Questions tagged [oauth2]
OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
286
questions
0
votes
0answers
25 views
Choosing oauth flow-type for on-prem installations
So according to the resources found here and in the official protocol documents I have a good grasp on what flow-types to use for what client-type. According to the following picture (credit: https://...
0
votes
0answers
10 views
Should OAuth2 proprietary client authorization prompt a confirmation window?
Given a company named X.
X has an OAuth 2 API available for its proprietary clients and also for 3rd party clients.
When a user P enters the process of authorizing a client, it is prompted with a ...
1
vote
1answer
62 views
Is it ok to share relevant login information on an API's public endpoint?
I have an (https-only) API that uses OAuth2 for authentication and authorization via access tokens.
Any request to the API needs an access token to the Authorization header. The API validates that ...
0
votes
0answers
24 views
How does Firebase app SHA-1 verification work?
Firebase iOS and Android applications authenticate with their servers using OAuth 2. Google makes this easy by providing a JSON file with the credentials and a library that handles authentication. ...
0
votes
0answers
21 views
OpenID Connect with user bound roles and M2M access
I'm trying to get my head straight about how to properly design a OpenID connect provider and the roles to use with it. I understand the basic of scopes, claims and the different flow one can use. ...
0
votes
1answer
50 views
Which Authentication mechanism to choose for PCI-DSS system
I want to create Angular 9 + Spring Boot application with strong security complaint to PCI-DSS security standard.
Which security protocol is preferred for user sessions in order to have high security ...
0
votes
0answers
34 views
Securing my own routes with “Login with X” and OAuth2
I have a single page application which communicates with a REST backend. I want to require a user to login before being allowed to access certain routes. I want to offload user authentication to ...
0
votes
2answers
78 views
OAuth2 - Authorization Code Flow - Do I really Need this for simple login/authentication?
I have been reading a lot about OAuth 2 flow recently, and I wanted to ask if this is applicable to the app that I am building, and what type of security I should be using.
Context
We have a native ...
0
votes
0answers
34 views
What is the correct way to implement the OAuth2 state parameter?
I'm trying to understand how to properly implement state in an OAuth2 client, to mitigate CSRF attacks. This answer explains the attack scenario pretty well, to summarize:
The attacker starts the ...
1
vote
1answer
56 views
Can OpenID Connect be used to implement social login?
Using OAuth to implement social login is insecure (https://tools.ietf.org/html/rfc6819#section-4.4.2.6) because OAuth doesn't provide authentication, only authorisation. The issue arises because the ...
1
vote
1answer
34 views
how does spotify do oauth(+open id connect) from the desktop app?
I understand what the workflow would be from the webpage, but how does oauth+open id work for desktop apps as they cannot open a browser page within the app. I see that when I click on log in with ...
1
vote
2answers
43 views
OAuth authorization code grant with exposed client secret
Let's assume that a client has the client secret exposed somewhere.
What are the risks that the client and its users are exposed to?
Are those the same as having implemented the implicit flow from ...
1
vote
1answer
54 views
What are disadvantages of a reverse OTP flow, where OTP is visible on a website and is retyped on authenticated mobile client?
I want to authenticate a user on a 3rd party website (this is more or less an OAuth flow, so this website will be able to perform actions on behalf of my user afterwards, e.g. receive some of her data)...
1
vote
2answers
76 views
Where should 'reset password' functionality be?
We've recently overhauled the backend to our mobile app from having a very basic authentication mechanism that went through the API to having both an authentication server and an API server, with the ...
1
vote
0answers
18 views
Is an “inversed” Device Authorization Grant flow secure for authenticating a daemon/service native app to a web server?
I am working on a hobby project which will involve a web server (hosted and owned by me) and a native app (which will communicate with the web server periodically) an end-user can install via a deb/...
0
votes
0answers
26 views
Are OAuth Authenication Codes meant to be transient or permanent?
I've been learning a bit about the OAuth web application flow.
One thing that is not clear to me is if the Authentication Code generated from step 5 of this diagram is something that can be used ...
0
votes
1answer
72 views
What are the security risks with rolling out your own Authorisation server implementation
Even though I'm working within .Net Core, this question is generally applicable to other platforms as well.
My question is to do with: Using a framework (such as IdentityServer) to manage ...
0
votes
1answer
47 views
Why does Authorization Code flow need the authorization code?
I've implemented Auth Code flow with PKCE on my server, but I'm still not entirely clear on why I'm doing it. I've read through the IETF documentation and I get flashes of what seems like ...
0
votes
1answer
31 views
Authorisation Request & Authorisation Grant In OAuth 2.0
I do not grasp the concept of the first steps in the OAuth process: Authorisation Request and Authorisation Grant. As far as I know:
User wants to access client by authorizing Service API
User clicks ...
1
vote
1answer
58 views
Custom OAuth2 Authorization Server / Identity Provider
I am currently trying to implement my own Authorization Server following the OAuth2 protocol PKCE flow, coupled with my own Identity Provider. The idea is to be able to reuse the same identity ...
4
votes
1answer
53 views
Exploitation of client_id in OAuth
We have a web app where the back end is composed of APIs. We use OAuth to authorize the web app's call to the APIs. We all know that in OAuth, there is always the Authorization endpoint used to get ...
0
votes
0answers
28 views
'confirm old password' OAuth equivalent
I want to allow users to link/unlink several OAuth providers to their account.
How can I mitigate 'office prank' attacks, when someone can access my computer while I am away?
My account: OAuth with ...
0
votes
0answers
44 views
OAuth2.0/OIDC Public Clients: What implementation is recommended for authentication & scopes consent when there is no third-party involved?
Context
I am developing a solution with
Two clients, a mobile one and an SPA.
An authorization server under my control.
A resource server / identity provider, that provides user data and features ...
0
votes
1answer
30 views
Does OAuth2 state parameter need to be cryptographically secure?
In OAuth2, as part of the authorization request, we generate a random string and pass it with the state parameter, so that when we get the response, we can ascertain that the response is a result of ...
2
votes
0answers
90 views
Does my app need authentication in addition to Spotify authorization?
I have an app that revolves entirely around Spotify. I have followed the authorization guide from Spotify and am using the Authorization Code Flow so the access token can be refreshed. My thinking was ...
0
votes
0answers
33 views
openID connect without resource owner authorization
the use case I have is, there are multiple systems that access each other over the internet, all sharing the same user base. openId connect seems to be the way of identity management. this means every ...
0
votes
0answers
35 views
Is it correct to use AWS Cognito groups as user roles?
I trying to implement authN/authZ for my application using Spring Security 5.2.2 and OAuth2/openid connect protocols. I use AWS Cognito as an identity provider and I'm trying to implement role-based ...
0
votes
0answers
21 views
Does OAuth2 state have to be server side?
I have a "stateless" OAuth2 client for the Authorization Code flow written like thus:
Involved parties: Untrusted User, Controlled OAuth2 Client, External OAuth2 Service.
User sends client.invalid/...
1
vote
1answer
52 views
Using the user's password hash as their refresh token (with the password hash in their JWT)?
I'm building an authentication system that I want to be secure. I plan on using JWT tokens as the main authentication mechanism. When the token expires, the server will return a "401 unauthorized" ...
0
votes
1answer
41 views
Difference between Form Post Response and Authorization Code
I am trying to find the best OAuth2 mechanism for our VueJS Single Page Application (SPA) hosted on our own backend. From my research, Authorization Code should be sufficient, as long as the redirect ...
0
votes
1answer
35 views
Risks associated with a compromised external Security token server
Consider the following architecture:
An on premise Web API 2 [Written in C# hosted in IIS] which uses OAuth 2 authentication [ Implicit Flow ] to secure itself. This API acts as the data source by ...
2
votes
1answer
51 views
OIDC/OAuth2 id_token and it's usage in the client application
I've recently migrated my application to use external provider for login so that my application doesn't have to deal with auth and storing user credentials. For this I'm using OpenID Connect (OIDC) ...
0
votes
1answer
107 views
Assuming I own the client. Is it acceptable to embed my authorization servers login page in an iframe?
We have an authorization server which exposes a login page, we would like to authenticate users in our single page app using this authorization server. My employer does not want to redirect users to ...
0
votes
1answer
59 views
Is it safe to use third party OIDC ID Token as our APIs bearer token?
Practically, we are outsourcing the authentication of our users to a third party application, that's, needless to say, external to our system. I am not sure if this is actually advisable, but from our ...
3
votes
1answer
206 views
Where to store refresh token if not in local storage?
In general it's recommended not to store refresh tokens in local storage. The Auth0 documentation advises against it.
Even though I am aware of the underlying threats, what I am not aware is if there ...
0
votes
0answers
38 views
PKCE vs Dynamic Client Registration for public clients
The RFC recommends to use PKCE for web (public client)/native apps.
It's not stated that Dynamic Client Registration (DCR) is bad but it's not stated as an alternative either.
I am wondering if there ...
2
votes
1answer
67 views
Isn't Facebook Apptoken Oauth2 client credential unsecure since it sends login credentials request in GET URL?
Facebook Apptoken uses OAuth2 client credential code. But the client_id and client_secret are sent to the servier via HTTP GET method. Isn't this unsecure ?
For instance, any node that has logging ...
1
vote
1answer
65 views
Netflix logout does not revoke secure netflix ids
I am learning about microservice security and I wanted to see if Netflix really logs me out.
While logged into Netflix, I opened https://www.netflix.com/YourAccount and in inspector viewed headers I ...
0
votes
0answers
44 views
When should refresh tokens be stored in a database?
I have a native Windows application programmed in .NET Core that needs to call a Web API. I intend to have the user enter credentials periodically, receiving a refresh token from my auth server for ...
0
votes
0answers
64 views
Authorization Code Grant Flow for web-app with backend on separate domain (same origin)
We have had a security consultant make a recommendantion of an approach that does not follow the IEFF best-practice document (https://tools.ietf.org/html/draft-ietf-oauth-browser-based-apps-04#section-...
0
votes
1answer
66 views
Combining User Context in Machine-2-Machine OAuth2 Client Credential Flow
I have a REST API that is used by 2 separate application and is authenticating them by M2M OAuth2 Client Credential Flow.
One of the two application is an automation service without user context. The ...
0
votes
1answer
38 views
What Is The Mechanism To Refresh Access Token
In RFC 6749 Section 4.4 regarding Client Credentials Grant:
4.4. Client Credentials Grant
The client can request an access token using only its client
credentials (or other supported means of ...
2
votes
4answers
198 views
Logging access tokens
In our REST API we write a log entry for every call made, including things like the query string, response code, duration etc... along with a SHA256 hash of the access token used. The thought process ...
0
votes
0answers
42 views
Are browsers vulnerable to Authorization Code Interception Attacks?
RFC7636 states "The operating systems must allow a custom URI scheme to be registered by multiple applications." Are web apps vulnerable to this attack? Could a web app link open a malicious app via a ...
0
votes
1answer
58 views
JWT with a single audience claim accessing a resource server with multiple configured audience values
When a JWT id_token with a single audience is presented to a resource server which has multiple configured audience values, should the resource server reject the validity of the token on the basis of ...
1
vote
0answers
168 views
In memory local variables (javascript), OAuth token storage, and XSS
Quoting from a long-dead Auth0 forum post: https://community.auth0.com/t/why-is-storing-tokens-in-memory-recommended/17742
"Any values stored in memory are still vulnerable to XSS attacks since
...
0
votes
2answers
82 views
Handling of 3rd party OAuth2 tokens
after some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd ...
0
votes
1answer
56 views
OAuth provider that authenticates only by phone? [closed]
I'm trying to find an OAuth provider that doesn't require a password but instead, it authenticates the user by sending a message to a phone number. I'm thinking that it would be using the phone the ...
0
votes
1answer
63 views
May I use OAuth2 for non third-party applications?
I need some help to understand my problem.
I'm studying a way to provide authentication for my applications.
My scenario:
I've a set of APIs with restricted access and users that will be ...
1
vote
2answers
101 views
What is the purpose of the OAuth2 client secret?
A typical OAuth2 Authorization Code Flow scenario looks like this:
What I'm not understanding is the purpose of the client secret in steps 6 and 7. If the auth server is guaranteed to redirect back ...
