state parameter in oauth flow. But i cant quite understand if the state validation helps my use case. end to end flow: resource owner is redirected to service provider site(...
ProgramCpp's user avatar
1 vote
0 answers
90 views

OAuth2/Cognito: Let trusted server act on behalf of user

I'm building a public HTTP JSON API using API Gateway with ID token authentication. I now need a server that acts on behalf of users. Users message that server using a third party (think Signal or ...
Max's user avatar
  • 11
0 votes
0 answers
490 views

Oauth: Authorizing multiple clients at once

I have an application where the frontend app talks to 2 set of API servers: be1.domain.com and be2.domain.com both these servers are independent entities (they do share the same top level domain, in ...
gaurav5430's user avatar
1 vote
0 answers
193 views

Is getting OAuth2 token safe to fetch client-side and pass to server-side?

I'm integrating my application with external service. My application will exchange data with the external service in context of some user. Data exchange will be done in background on server-side. User ...
Politechniczny's user avatar
1 vote
0 answers
127 views

Access token lifetime when tokens are client certificate constrained

When we use mTLS we can use access tokens constrained to client certificate that was sent to token endpoint to receive the access token. In this case, if only the client that send this request can use ...
Szyszka947's user avatar
23 votes
5 answers
12k views

If JWT tokens are stateless how does the auth server know a token is revoked?

I've read that JWT tokens are stateless and you don't need to store the tokens in the database and that this prevents a look up step. What I don't understand is that according to RFC 7009 you can ...
Gilles's user avatar
  • 635
1 vote
0 answers
121 views

Encrypting authorization response with state

Imagine a authorization_code flow which MUST use PAR and after succeded authorization at authorization_endpoint instead of returning code and state returns only code, but this response is encrypted ...
Szyszka947's user avatar
1 vote
0 answers
97 views

Migrate OAuth 2.0 to OAuth 2.1

I have a old Spring Cloud gateway working with Keyclock server. I don't have Web UI for login because the project is a Rest API. OAuth 2.0 is used with Grant type password. I want to migrate to OAuth ...
Peter Penzov's user avatar
0 votes
0 answers
131 views

Why is there 2 separate, different endpoint in OAuth2? (/authorization and /token)

I know they both serve different purpose, but that does not answer why the need for 2 separate endpoint when it could have been done using just 1 endpoint? We pass different parameters when we request ...
Farid-EN's user avatar
0 votes
0 answers
75 views

Attack using the same scope names within differents api resources with OpenID Connect / OAuth2

Assume that we have a client X and client Y. There's also api resources: api-resource-1 and api-resource-2, and api scopes: test.read and test.write. Client X is allowed to test.read within api-...
Szyszka947's user avatar

1
2 3 4 5
9