Questions tagged [oauth2]

OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0

Filter by
Sorted by
Tagged with
0
votes
0answers
25 views

Choosing oauth flow-type for on-prem installations

So according to the resources found here and in the official protocol documents I have a good grasp on what flow-types to use for what client-type. According to the following picture (credit: https://...
0
votes
0answers
10 views

Should OAuth2 proprietary client authorization prompt a confirmation window?

Given a company named X. X has an OAuth 2 API available for its proprietary clients and also for 3rd party clients. When a user P enters the process of authorizing a client, it is prompted with a ...
1
vote
1answer
62 views

Is it ok to share relevant login information on an API's public endpoint?

I have an (https-only) API that uses OAuth2 for authentication and authorization via access tokens. Any request to the API needs an access token to the Authorization header. The API validates that ...
0
votes
0answers
24 views

How does Firebase app SHA-1 verification work?

Firebase iOS and Android applications authenticate with their servers using OAuth 2. Google makes this easy by providing a JSON file with the credentials and a library that handles authentication. ...
0
votes
0answers
21 views

OpenID Connect with user bound roles and M2M access

I'm trying to get my head straight about how to properly design a OpenID connect provider and the roles to use with it. I understand the basic of scopes, claims and the different flow one can use. ...
0
votes
1answer
50 views

Which Authentication mechanism to choose for PCI-DSS system

I want to create Angular 9 + Spring Boot application with strong security complaint to PCI-DSS security standard. Which security protocol is preferred for user sessions in order to have high security ...
0
votes
0answers
34 views

Securing my own routes with “Login with X” and OAuth2

I have a single page application which communicates with a REST backend. I want to require a user to login before being allowed to access certain routes. I want to offload user authentication to ...
0
votes
2answers
78 views

OAuth2 - Authorization Code Flow - Do I really Need this for simple login/authentication?

I have been reading a lot about OAuth 2 flow recently, and I wanted to ask if this is applicable to the app that I am building, and what type of security I should be using. Context We have a native ...
0
votes
0answers
34 views

What is the correct way to implement the OAuth2 state parameter?

I'm trying to understand how to properly implement state in an OAuth2 client, to mitigate CSRF attacks. This answer explains the attack scenario pretty well, to summarize: The attacker starts the ...
1
vote
1answer
56 views

Can OpenID Connect be used to implement social login?

Using OAuth to implement social login is insecure (https://tools.ietf.org/html/rfc6819#section-4.4.2.6) because OAuth doesn't provide authentication, only authorisation. The issue arises because the ...
1
vote
1answer
34 views

how does spotify do oauth(+open id connect) from the desktop app?

I understand what the workflow would be from the webpage, but how does oauth+open id work for desktop apps as they cannot open a browser page within the app. I see that when I click on log in with ...
1
vote
2answers
43 views

OAuth authorization code grant with exposed client secret

Let's assume that a client has the client secret exposed somewhere. What are the risks that the client and its users are exposed to? Are those the same as having implemented the implicit flow from ...
1
vote
1answer
54 views

What are disadvantages of a reverse OTP flow, where OTP is visible on a website and is retyped on authenticated mobile client?

I want to authenticate a user on a 3rd party website (this is more or less an OAuth flow, so this website will be able to perform actions on behalf of my user afterwards, e.g. receive some of her data)...
1
vote
2answers
76 views

Where should 'reset password' functionality be?

We've recently overhauled the backend to our mobile app from having a very basic authentication mechanism that went through the API to having both an authentication server and an API server, with the ...
1
vote
0answers
18 views

Is an “inversed” Device Authorization Grant flow secure for authenticating a daemon/service native app to a web server?

I am working on a hobby project which will involve a web server (hosted and owned by me) and a native app (which will communicate with the web server periodically) an end-user can install via a deb/...
0
votes
0answers
26 views

Are OAuth Authenication Codes meant to be transient or permanent?

I've been learning a bit about the OAuth web application flow. One thing that is not clear to me is if the Authentication Code generated from step 5 of this diagram is something that can be used ...
0
votes
1answer
72 views

What are the security risks with rolling out your own Authorisation server implementation

Even though I'm working within .Net Core, this question is generally applicable to other platforms as well. My question is to do with: Using a framework (such as IdentityServer) to manage ...
0
votes
1answer
47 views

Why does Authorization Code flow need the authorization code?

I've implemented Auth Code flow with PKCE on my server, but I'm still not entirely clear on why I'm doing it. I've read through the IETF documentation and I get flashes of what seems like ...
0
votes
1answer
31 views

Authorisation Request & Authorisation Grant In OAuth 2.0

I do not grasp the concept of the first steps in the OAuth process: Authorisation Request and Authorisation Grant. As far as I know: User wants to access client by authorizing Service API User clicks ...
1
vote
1answer
58 views

Custom OAuth2 Authorization Server / Identity Provider

I am currently trying to implement my own Authorization Server following the OAuth2 protocol PKCE flow, coupled with my own Identity Provider. The idea is to be able to reuse the same identity ...
4
votes
1answer
53 views

Exploitation of client_id in OAuth

We have a web app where the back end is composed of APIs. We use OAuth to authorize the web app's call to the APIs. We all know that in OAuth, there is always the Authorization endpoint used to get ...
0
votes
0answers
28 views

'confirm old password' OAuth equivalent

I want to allow users to link/unlink several OAuth providers to their account. How can I mitigate 'office prank' attacks, when someone can access my computer while I am away? My account: OAuth with ...
0
votes
0answers
44 views

OAuth2.0/OIDC Public Clients: What implementation is recommended for authentication & scopes consent when there is no third-party involved?

Context I am developing a solution with Two clients, a mobile one and an SPA. An authorization server under my control. A resource server / identity provider, that provides user data and features ...
0
votes
1answer
30 views

Does OAuth2 state parameter need to be cryptographically secure?

In OAuth2, as part of the authorization request, we generate a random string and pass it with the state parameter, so that when we get the response, we can ascertain that the response is a result of ...
2
votes
0answers
90 views

Does my app need authentication in addition to Spotify authorization?

I have an app that revolves entirely around Spotify. I have followed the authorization guide from Spotify and am using the Authorization Code Flow so the access token can be refreshed. My thinking was ...
0
votes
0answers
33 views

openID connect without resource owner authorization

the use case I have is, there are multiple systems that access each other over the internet, all sharing the same user base. openId connect seems to be the way of identity management. this means every ...
0
votes
0answers
35 views

Is it correct to use AWS Cognito groups as user roles?

I trying to implement authN/authZ for my application using Spring Security 5.2.2 and OAuth2/openid connect protocols. I use AWS Cognito as an identity provider and I'm trying to implement role-based ...
0
votes
0answers
21 views

Does OAuth2 state have to be server side?

I have a "stateless" OAuth2 client for the Authorization Code flow written like thus: Involved parties: Untrusted User, Controlled OAuth2 Client, External OAuth2 Service. User sends client.invalid/...
1
vote
1answer
52 views

Using the user's password hash as their refresh token (with the password hash in their JWT)?

I'm building an authentication system that I want to be secure. I plan on using JWT tokens as the main authentication mechanism. When the token expires, the server will return a "401 unauthorized" ...
0
votes
1answer
41 views

Difference between Form Post Response and Authorization Code

I am trying to find the best OAuth2 mechanism for our VueJS Single Page Application (SPA) hosted on our own backend. From my research, Authorization Code should be sufficient, as long as the redirect ...
0
votes
1answer
35 views

Risks associated with a compromised external Security token server

Consider the following architecture: An on premise Web API 2 [Written in C# hosted in IIS] which uses OAuth 2 authentication [ Implicit Flow ] to secure itself. This API acts as the data source by ...
2
votes
1answer
51 views

OIDC/OAuth2 id_token and it's usage in the client application

I've recently migrated my application to use external provider for login so that my application doesn't have to deal with auth and storing user credentials. For this I'm using OpenID Connect (OIDC) ...
0
votes
1answer
107 views

Assuming I own the client. Is it acceptable to embed my authorization servers login page in an iframe?

We have an authorization server which exposes a login page, we would like to authenticate users in our single page app using this authorization server. My employer does not want to redirect users to ...
0
votes
1answer
59 views

Is it safe to use third party OIDC ID Token as our APIs bearer token?

Practically, we are outsourcing the authentication of our users to a third party application, that's, needless to say, external to our system. I am not sure if this is actually advisable, but from our ...
3
votes
1answer
206 views

Where to store refresh token if not in local storage?

In general it's recommended not to store refresh tokens in local storage. The Auth0 documentation advises against it. Even though I am aware of the underlying threats, what I am not aware is if there ...
0
votes
0answers
38 views

PKCE vs Dynamic Client Registration for public clients

The RFC recommends to use PKCE for web (public client)/native apps. It's not stated that Dynamic Client Registration (DCR) is bad but it's not stated as an alternative either. I am wondering if there ...
2
votes
1answer
67 views

Isn't Facebook Apptoken Oauth2 client credential unsecure since it sends login credentials request in GET URL?

Facebook Apptoken uses OAuth2 client credential code. But the client_id and client_secret are sent to the servier via HTTP GET method. Isn't this unsecure ? For instance, any node that has logging ...
1
vote
1answer
65 views

Netflix logout does not revoke secure netflix ids

I am learning about microservice security and I wanted to see if Netflix really logs me out. While logged into Netflix, I opened https://www.netflix.com/YourAccount and in inspector viewed headers I ...
0
votes
0answers
44 views

When should refresh tokens be stored in a database?

I have a native Windows application programmed in .NET Core that needs to call a Web API. I intend to have the user enter credentials periodically, receiving a refresh token from my auth server for ...
0
votes
0answers
64 views

Authorization Code Grant Flow for web-app with backend on separate domain (same origin)

We have had a security consultant make a recommendantion of an approach that does not follow the IEFF best-practice document (https://tools.ietf.org/html/draft-ietf-oauth-browser-based-apps-04#section-...
0
votes
1answer
66 views

Combining User Context in Machine-2-Machine OAuth2 Client Credential Flow

I have a REST API that is used by 2 separate application and is authenticating them by M2M OAuth2 Client Credential Flow. One of the two application is an automation service without user context. The ...
0
votes
1answer
38 views

What Is The Mechanism To Refresh Access Token

In RFC 6749 Section 4.4 regarding Client Credentials Grant: 4.4. Client Credentials Grant The client can request an access token using only its client credentials (or other supported means of ...
2
votes
4answers
198 views

Logging access tokens

In our REST API we write a log entry for every call made, including things like the query string, response code, duration etc... along with a SHA256 hash of the access token used. The thought process ...
0
votes
0answers
42 views

Are browsers vulnerable to Authorization Code Interception Attacks?

RFC7636 states "The operating systems must allow a custom URI scheme to be registered by multiple applications." Are web apps vulnerable to this attack? Could a web app link open a malicious app via a ...
0
votes
1answer
58 views

JWT with a single audience claim accessing a resource server with multiple configured audience values

When a JWT id_token with a single audience is presented to a resource server which has multiple configured audience values, should the resource server reject the validity of the token on the basis of ...
1
vote
0answers
168 views

In memory local variables (javascript), OAuth token storage, and XSS

Quoting from a long-dead Auth0 forum post: https://community.auth0.com/t/why-is-storing-tokens-in-memory-recommended/17742 "Any values stored in memory are still vulnerable to XSS attacks since ...
0
votes
2answers
82 views

Handling of 3rd party OAuth2 tokens

after some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd ...
0
votes
1answer
56 views

OAuth provider that authenticates only by phone? [closed]

I'm trying to find an OAuth provider that doesn't require a password but instead, it authenticates the user by sending a message to a phone number. I'm thinking that it would be using the phone the ...
0
votes
1answer
63 views

May I use OAuth2 for non third-party applications?

I need some help to understand my problem. I'm studying a way to provide authentication for my applications. My scenario: I've a set of APIs with restricted access and users that will be ...
1
vote
2answers
101 views

What is the purpose of the OAuth2 client secret?

A typical OAuth2 Authorization Code Flow scenario looks like this: What I'm not understanding is the purpose of the client secret in steps 6 and 7. If the auth server is guaranteed to redirect back ...

1
2 3 4 5 6