Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [oauth2]

OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0

1
vote
0answers
26 views

Oauth2/OIDC: I know the address of a resource server, is there a standard for querying which authorization servers it accepts?

I have a bunch of what are essentially IOT devices that will authenticate connections using oauth 2 tokens and/or openid connect (depending on use-case). Each IOT device is individually configurable ...
0
votes
0answers
21 views

Implementing OAuth 2 refresh token rotation on web clients

I'm looking to implement refresh token rotation for unauthenticated clients of my OAuth 2 provider. Things are all implemented on the server side, but I'm concerned that web clients will be unable to ...
2
votes
0answers
45 views

OAuth2: what to return when revoking a token which is not the client's? RFC7009

In RFC7009 - section 2.1, it is stated that: The authorization server first validates the client credentials (in case of a confidential client) and then verifies whether the token was ...
0
votes
0answers
25 views

OpenId Connect Authorization Code Flow in Microservice Scenario (API-Gateway?)

Im building a SPA with a couple of backend-microservices and i want to authenticate using OIdC. I'm aware of the fact that the implicit flow is not recommended anymore for this. So the recommended ...
4
votes
1answer
206 views
+50

Can websites detect if visitors are logged in to mainstream ID providers and collect their IDs?

Logging in to websites using mainstream IDs (Google/Facebook/Github etc.) by means of OAuth (or similar) has nowadays become a feature that people expect. Not that long ago the corresponding user ...
1
vote
1answer
44 views

Why is there a redirect to the native app in PKCE?

Why even have a redirect or even use the browser? Wouldn't just a normal TLS/HTTPS request/response in the app protect the requests and token? The one argument I have heard against solely relying on ...
2
votes
1answer
54 views

What are the security risks associated with leaking client_secret in OAuth2?

There is an API that openly returns client_secret for each existing user, as long as you pass an email address. Is that a vulnerability? What are the risks?
0
votes
1answer
35 views

what is the scope of google drive's OAuth credentials?

I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
0
votes
1answer
15 views

Can a service be Oauth2 provider and Oauth2 client at the same time?

Let's say a new application X is an Oauth2 client and allows it's user to signup/login with other Oauth2 providers like Google. So a user U signs up using Google and regularly logins using Google to ...
0
votes
0answers
23 views

OAuth M2M Security Practices

For M2M communication, I thought of implementing Client Credentials OAuth 2 flow, Client credentials depends mainly on client Id and Client Secret. if Client credential is exposed, it will expose ...
0
votes
0answers
20 views

OIDC Protocol :: Different OIDC Server End points

OIDC Specifications: Authorization Code Grant Flow. As OIDC Server is shall list the various end points (Auth EP, Token EP, Token validation EP etc.) In this scenario, Can Auth End Point and Token End ...
0
votes
1answer
69 views

OAuth2 Client Credentials Flow with assertion JWT: How to share the client's public key?

I'm having a deeper look into OAuth 2.0 and especially the Client Credentials Flow that is intended to authenticate a client application or device without user interaction (the client is accessing its ...
1
vote
0answers
51 views

Is it secure to expose OAuth2 credentials for a test application

I have created an application in which it is possible to login using GitLab. This requires an OAuth2 app id and secret. I created a test application in GitLab UI with the redirect set to https://...
1
vote
1answer
108 views

Why is PKCE secure against man-in-the-middle attacks?

In attempting to implement OAuth2 into a natively installed client application, we face the problem that we cannot securely store the pre-shared client secret. After doing some research, I came across ...
2
votes
1answer
84 views

Microservices and RBAC using OIDC

I am currently working on migrating our users from an internal DB to an OIDC service (considering Cognito/Auth0/etc.), and I am trying to implement RBAC. Our backend is basically a bunch of ...
0
votes
0answers
63 views

Using Cognito access token to pass claims

I am working on migrating all our users from our DB to a managed service, and we're considering AWS Cognito. We want to use Cognito for Authentication and Access Control. For access control, we're ...
1
vote
1answer
158 views

OpenID Connect: Is storing access token in browser secure?

I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
0
votes
0answers
79 views

OAuth2 refresh token flow with mobile app

I'm having some issue with an access token not being refreshed in my mobile application. I'm trying to figure out what would be the best approach to fix it. This is the scenario faced by some mobile ...
0
votes
0answers
37 views

Is it ok to forward a JWT between two custom services?

I'm using Azure AD Implicit Flow for authentication between a SPA and a WebApi. I want to know if it would be ok/save to redirect from the SPA to a intermediary service of my own as well with the ...
0
votes
0answers
19 views

How does access delegation work - Access Token work?

I'm trying to understand how do access tokens work. What is the mechanism used to generate access tokens similar to AWS Secure Token Service or OAuth Tokens. I am assuming the algorithm is as follows:...
1
vote
2answers
149 views

Invalidate API tokens when LDAP user is invalid

I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below. User sends LDAP username and password (with password grand type) to the server. Server ...
0
votes
0answers
110 views

Alternative OAuth 2 flow?

I have an implementation of the OAuth 2.0 authorization code flow, but I'm wondering if I can securely introduce a new flow. I'd like a flow that doesn't require the resource owner to ever need to ...
2
votes
1answer
33 views

OAuth2 - Obtaining Refresh Tokens

Given a valid access token alone (you don't know username+password), should you be able to get a refresh token?
2
votes
1answer
103 views

OAuth: how to prevent phishing with malicious redirect URIs

To quote the OAuth spec: If the resource owner denies the access request or if the request fails for reasons other than a missing or invalid redirection URI, the authorization server informs the ...
0
votes
0answers
33 views

Do I have to use two OAuth/OpenIdConnect bearer token with PKCE?

We have some REST APIs exposed to public applications. Those applications are registered with an (application protocol scheme) redirect URL and we provide to the developer a client secret and client ...
3
votes
0answers
40 views

Architecting a solution with native login and 3rd party login via OAuth/OpenID Connect using dotnet core

I am building an API driven application that will have a native login with username and password, and will also need to grant 3rd party access via OAuth/OpenID Connect in the near future. A pattern I ...
0
votes
1answer
64 views

capture authorization code programmatically in OAuth 2.0

In a standard OAuth auth code Grant flow, user is redirected to authorization server page where he provides consent to allow the requesting app to perform some actions on his behalf, after which a ...
0
votes
2answers
178 views

Does an authorization code grant rely on sessions?

It's my (possibly flawed) understanding that the authorisation code grant is attractive because it keeps access tokens away from a potentially insecure user agent. I understand how this would work ...
0
votes
0answers
30 views

What's the attack vector for authenticated wildcard CORS origin for a public API?

I have a public API (intended to be used by third-party websites) authentication only via JWT bearer tokens (no cookie authentication). SPAs have to add the Authorization header for every API request....
0
votes
1answer
55 views

Is it safe to just forget OAuth tokens, and not invalidate them in a mobile app?

I have a mobile application that a user signs into using OpenId Connect and OAuth 2.0. Currently when the user logs out, I open up a webpage to the end_session_endpoint (http://docs.identityserver.io/...
0
votes
0answers
67 views

Node.js Cookies/Tokens (Access & Refresh) - OAUTH2 - How to store tokens and time/function refreshing

1) I am currently building a RESTful API which acts as a middleman between clients and an authentication server. A client gives me some account details and my server passes them to the auth server who ...
1
vote
2answers
49 views

Is it dangerous not to verify the signature of an id token issued by an external authorization server?

I need to retrieve some values from an id token issued by an external authorization server inside a private network. I asked for the certificate used to sign the jwt in order to verify it but I've ...
4
votes
0answers
48 views

Poor Man's OAuth Grant - Review

A 3rd party company has requested that we implement single sign-on with them using the below approach. I'm familiar with OAuth grants and OIDC flows but this seems rather odd to me. The user has ...
1
vote
0answers
38 views

Is the OAuth implicit flow too insecure for serverless single page web applications?

Assuming the need for OAuth Imagine an application that is: A single page web application hosted on S3 Authenticated using implicit OAuth flow implicit Have the web application access resources ...
0
votes
0answers
41 views

Is Oauth2 Implicit grant two-legged or three-legged?

In implicit grant, the resource owner has to provide consent to allow the application to access the resources on user's behalf. Doesn't this make Implicit grant a 3-legged flow? This video states ...
1
vote
1answer
163 views

How can I securely disable CSRF validation for native clients when browser clients access the same API?

I have an API endpoint that is accessible by both native (console, mobile apps) and Javascript based clients. How do I ensure that the CSRF AntiForgeryToken is only invoked during Javascript calls? ...
1
vote
0answers
215 views

Using Google Authentication with Lambda@Edge and S3 Static Sites

I am looking to set up authentication on an S3 hosted static site. The configuration is: S3 bucket configured to allow access via cloudfront AWS Cloudfront distribution with HTTPS configured and a ...
0
votes
0answers
26 views

How does SupportsCredentials, Access-Control-Allow-Credentials, and CORS Origin=* relate?

I'm investigating CSRF implementations in ASP.NET, MVC, WebAPI the relationship between the headers that are sent: A Javascript client call of XMLHttpRequest.withCredentials A server response of ...
1
vote
1answer
118 views

OAuth 2.0 when and how to use the client id and secret

The OAuth 2.0 protocol uses the client id and secret. It considers the client id to be public while the secret is private. Anyway it also considers to generate the client id randomly with a certain ...
2
votes
2answers
87 views

Why refresh token if I can reauthenticate?

So I have a backend service (batch service, no user access), everytime I make a request I need to call the token endpoint and send my username/password in the header then it returns an access token ...
0
votes
1answer
58 views

Mobile apps that use OAuth2 to offload authentication to a 3rd party: are they misusing OAuth2?

I have been tasked with building a mobile app that requires users to login to a 3rd party service via OAuth2 to obtain some data about them. This mobile app also requires its own backend database ...
0
votes
1answer
123 views

Should I use TOTP when using OAuth2

I'm implementing TOTP in my application to allow users to use two factor authentication with Google authenticator and the like. However I've also implemented "social login" using OAuth, should the ...
1
vote
0answers
24 views

When is OAuth1 preferred over OAuth2

Scenario: I need to build a new API for a third party company who are building a tool to capture information of new users wishing to create accounts on our enterprise platform. -x- My preferred ...
2
votes
3answers
272 views

How Secure is OAuth2 for Web Applications?

Let’s consider a single page client side application, developed using HTML and Javascript. In this case, even if the implicit or authentication code flow is being used to request Access Tokes, still ...
1
vote
1answer
75 views

Is it a good idea to notify a user that they signed up with a social-login account?

Say my website provides three main ways to signup/signin: Google, Facebook and typical username/password. Is it a good idea to flash "Please login using your Google account" if a user tries to login ...
0
votes
1answer
34 views

Revoke OAuth2 Token For Mobile App

When a user logs into my mobile app it uses OAuth to authenticate them and generates a token. The token is then checked against each subsequent request. Each user account in my application has an ...
2
votes
1answer
80 views

Is it secure to handle the OAuth 2 Authorization callback from a CDN?

This question is in the context of the OAuth 2.0 Authorization Framework. Consider a web application that is backed by a first-party API but relies on a third-party authorization server for SSO. Say ...
1
vote
0answers
51 views

Tunelling an Authenticated User Across Microservices Securely

On a platform which follows the OAuth 2.0 framework for authorization and a microserivce based architecture, what is a secure way to pass a user from one microservice to another on the same platform ...
1
vote
0answers
125 views

How to properly store OAuth 2.0 client_id and client_secret in a web application?

In the PoC (Proof of Concept) that I'm currently developing, data from an API is consumed and OAuth 2.0 is required for authentication. The application is already working as expected, the users are ...
0
votes
0answers
18 views

implementing push api for files using oauth2

i want to implement a push api similar to Garmin Connect API. this api allows the clients to get the data of garmin users, as garmin will push to the clients the user's files whenever created. we ...