OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
0
votes
0answers
25 views
What oauth grant type should I use after social sign in
I have an application which has its own oauth microservice to issue access tokens. The flow runs as below:
User enters username and password to register, which makes api call to
user-microservice
...
1
vote
2answers
36 views
Storing OAuth access and refresh tokens in non HttpOnly cookies
I am using OAuth auth code flow to generate access and refresh tokens and then I store them in two browser cookies that are not HttpOnly and send them back too the client.
The cookies need to be non ...
1
vote
1answer
46 views
Google login button - what prevents an rogue app from stealing a token?
Here are steps to setup a Google login button on a web client:
https://developers.google.com/identity/sign-in/web/sign-in
When click on the Google login button this pops up:
All the interactions are ...
1
vote
1answer
38 views
How to use Oauth2 and JWT to secure microservice architecture?
We have been investigating proper mechanism to secure microservises that we are going to provide as API endpoints via API manager application.
Fundamentally we need stateless security mechanism like ...
0
votes
1answer
54 views
Reasons to transition Kerberos secured web applications to OAuth2/OpenId
We have five internal web applications written in Java / AngularJs that are secured via Kerberos/ Spnego ( Spring Security implementation) . We are looking to transition these apps to AWS ( EBS) .
...
0
votes
1answer
51 views
Is the OAuth2 authentication code long enough to be secure?
I have recently started working with the OAuth2 authentication flow. In using it, I see that in the authcode flow, the client allows the AuthServer to authenticate a user, and then returns an ...
1
vote
0answers
23 views
OAuth2 and linking resources of one owner to another person account
I'm implementing client side OAuth and I'm worried about the following scenario.
There is application A registered with service B that is offering access to its user resources - authorized by OAuth (...
0
votes
0answers
37 views
Which OAuth 2 flow is used by larger companies like Twitter and Facebook and why did they choose it?
Based on the user experience it seems like Twitter and Facebook use the resource owner password credential flow. From what I've read authorization code flow is the most secure option for a standard ...
0
votes
0answers
117 views
Auth0 vs Firebase = oidc vs Firebase Tokens
I am trying to choose between Auth0 and Firebase as my identity provider. I am building a SPA with a Backend API and I would like to use Auth0 or Firebase for all the logic regarding users/passwords/...
0
votes
0answers
19 views
How to safely store OAuth2 credentials in a Desktop application
I've been searching for a good answer to this problem for a while now, and have seen questions that could be duplicates, but none of them seem to have good/definitive answers that work for my case.
I ...
0
votes
0answers
43 views
In google OAuth callback, is providing redirect_uri by client a security risk?
for example, at callback url of google oauth,to convert 'code' to access_token, I need:
Client side href:
https://accounts.google.com/o/oauth2/auth?scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%...
0
votes
1answer
32 views
OIDC - what is the point of two separate tokens - access and id?
I struggle to understand why don't we just have a single token that serves both purposes - authorisation and authentication?
In some sense, the access token does more than just authorisation. It also ...
5
votes
1answer
147 views
Do I need CSRF protection in this setup with a REST API backed with oauth2 and a basic auth SSO auth server?
I've seen the answer Is CSRF possible if I don't even use cookies? but there are 2 conflicting answers and the question itself doesn't provide that much information either.
I am creating a REST ...
0
votes
0answers
120 views
Token Exchange at a REST API Gateway to federate authentication while maintaining detailed authorization (think ABAC) within the API?
I'm on the verge of creating a service within our resource server that would exchange an externally generated access token for an internally generated access token. However, this feels wrong. I have ...
0
votes
0answers
18 views
Why is auth_code server over redirect URI than on a webpage in OAuth 2.0?
Per three-legged OAuth standard, an auth_code is served as an URL parameter, while the URL being the redirect_uri specified during client registration. I guess it's an HTTP 302 response sent by the ...
0
votes
0answers
167 views
Should OAuth2 Access Token support multiple audiences?
I am considering a usecase where an OAuth2 client obtains an access token to access multiple resource servers.
Based on spec, to protect against token redirect attack:
to deal with token redirect,...
1
vote
2answers
263 views
OAuth - How does the Resource Server validate the access token is not for any other Resource Server?
Let's take an example where there are two resource servers - RS1 and RS2 and there is one authorization server - AS.
Both resource servers - RS1 and RS2 use authorization server - AS
If a client ...
4
votes
1answer
82 views
Need of scope in OAuth Client Credentials Flow
For me, Client Credential flow is like client is asking access token for itself - not on behalf of some user.
Then, why would client like to limit its own scope? What is the benefit of scopes in ...
2
votes
1answer
146 views
How to get better IAM understanding
I'm getting interested in Identity and Access Management (IAM), but I find it hard to find complete and understandable explanations that suit me, surely because I started wrong.
I began with ...
2
votes
1answer
124 views
Why CORS preflight is not available for POST requests when Content-Type is application/x-www-form-urlencoded
In oauth2 for single page application(SPA), we can revoke the access tokens of the implicit grant type by using an ajax request(this is not recommended now). I tried to do a request like below from ...
0
votes
1answer
82 views
What is the risk of sharing the client_secret.json in a public repo?
I have a python script which writes data into a public google sheets file and for using the google sheets API I need to have a user authorize my script. I want to share the script with others and thus ...
4
votes
1answer
62 views
Authorize transitive communication between applications on behalf of the user
I'm trying to wrap my head around to following web security question for a while now. Say we have a system set up as depicted in the picture below.
There is one main application with which the user ...
2
votes
1answer
83 views
Why can't the client server speak directly to an identity provider like Facebook in OAauth 2.0
OAuth 2.0 used for authentication by Google makes sense given that the server and client both trust Google but not each other.
As I understand the authorization code is passed back to the server (in ...
1
vote
1answer
304 views
OAuth2 for mobile apps with confidential backend client (Is PKCE required?)
I'm wondering why neither rfc6749 nor rfc8252 seem to consider the case where the mobile app does not make protected resource requests (and is therefore not a client) but instead relies on a backend ...
3
votes
1answer
51 views
How does security work in a cloud-to-cloud backup scenario?
I'm thinking of using Spinbackup which is a cloud-to-cloud backup of gmail, but I was resistant to the idea of telling Spinbackup my gmail password for obvious reasons. However, on the Spinbackup ...
0
votes
1answer
71 views
Best practice to share google drive API credentials for being used by a script?
In a nutshell: Shall I share oauth2-credentials in our source code with the scope of full write-access to a google drive from a dedicated single-purpose google-account?
so, I've written a python ...
2
votes
0answers
49 views
Is passing claims about the user in an access token “abusing” OpenID Connect?
First, let me assure you that I have read a number of posts on the topic before asking this question, but I am still confused and would appreciate more insights.
So, here's the premise:
There is a ...
2
votes
1answer
251 views
How to prevent refreshing a stolen access token
The scenario is: you have refresh token that is valid for a longer period of time and an access token that is valid for a shorter period of time.
The setup: There is a client, application server and ...
1
vote
1answer
95 views
Why using oAuth2 refresh token is more secure then regenerate an access_token?
I'm implementing an oAuth2 authentification to secure my REST Api.
As I am implementing oAuth2, I need to generate an access_token which will give me a temporary access to my REST datas.
To do it, I ...
0
votes
0answers
37 views
How to do authentication of SaaS implementation for uploading, processing, and retrieving documents
We would like to provide a B2B SaaS with the following flow:
Our customer's end-users upload their document using our custom
upload UI which should be embedded using an iframe
Once the user finishes ...
0
votes
1answer
26 views
Non-standard OIDC flow: How safe is this?
I have been made aware of an application, at a client, that claims to use OIDC to authenticate users. This is however done via a non-standard flow that I find hard to assess from a security standpoint....
8
votes
1answer
907 views
Why isn't PKCE encouraged for Single-Page Apps?
A lot of services today still recommend the implicit flow for an OpenID Connect/Oauth2 token exchange when developing Single-Page Apps. (See Okta, Google, Auth0)
Some newer guidance out there points ...
1
vote
1answer
53 views
OpenID Connect, OAuth2, and deleted accounts
If I use OpenID Connect or OAuth2 for authentication, and a customer deletes his/her OAuth2 provider (Facebook) account, how can I safely associate a new authentication with a different OAuth2 ...
0
votes
0answers
121 views
How to store `client_secret` privately on frontend applications?
I am trying to understand how authentication and authorization should work with a REST API given that the API will be available to be used by third-party applications.
I realize that if we allow ...
3
votes
1answer
200 views
Is using OAuth2 services like Google or Facebook Single Sign-On a privacy concern?
With all the coverage of Cambridge Analytica scandal, it seems like this wasn't a data breach or hack, it was just that Cambridge Analytica did not properly disclose how they would use the data.
Is ...
2
votes
1answer
44 views
What advantages would client-side certificates have over signature based auth such as Oauth2 or HMAC for HTTP Requests?
My application currently supports these two authentications methods OAuth2 and HMAC Auth.
OAuth2 https://tools.ietf.org/html/rfc6749
HMAC https://tools.ietf.org/html/draft-cavage-http-signatures-09
...
1
vote
0answers
27 views
OAuth2 auth server reusing the access token
I found some implementations of OAuth2 provider (auth server) which issues the same access token (for same user & scope) for different authentication request. Does the OAuth2 spec allows it?
Any ...
2
votes
0answers
57 views
OAuth2 Implicit Flow. Additional protection for access_token from interception
We have a one-page JavaScript application that authenticates the user on our server using the OAuth 2.0 protocol (and the AddId-Connect add-in). After authentication, the server issues an access_token ...
1
vote
0answers
201 views
OAuth2 Implicit Flow and silent autologin by Windows Identity. Possible new attack vectors?
We have a typical Single-Page js application that authenticates to our own authentication server using the OAuth 2.0 protocol (and the OpenId-Connect add-in). The customer sent a request to implement ...
1
vote
2answers
50 views
Does the OpenID Connect Core specification incorrectly define the OpenID Provider and Relying Party in terms of human participants?
There are a few important definitions in the OpenID Connect Core specification that refer to a human participant, and at first glance it would seem that OpenID Connect only applies in cases where ...
2
votes
0answers
139 views
Is OAuth2 Implicit secure?
I have built an authorisation server using OWIN based OAuth2. I understand that the Implicit grant is basically only authenticating the redirect_URL and Client_ID when making the request. I thought, ...
0
votes
0answers
71 views
On Android, Is using “Custom URI Scheme” with “OAUTH 2.0” is secure?
Is anyone can register the same Custom URI Scheme (maybe a hacker), and if so how can i prevent other apps from registering the same Custom URI Scheme.
If there's good alternatives to Custom URI ...
1
vote
2answers
563 views
Why is a wildcard-subdomain callback URL in OAuth considered unsafe?
In this post: http://technotes.iangreenleaf.com/posts/closing-another-nasty-security-hole-in-oauth.html
Enter your full callback URL(s) in this field. This means you should
be providing the ...
0
votes
0answers
30 views
Can GitHub OAuth be used safely in a published desktop application?
Lets say I want to create an open-source desktop application that I will share with other people. I want it to have the ability to read and write to people's GitHub repositories, so lets consider ...
0
votes
1answer
301 views
Resource server and authorization server in OAuth 2.0
Can resource server and authorization server be on the same server in OAuth 2.0? Also, Can they share the same database as well?
1
vote
0answers
27 views
Oauth2 for mobile apps vs Google Digital Asset Links
I'm working on new authentication service for my company. We've got web app (asp.net) and separate API. API is consumed by third party integrators and also by our own mobile apps.
For mobile apps, ...
1
vote
1answer
54 views
How does the user agent know who is logged in? (Using auth codes)
When using Authorization codes (in the Explicit oAuth2 flow), the user agent never seems to see anything other than the auth code, which does not even identify the user. The code is then sent client, ...
0
votes
0answers
14 views
Is there ever a situation where it makes sense for a web app to use Explicit (auth-code based) oAuth2 authentication?
From what I've read, the main reason to use explicit oAuth is that the user-agent never sees the auth token. However, if we are designing a web app with auth-code based oAuth2, it seems impossible for ...
4
votes
3answers
870 views
Oauth2 vs APIKey in a server to server communication
A third party service provider is exposing a payment API that we need to integrate on our backend.
As transport communication we will consume this API using TLS with Client Certificate and over a MPLS ...
0
votes
0answers
71 views
Ouath2 SSO with SPA using proxy
I have a single page application (client side) that interacts with a set of backend rest APIs - microservices architecture, to achieve SSO, I used the Oauth2 protocol (Spring implementation).
Now, to ...
