Questions tagged [oauth2]
OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
383
questions
0
votes
0
answers
12
views
Azure AD has an "issuer" attribute on JWK keys in the JWK Set but Google ID does not, what is its purpose?
The Google Identity openid discovery url https://accounts.google.com/.well-known/openid-configuration, has a .jwks_uri of https://www.googleapis.com/oauth2/v3/certs. If we look at the first key in ...
- 101
0
votes
0
answers
25
views
oauth2 with additional secret
I'm using Spring boot to create an application that stores user secrets in a database (I have to store the secrets); each secret is stored in the database after being encrypted with the user's ...
- 1
0
votes
0
answers
18
views
Are there security concerns with IMAP when used with OAuth2 and MFA?
Several organizations using Outlook365 (the hosted/managed MS Exchange service from Microsoft) seem to be disabling IMAP and SMTP entirely, forcing users to only use the Outlook client. I get that ...
0
votes
1
answer
39
views
Fully Qualified Domain Name (FQDN) based authentication
IP addresses can change and the FQDN is slightly more constant. So I thought that FQDN based authentication instead of IP based authentication might be a good idea, but I didn't find any information ...
- 15
0
votes
1
answer
48
views
refresh token without client_id and client_secret
I was reading the OAuth protocol docs https://datatracker.ietf.org/doc/html/rfc6749#section-6 where it implies that you don't need a client_id and client_secret to refresh an access token, just a ...
- 113
0
votes
0
answers
20
views
Using public OAuth tokens to authorize access to internal services
Here's the deal. This might probably be a known best practice, but I haven't been able to find anything on the matter.
Suppose company X has a public facing web API server, and a public OAuth Identity ...
- 23
0
votes
0
answers
15
views
Act as another google cloud platform user in a web app
I want to set up an OAuth2.0 flow on a web application for users that have access to GCP.
The user will login to a web app.
Then, the OAuth2.0 flow will need to ask for the consent that will allow the ...
- 103
0
votes
1
answer
52
views
Is it acceptable to send an access token back to a browser client?
I am currently following the instructions for getting an access token on behalf of a Twilio user described here
The part that is confusing me where it seems to generate an access token then proxy it ...
- 161
0
votes
2
answers
33
views
Is it safe to use email from OAuth for authentication?
I am implementing OAuth (more specifically "Sign in with Google") for a website that has been using only email and password for years.
Now the guide that I'm reading suggests to read the uid ...
- 113
0
votes
0
answers
48
views
Using `react-oidc-context` and storing the `access_token` and `refresh_token` together
I am looking for a "best practises" approach for creating SPAs protected using OIDC + PKCE.
Most of our applications are hosted on two independent web servers with a load balancer routing ...
0
votes
0
answers
49
views
Why is OIDC more secure than oauth2?
If oauth2 is used with the state parameter (I know it's not required by the standard), wouldn't this ensure freshness, i.e. that authentication just happened? What additional security can OIDC bring?
0
votes
0
answers
19
views
What risks are there in using an OAuth2 access_token from an IdP that I do not control to secure an API that I do control?
Imagine I host some API. Its exact function is irrelevant to the question, but it needs to have some sort of authorization put in front of it. I want to call Google's APIs, so users can interact with ...
- 194
1
vote
2
answers
57
views
OAuth2 - What is the advantage of using certificate over client secret credentials? (Azure)
When using OAuth2 in Azure, why Certificates are more secure than using Secrets?
The Secrets have expiration and are strong, and generated automatically.
The application needs to send a JWT containing ...
- 111
0
votes
1
answer
50
views
Validating CSRF state with an OAuth2 POST Callback
I am setting up OAuth2 for Apple, and it requires a POST response to the callback URL if certain scopes (e.g. email address) are included.
My intended process for preventing CSRF:
Set a cookie with a ...
0
votes
1
answer
49
views
OAuth 2.0 POST to Authorization Endpoint
The OAuth 2.0 specification states:
The authorization server MUST support the use of the HTTP "GET" method [RFC2616] for the authorization endpoint and MAY support the use of the "POST&...
0
votes
0
answers
154
views
What are the risks of using wildcard in context path of OIDC/OAuth redirect_uri?
I'm using Keycloak for my authentication needs. It allows me to use * as wildcard when whitelisting redirect_uris for OIDC clients. What are the risks of using * in context path of redirect_uri? For ...
0
votes
0
answers
19
views
Safe way to allow authorized application to generate a new key after one is broken?
I've run into an OAuth issue where I received a key from the provider with an expiration that was literally set for the same moment I received it. The refresh token's expiration was also set for that ...
- 181
0
votes
0
answers
21
views
What is the 'domain name' in PKCE Auth flow for mobile apps?
I'm interested in building a mobile app that authenticates with a service using OAuth2 so that my app can use their API's. Documentation
To apply for an application key, I need to enter my application'...
- 101
-1
votes
1
answer
24
views
Definition of Authorization according to OAuth2
I am trying to understand OAuth2 and OIDC. The OIDC glossary is a good starting point, and while it defines "Authentication", but does not actually define "Authorization". I ...
- 99
3
votes
1
answer
137
views
Adding SSO to an existing website - should SSO login link to matching email address?
I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and ...
- 131
0
votes
2
answers
87
views
Revoke all refresh tokens when account locked?
Scenario: a user enters his password incorrectly x times, so his account is locked for y minutes.
Should I revoke all his refresh tokens?
Problems:
user is logged out of all devices, not just the one ...
- 363
0
votes
1
answer
46
views
Downside of resource owner password flow for native mobile apps?
I have seen some similar questions a few years old and I am not sure if there are any new changing views on this.
I see that this flow is not recommended for mobile native apps. What are the practical ...
- 101
1
vote
1
answer
103
views
3rd party mobile app access our service via our APIs
We have a microservice backend system & we expose APIs for our customers to use. We are now developing our Authentication system with our identity provider service.
We have a customer(a company), ...
- 61
0
votes
0
answers
98
views
Using oauth2 to implement SSO between a desktop application and a web application
Is oauth2 designed to handle single-sign-on between a desktop application and a webapp?
The scenario looks like this:
The desktop app has a username/password login
After a user is authenticated in ...
- 43
0
votes
0
answers
36
views
Why can't an email or profile scope used to authenticate in OAuth?
I am trying to learn OAuth and I keep reading that "OAuth is only used for authorization." However, if you add an email or profile scope, doesn't that identify who the user is? So can it be ...
- 131
1
vote
0
answers
55
views
Auth0 token exchange vs Google Firebase token exchange
I'm researching our options for securing access to a single-page web app and a mobile app. The apps communicate with a REST API which, based on the authenticated user's identity, will return ...
- 111
0
votes
1
answer
44
views
Multifactor auth in OAuth2 Password flow
This resource (and others) mention that OAuth2 Password flow doesn't provide mechanism for multi-factor authentication.
Does that mean other flows do?
How does MFA fit in the OAuth2 framework?
What ...
0
votes
0
answers
76
views
HTTP Bearer authentication with multiple identity providers?
Suppose I have a web application that uses OpenID Connect to enable users to log in with one of several 3rd party identity providers (e.g., "log in with Google", "log in with Facebook&...
- 376
3
votes
0
answers
198
views
Implement state parameter in OAuth2.0 code flow server-side
I have a scenario where I need to implement OAuth 2.0 authorization code flow on the server side - the user authorizes a backend service against Microsoft, the service receives a token, saves it in a ...
- 81
2
votes
3
answers
213
views
Detecting session sharing with OAuth2
In the OAuth2 Implict Grant flow, the access token is added to the URL fragment as part of the redirect from the Authorization Server to the Relying Party. Since this access token is made visible to ...
- 125
-1
votes
1
answer
423
views
How to secure backend API access?
In the good old days, you made server-side websites using PHP or something like that, now we have modern web apps divided into front-end and back-end (usually API Rest), you can't rely on CORS because ...
- 143
0
votes
0
answers
92
views
GitLab with api scope and confidentiality unchecked. What are the privacy risks?
I just created a GitLab application to connect it with StackEdit.io. I created it by following the instructions on this GitLab docs page. I had to create the GitLab application with api scope and I ...
- 101
0
votes
0
answers
239
views
OpenId with Biometrics - should I write a custom login + OIDC
We are trying to arrive at a solution for an enterprise app
Different Users have different Authentication Methods
User Type 1 - Password + Captcha
User type 2 - Biometric [Not device-based] + ...
0
votes
0
answers
61
views
I have a non-Oauth service and am using this approach with Server initiated HttpOnly cookies with stripped JWT
My question is : Is this approach correct given I have a non-Oauth service? My goal is to use the simplest amount of security features while still being as strong as possible.
My approach is as ...
- 101
0
votes
1
answer
122
views
Modern security flow/process for trusted Mobile and SPA apps with self-hosted OIDC
Currently, there are two common auth flows i know:
Resource Owner Password Flow
Authentication Code Flow + PKCE (didn't mention other, since this one is more robust within redirect-based)
This theme ...
- 101
0
votes
1
answer
162
views
Wouldn't the OAuth 2.0 client credentials flow be more secure with the option of using refresh tokens?
The OAuth 2.0 specification states that "A refresh token SHOULD NOT be included" in responses to access token requests in the client credentials flow and that, even if they were used, the ...
- 101
0
votes
0
answers
128
views
Access to JWT session after OAuth redirects
I have a stateless backend app, session data is stored on the front-end in a JWT token, so the front-end app passes this token in Authorization header to all the requests.
I need to add 3rd party API ...
- 1
0
votes
0
answers
138
views
how to avoid Oauth2 timeouts with orchestrator REST API
I have a REST API, which I'll call "R". R uses Oauth2 Bearer tokens for auth.
However, R has a fairly complex API, so we're designing a new system called "O" that provides a ...
- 51
1
vote
1
answer
96
views
Password Based Encryption with Social Login
I have a question about implementing user password-based encryption in a database injunction with the Social Login feature.
User private data in my database should be encrypted in order to provide ...
2
votes
3
answers
605
views
OAuth2 - using Id Token for authentication to a backend service
Many resources on the internet state that you should use Access Token and not Id Token to authenticate to an API, but do not provide explicit reasons why. Are there any real drawbacks to use an Id ...
- 229
2
votes
1
answer
246
views
Why is PKCE "RECOMMENDED" for authorization codes with confidential clients?
Section 2.1.1 of IETF's OAuth 2.0 Security Best Current Practice begins as follows:
Clients MUST prevent injection (replay) of authorization codes into
the authorization response by attackers. ...
- 441
0
votes
1
answer
62
views
A Native Desktop App using PKCE - Can an id_token be consider valid authentication when passed to another protected server resource?
My understanding is that client impersonation cannot be prevented for Native Desktop Apps. If all standard controls: State, PKCE, Redirect_URI confirmation etc are in place, to prevent auth_code ...
- 13
0
votes
1
answer
212
views
Is there a risk involved in refreshing a JWT token every time you refocus the webpage?
I am currently testing a website that appears to make a refresh token request every time I focus away from the web browser and back, or away from the tab the website is open in and back to it. I've ...
- 173
1
vote
1
answer
123
views
What is a pre-warmed secret?
As described here: https://tools.ietf.org/id/draft-ietf-oauth-security-topics-13.html#proposed-countermeasures-2
Note on pre-warmed secrets: An attacker can circumvent the
countermeasures described ...
- 13
1
vote
0
answers
200
views
Openid nonce replay attack in auth code flow
Looking at this question Openid connect nonce replay attack and the answer by @benbotto. I understand the replay attack in implicit flow but unable to understand it for auth code flow. Let's say an ...
- 11
1
vote
1
answer
340
views
Is OAuth2.0 Authorization Code Grant flow with PKCE really secure?
CONTEXT
There is a SPA that uses Authorization Code Grant flow with PKCE to get info from an API all the info is highly sensitive
RESEARCH
Here is what I found of how Authorization Code Grant flow ...
- 143
1
vote
0
answers
82
views
Authorise access to hierarchical data
Consider a scenario in which you offer service access based on a hierarchy of authority. i.e., a HEAD can register his subordinates. The authenticated HEAD has the previledge to read and update data ...
- 121
0
votes
0
answers
75
views
Strategies for segregating anonymous and secure access to APIs
Traditionally, we used either path-based access control or a separate DNS for public and private content segregation. In the modern era of standard-based auth, what are the best auth strategies for ...
- 121
0
votes
1
answer
113
views
Which OAuth2 flow should I use?
Context
I'm trying to build an hybrid multi-tenant API using OAuth2.0 using Laravel 8 Passport, so my system has 2 parts: one process the request from the tenant application, and the other part ...
- 143
0
votes
2
answers
196
views
Is a consent screen in an OAuth 2.0 implementation optional
I've read through RFC 6749: https://datatracker.ietf.org/doc/html/rfc6749
The only mention of consent is in this bit:
The authorization server MUST implement CSRF protection for its
authorization ...
- 111