Questions tagged [oauth2]
OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
0
votes
0answers
27 views
How Secure is OAuth2 for Web Applications?
Let’s consider a single page client side application, developed using HTML and Javascript.
In this case, even if the implicit or authentication code flow is being used to request Access Tokes, still ...
1
vote
1answer
69 views
Is it a good idea to notify a user that they signed up with a social-login account?
Say my website provides three main ways to signup/signin: Google, Facebook and typical username/password. Is it a good idea to flash "Please login using your Google account" if a user tries to login ...
0
votes
1answer
26 views
Revoke OAuth2 Token For Mobile App
When a user logs into my mobile app it uses OAuth to authenticate them and generates a token. The token is then checked against each subsequent request. Each user account in my application has an ...
2
votes
1answer
34 views
Is it secure to handle the OAuth 2 Authorization callback from a CDN?
This question is in the context of the OAuth 2.0 Authorization Framework.
Consider a web application that is backed by a first-party API but relies on a third-party authorization server for SSO.
Say ...
1
vote
0answers
44 views
Tunelling an Authenticated User Across Microservices Securely
On a platform which follows the OAuth 2.0 framework for authorization and a microserivce based architecture, what is a secure way to pass a user from one microservice to another on the same platform ...
0
votes
0answers
30 views
How to properly store OAuth 2.0 client_id and client_secret in a web application?
In the PoC (Proof of Concept) that I'm currently developing, data from an API is consumed and OAuth 2.0 is required for authentication. The application is already working as expected, the users are ...
0
votes
0answers
12 views
implementing push api for files using oauth2
i want to implement a push api similar to Garmin Connect API.
this api allows the clients to get the data of garmin users, as garmin will push to the clients the user's files whenever created.
we ...
3
votes
1answer
76 views
Is there any way for server side to verify the application integrity during OAuth2 workflow
During OAuth2 PKCE workflow, the native application (installed on Android/iOS device) issues the authorize request to server and exchange the OAuthtokens.
For server side, is there any way that we ...
0
votes
0answers
12 views
Clarification needed on OAuth 2.0 Framework RFC content
In the introduction part of OAuth 2.0 RFC document, the 4th bullet mentions as follows:
Resource owners cannot revoke access to an individual third party
without revoking access to all ...
1
vote
1answer
91 views
Found how to get Oauth2 client_id along matching secret but redirect_uri is whitelisted as requirement. Is it still safe?
If you get an OAuth 2.0 client_id along with a matching secret, you can in theory impersonate the target website.
You trick the victim into visiting your URL;
Through the client_id and the matching ...
1
vote
1answer
66 views
JWT access tokens: Too much information?
I've recently encountered the practice of systems using JWTs as Access Tokens. I have a concern and I'm not sure if it's unfounded:
I associate JWTs with the OpenID Connect protocol, where there are ...
2
votes
4answers
75 views
How can a OAuth2 resource server relate an access token to the user that authorized it to prevent unauthorized access to other user resources?
I'd appreciate if someone could clear up if, according to the OAuth2 RFC, the resource server could infer the user associated to an access token or not, or even if that is expected.
Let’s assume the ...
2
votes
1answer
152 views
Using third party authentication like google/facebook to login to a site, is there any security risk when the site is hacked?
Sites like stackoverflow, quora, and many more offers sign in from Google/Facebook. In the event that there is a data breach or the site is hacked, is there any security risk to your Google/Facebook ...
1
vote
1answer
23 views
Oauth2 PKCE - Can the refresh_token be trusted?
If a have a mobile that is authorized against my server using PKCE, which allows it to get a access_token and a refresh_token, to what extent should I trust that the app can use the refresh_token from ...
1
vote
1answer
37 views
What are the pieces of information delivered in a user profile at the end of a OpenID Connect flow?
From what I understand about using OpenID Connect (over OAuth2), is that we end up with some JSON containing information about the user. That information is transported as a JSON Web Token.
➥ What ...
-1
votes
0answers
45 views
Understanding facebook login token
I have a client-server rest-api application. I want use facebook login to authenticate user. When I logged in with facebook using fb api I obtain an access-token. Can I use this token to authenticate ...
0
votes
1answer
24 views
How to implement magic link sign in with oAuth2
We have two web applications. One is developed in Django, let's call it portal (oAuth2 provider). Another is developed in PHP, let's call it client.
We want to display a link for authenticated users ...
2
votes
0answers
52 views
How to provide granular API security using OAuth scopes and claims
I'm trying to work out how best to secure an API using oAuth scopes and/or claims. I'm unsure on which I should be using.
My setup is as follows:
All users sign in to signin.domain.com
There are ...
0
votes
1answer
116 views
What is the example parameter in the OAuth 2.0 RFC
In section 4.1.4 of the OAuth 2.0 RFC, it gives an example of an access token response:
An example successful response:
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
...
0
votes
1answer
27 views
A Method for Generating Un-Guessable Client Identifiers
I am implementing an OAuth 2.0 authorisation server. As part of client registration process I want to generate the unique client identifier for this client.
The method I have chosen is to take all ...
1
vote
0answers
28 views
Nested API security
What are best practices for securing nested APIs?
Here is an example:
User browser (Authenticated already) -> REST API A -> REST API B (internal and may or may not be exposed to internet)
Typically,...
2
votes
1answer
50 views
What is the proper flow for authentication?
I'm tasked with migrating a group of .Net WebForms applications from a current custom username/password login scheme to an oauth2/openid connect based authentication and authorization. This specific ...
1
vote
1answer
127 views
Why do we use Oauth2 instead of Basic Auth in server to server communication using SSL?
Why do some API providers ask you to implement Oauth2 in server to server communication that's available only over HTTPS?
In the frontend (app or webapp), Oauth2 is useful to protect the user ...
4
votes
1answer
168 views
Can oauth2 “state” parameter be used to avoid using session cookies to identify user
https://tools.ietf.org/html/rfc6749#section-4.1.1 states:
4.1.1. Authorization Request"
"state"
RECOMMENDED. An opaque value used by the client to maintain
state between the ...
2
votes
1answer
32 views
Why should authorization servers document the size of client identifiers?
In section 2.1 of the OAuth2.0 RFC, it states the following regarding the client identifier:
The authorization server SHOULD document the size of any identifier it issues.
What is the point of ...
0
votes
1answer
81 views
What a malicious user could do with a refresh token that cannot be revoked and has 1 year expiry time?
In ADFS 4.0 a refresh token cannot be renowed without passing through an authorization request flow (asking the user again for credentials) and cannot be revoked.
I'm forced to put a 1 year lifetime ...
0
votes
0answers
57 views
Oauth2 vulnerable authentication flow with state parameter
As per my understanding, this is the standard authentication flow to log in a user using auth service provider;
But I've seen some framework and examples, where they build authentication URI at ...
1
vote
1answer
130 views
OAuth 2 Implicit grant type for first party SPA - Most secure and sensible way
My aim is to secure my stateless API and only allow the registered first-party clients (SPA) to consume my resources. There is not going to be any third party clients in my scenario.
I know Oauth 2 ...
1
vote
0answers
32 views
OAuth2.0 and RESTful API
So I'm creating some RESTful API endpoints which use Bearer tokens for authorization. I want to use OAuth2.0 to get the access tokens for these. But I can't get my head around how to get the OAuth2.0 ...
0
votes
0answers
64 views
OAuth 2 Client Credentials within Mobile App
I am currently developing a mobile app that communicates with an OAuth server. The server I am trying to access provides two grants: Authorisation Code and a device PIN grant (not sure if it's part of ...
1
vote
1answer
34 views
How does the authorization work after authentication using OpenID Connect
Suppose that a client gets an ID token and access token from the auth server after successful authentication. The client now sends a request to the application server (request contains access token ...
1
vote
2answers
326 views
Storing OAuth access and refresh tokens in non HttpOnly cookies
I am using OAuth auth code flow to generate access and refresh tokens and then I store them in two browser cookies that are not HttpOnly and send them back too the client.
The cookies need to be non ...
3
votes
1answer
91 views
Google login button - what prevents an rogue app from stealing a token?
Here are steps to setup a Google login button on a web client:
https://developers.google.com/identity/sign-in/web/sign-in
When click on the Google login button this pops up:
All the interactions are ...
1
vote
1answer
206 views
How to use Oauth2 and JWT to secure microservice architecture?
We have been investigating proper mechanism to secure microservises that we are going to provide as API endpoints via API manager application.
Fundamentally we need stateless security mechanism like ...
0
votes
1answer
214 views
Reasons to transition Kerberos secured web applications to OAuth2/OpenId
We have five internal web applications written in Java / AngularJs that are secured via Kerberos/ Spnego ( Spring Security implementation) . We are looking to transition these apps to AWS ( EBS) .
...
1
vote
1answer
86 views
Is the OAuth2 authentication code long enough to be secure?
I have recently started working with the OAuth2 authentication flow. In using it, I see that in the authcode flow, the client allows the AuthServer to authenticate a user, and then returns an ...
1
vote
0answers
27 views
OAuth2 and linking resources of one owner to another person account
I'm implementing client side OAuth and I'm worried about the following scenario.
There is application A registered with service B that is offering access to its user resources - authorized by OAuth (...
0
votes
0answers
37 views
Which OAuth 2 flow is used by larger companies like Twitter and Facebook and why did they choose it?
Based on the user experience it seems like Twitter and Facebook use the resource owner password credential flow. From what I've read authorization code flow is the most secure option for a standard ...
1
vote
0answers
402 views
Auth0 vs Firebase = oidc vs Firebase Tokens
I am trying to choose between Auth0 and Firebase as my identity provider. I am building a SPA with a Backend API and I would like to use Auth0 or Firebase for all the logic regarding users/passwords/...
0
votes
0answers
35 views
How to safely store OAuth2 credentials in a Desktop application
I've been searching for a good answer to this problem for a while now, and have seen questions that could be duplicates, but none of them seem to have good/definitive answers that work for my case.
I ...
0
votes
0answers
123 views
In google OAuth callback, is providing redirect_uri by client a security risk?
for example, at callback url of google oauth,to convert 'code' to access_token, I need:
Client side href:
https://accounts.google.com/o/oauth2/auth?scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%...
1
vote
1answer
53 views
OIDC - what is the point of two separate tokens - access and id?
I struggle to understand why don't we just have a single token that serves both purposes - authorisation and authentication?
In some sense, the access token does more than just authorisation. It also ...
5
votes
1answer
559 views
Do I need CSRF protection in this setup with a REST API backed with oauth2 and a basic auth SSO auth server?
I've seen the answer Is CSRF possible if I don't even use cookies? but there are 2 conflicting answers and the question itself doesn't provide that much information either.
I am creating a REST ...
2
votes
0answers
400 views
Token Exchange at a REST API Gateway to federate authentication while maintaining detailed authorization (think ABAC) within the API?
I'm on the verge of creating a service within our resource server that would exchange an externally generated access token for an internally generated access token. However, this feels wrong. I have ...
0
votes
0answers
20 views
Why is auth_code server over redirect URI than on a webpage in OAuth 2.0?
Per three-legged OAuth standard, an auth_code is served as an URL parameter, while the URL being the redirect_uri specified during client registration. I guess it's an HTTP 302 response sent by the ...
1
vote
0answers
431 views
Should OAuth2 Access Token support multiple audiences?
I am considering a usecase where an OAuth2 client obtains an access token to access multiple resource servers.
Based on spec, to protect against token redirect attack:
to deal with token redirect,...
2
votes
2answers
781 views
OAuth - How does the Resource Server validate the access token is not for any other Resource Server?
Let's take an example where there are two resource servers - RS1 and RS2 and there is one authorization server - AS.
Both resource servers - RS1 and RS2 use authorization server - AS
If a client ...
5
votes
1answer
229 views
Need of scope in OAuth Client Credentials Flow
For me, Client Credential flow is like client is asking access token for itself - not on behalf of some user.
Then, why would client like to limit its own scope? What is the benefit of scopes in ...
4
votes
1answer
296 views
How to get better IAM understanding
I'm getting interested in Identity and Access Management (IAM), but I find it hard to find complete and understandable explanations that suit me, surely because I started wrong.
I began with ...
2
votes
1answer
322 views
Why CORS preflight is not available for POST requests when Content-Type is application/x-www-form-urlencoded
In oauth2 for single page application(SPA), we can revoke the access tokens of the implicit grant type by using an ajax request(this is not recommended now). I tried to do a request like below from ...
