Questions tagged [oauth2]
OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
409
questions
0
votes
0
answers
16
views
OAuth2 - implicit flow sign-out
I'm using a service that implements OAuth2
Because of some network issues, I need to use OAuth implicit flow in a component I'm developing (I know, it's terrible - we are working on the way to ...
- 101
0
votes
0
answers
21
views
Is it worth replacing session based traditional auth with OpenID-Connect?
Details: traditional web-application with react frontend & nodejs API backend. FE & BE served on the same domain. FE -> example.com, API -> example.com/api
We have users and some of the ...
- 141
0
votes
1
answer
24
views
Using id_token for all user data instead of userinfo endpoint in OIDC
I need to provide high security for user data. So I would have to encrypt userinfo_endpoint response (despite using TLS, these are the requirements I got).
But encrypting userinfo_endpoint response ...
- 187
0
votes
1
answer
24
views
JWT and JWKS for server to server calls
I have an application that uses an OAUTH2 flow based on JWT and JWKS.
JWT and JWKS are used for the "client authentication": when the application needs to call the endpoint to flip the ...
- 633
2
votes
1
answer
52
views
Oauth: redirect uri validation [duplicate]
As per the below resource: https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uri-validation/
we should validate the redirect url at 3 points:
at time of app registration
when the auth flow ...
- 263
1
vote
0
answers
36
views
Sign vs hash HTTP body request
I use OAuth2 private_key_jwt authentication scheme to authenticate clients. Also, I need to be sure that request body isn't modified.
I see two ways:
In token which I use to authenticate client I can ...
- 187
2
votes
2
answers
171
views
Encrypted instead of signed access tokens in OAuth2
In OAuth2 access token is typically JWT signed by authorization server. Assuming that we will use Ed25519 to sign the JWT, we will have 128 bits of security.
But what about access tokens that would be ...
- 187
2
votes
2
answers
452
views
Oauth: native UI for internal / first party apps
We have an oauth implementation, which was chosen because of the following reasons:
session sharing across different applications
easy to reason about the security considerations as oauth is well ...
- 263
1
vote
1
answer
45
views
Using CSRF token as state parameter for OAuth request
I recently completed Azure OAuth2 integration with my existing web application. Upon user's successful login into my application user can configure multiple outlook accounts using OAuth2 flow.
As for ...
- 113
1
vote
1
answer
28
views
Using certificate-constrained access tokens created by private key used to authentication (with private_key_jwt)
I have a OIDC provider that can't use mutual TLS authentication due to mTLS problems like certificates expiration (what if client didn't rotate certificate and it's expired now? Client cant ...
- 187
0
votes
0
answers
20
views
OAuth Authorization Code for CLI
Trying to allow a CLI to "login" via web browser and obtain an access token for the user's account, similar to how gcloud and github's CLI do it. I realize it'll be using the OAuth ...
- 1
0
votes
1
answer
67
views
OAuth2: Is PKCE required if the callback is located in the backend?
This is the architecture I want to follow
Source:
https://stackoverflow.com/questions/73075156/what-exactly-is-redirect-uri-in-google-oauth2-request-for-getting-authorization
I'm using a backend to ...
- 103
3
votes
1
answer
61
views
CSRF protection for oauth authorization
I've read a lot about the state parameter in oauth flow. But i cant quite understand if the state validation helps my use case.
end to end flow:
resource owner is redirected to service provider site(...
- 211
1
vote
0
answers
18
views
OAuth2/Cognito: Let trusted server act on behalf of user
I'm building a public HTTP JSON API using API Gateway with ID token authentication.
I now need a server that acts on behalf of users. Users message that server using a third party (think Signal or ...
- 11
0
votes
0
answers
104
views
Oauth: Authorizing multiple clients at once
I have an application where the frontend app talks to 2 set of API servers: be1.domain.com and be2.domain.com
both these servers are independent entities (they do share the same top level domain, in ...
- 263
0
votes
0
answers
36
views
Is getting OAuth2 token safe to fetch client-side and pass to server-side?
I'm integrating my application with external service. My application will exchange data with the external service in context of some user. Data exchange will be done in background on server-side.
User ...
- 101
1
vote
0
answers
36
views
Access token lifetime when tokens are client certificate constrained
When we use mTLS we can use access tokens constrained to client certificate that was sent to token endpoint to receive the access token. In this case, if only the client that send this request can use ...
- 187
21
votes
4
answers
7k
views
If JWT tokens are stateless how does the auth server know a token is revoked?
I've read that JWT tokens are stateless and you don't need to store the tokens in the database and that this prevents a look up step.
What I don't understand is that according to RFC 7009 you can ...
- 615
1
vote
0
answers
30
views
Encrypting authorization response with state
Imagine a authorization_code flow which MUST use PAR and after succeded authorization at authorization_endpoint instead of returning code and state returns only code, but this response is encrypted ...
- 187
1
vote
0
answers
24
views
Migrate OAuth 2.0 to OAuth 2.1
I have a old Spring Cloud gateway working with Keyclock server. I don't have Web UI for login because the project is a Rest API. OAuth 2.0 is used with Grant type password.
I want to migrate to OAuth ...
- 141
0
votes
0
answers
35
views
Why is there 2 separate, different endpoint in OAuth2? (/authorization and /token)
I know they both serve different purpose, but that does not answer why the need for 2 separate endpoint when it could have been done using just 1 endpoint? We pass different parameters when we request ...
- 1
0
votes
0
answers
24
views
Attack using the same scope names within differents api resources with OpenID Connect / OAuth2
Assume that we have a client X and client Y. There's also api resources: api-resource-1 and api-resource-2, and api scopes: test.read and test.write.
Client X is allowed to test.read within api-...
- 187
1
vote
0
answers
39
views
Creating session based on Google sign in
Does it make sense to implement your own session management on top of the Google sign in?
Scenario:
I have a web app where I allow users to sign in with Google. I just need this sign in to verify the ...
- 263
2
votes
1
answer
65
views
Handle authorization_code flow with Pushed Authorization Requests
When we use PAR, I see some problems:
When we redirect user to login page we have to store (while user is on the login page) the same data as contained in request object referenced by request_uri (...
- 187
1
vote
2
answers
90
views
OAuth2 public clients cant use client secret and still achieve a secure workflow, why is it used for confidential clients?
In an OAuth2 authorization flow, if I understand correctly the request made to receive a token with PCKE is almost identical between that of a public client and that of a confidential client. The only ...
- 111
1
vote
0
answers
36
views
Use TOTP as client_secret with OAuth
Can we use 10 digital TOTP as client_secret? What security problems would this do, and maybe some benefits? After all, TOTP changes every 30 seconds, but you need to know e.g. a 32 byte secret (which ...
- 187
1
vote
0
answers
95
views
How does Oauth 2.0 for native applications protect against spoofed redirect urls?
In https://datatracker.ietf.org/doc/html/rfc8252 (summarised well in https://auth0.com/blog/oauth-2-best-practices-for-native-apps) it states that there are a number of options for a native ...
- 111
1
vote
2
answers
79
views
Using oauth for authentication
I understand that oauth is an Authorization protocol, but it is possible to use it for authentication when clubbed with something like open ID Connect.
I am trying to understand why do we need an ...
- 263
1
vote
1
answer
115
views
How to manage long-term access to profile data using OIDC?
I am designing an ecosystem of web applications that uses an Open ID Connect (OIDC) authorization server. The users authenticate to the authorization server using the Authorization Code Flow with ...
- 107
0
votes
0
answers
89
views
OpenID Connect for authenticating a web-api
I want to accomplish the following:
Having a web application or mobile app authenticating users using openid connect.
Having a REST Api authenticated using openid connect using the same user as for ...
0
votes
1
answer
52
views
Is there a viable zero-knowledge approach for using oAuth to generate and manage private keys?
I've been doing a deep dive into how products like Web3Auth work under the hood and wonder if this is a viable approach to building applications where a user can have the convenience of using oAuth to ...
0
votes
0
answers
72
views
Azure AD has an "issuer" attribute on JWK keys in the JWK Set but Google ID does not, what is its purpose?
The Google Identity openid discovery url https://accounts.google.com/.well-known/openid-configuration, has a .jwks_uri of https://www.googleapis.com/oauth2/v3/certs. If we look at the first key in ...
- 101
0
votes
0
answers
44
views
oauth2 with additional secret
I'm using Spring boot to create an application that stores user secrets in a database (I have to store the secrets); each secret is stored in the database after being encrypted with the user's ...
- 1
0
votes
0
answers
134
views
Are there security concerns with IMAP when used with OAuth2 and MFA?
Several organizations using Outlook365 (the hosted/managed MS Exchange service from Microsoft) seem to be disabling IMAP and SMTP entirely, forcing users to only use the Outlook client. I get that ...
user280973
0
votes
1
answer
83
views
Fully Qualified Domain Name (FQDN) based authentication
IP addresses can change and the FQDN is slightly more constant. So I thought that FQDN based authentication instead of IP based authentication might be a good idea, but I didn't find any information ...
- 187
0
votes
1
answer
160
views
refresh token without client_id and client_secret
I was reading the OAuth protocol docs https://datatracker.ietf.org/doc/html/rfc6749#section-6 where it implies that you don't need a client_id and client_secret to refresh an access token, just a ...
- 113
0
votes
0
answers
26
views
Using public OAuth tokens to authorize access to internal services
Here's the deal. This might probably be a known best practice, but I haven't been able to find anything on the matter.
Suppose company X has a public facing web API server, and a public OAuth Identity ...
- 23
0
votes
0
answers
22
views
Act as another google cloud platform user in a web app
I want to set up an OAuth2.0 flow on a web application for users that have access to GCP.
The user will login to a web app.
Then, the OAuth2.0 flow will need to ask for the consent that will allow the ...
- 103
0
votes
1
answer
279
views
Is it acceptable to send an access token back to a browser client?
I am currently following the instructions for getting an access token on behalf of a Twilio user described here
The part that is confusing me where it seems to generate an access token then proxy it ...
- 211
0
votes
2
answers
173
views
Is it safe to use email from OAuth for authentication?
I am implementing OAuth (more specifically "Sign in with Google") for a website that has been using only email and password for years.
Now the guide that I'm reading suggests to read the uid ...
- 123
0
votes
0
answers
396
views
Using `react-oidc-context` and storing the `access_token` and `refresh_token` together
I am looking for a "best practises" approach for creating SPAs protected using OIDC + PKCE.
Most of our applications are hosted on two independent web servers with a load balancer routing ...
- 105
0
votes
0
answers
61
views
Why is OIDC more secure than oauth2?
If oauth2 is used with the state parameter (I know it's not required by the standard), wouldn't this ensure freshness, i.e. that authentication just happened? What additional security can OIDC bring?
0
votes
0
answers
22
views
What risks are there in using an OAuth2 access_token from an IdP that I do not control to secure an API that I do control?
Imagine I host some API. Its exact function is irrelevant to the question, but it needs to have some sort of authorization put in front of it. I want to call Google's APIs, so users can interact with ...
- 194
1
vote
2
answers
287
views
OAuth2 - What is the advantage of using certificate over client secret credentials? (Azure)
When using OAuth2 in Azure, why Certificates are more secure than using Secrets?
The Secrets have expiration and are strong, and generated automatically.
The application needs to send a JWT containing ...
- 111
0
votes
1
answer
173
views
Validating CSRF state with an OAuth2 POST Callback
I am setting up OAuth2 for Apple, and it requires a POST response to the callback URL if certain scopes (e.g. email address) are included.
My intended process for preventing CSRF:
Set a cookie with a ...
1
vote
1
answer
152
views
OAuth 2.0 POST to Authorization Endpoint
The OAuth 2.0 specification states:
The authorization server MUST support the use of the HTTP "GET" method [RFC2616] for the authorization endpoint and MAY support the use of the "POST&...
1
vote
0
answers
373
views
What are the risks of using wildcard in context path of OIDC/OAuth redirect_uri?
I'm using Keycloak for my authentication needs. It allows me to use * as wildcard when whitelisting redirect_uris for OIDC clients. What are the risks of using * in context path of redirect_uri? For ...
0
votes
0
answers
19
views
Safe way to allow authorized application to generate a new key after one is broken?
I've run into an OAuth issue where I received a key from the provider with an expiration that was literally set for the same moment I received it. The refresh token's expiration was also set for that ...
- 181
0
votes
0
answers
25
views
What is the 'domain name' in PKCE Auth flow for mobile apps?
I'm interested in building a mobile app that authenticates with a service using OAuth2 so that my app can use their API's. Documentation
To apply for an application key, I need to enter my application'...
- 101
-1
votes
1
answer
26
views
Definition of Authorization according to OAuth2
I am trying to understand OAuth2 and OIDC. The OIDC glossary is a good starting point, and while it defines "Authentication", but does not actually define "Authorization". I ...
- 99