Questions tagged [oauth2]
OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
362
questions
-1
votes
1answer
101 views
How to secure backend API access?
In the good old days, you made server-side websites using PHP or something like that, now we have modern web apps divided into front-end and back-end (usually API Rest), you can't rely on CORS because ...
0
votes
0answers
21 views
GitLab with api scope and confidentiality unchecked. What are the privacy risks?
I just created a GitLab application to connect it with StackEdit.io. I created it by following the instructions on this GitLab docs page. I had to create the GitLab application with api scope and I ...
0
votes
0answers
29 views
OpenId with Biometrics - should I write a custom login + OIDC
We are trying to arrive at a solution for an enterprise app
Different Users have different Authentication Methods
User Type 1 - Password + Captcha
User type 2 - Biometric [Not device-based] + ...
0
votes
0answers
29 views
I have a non-Oauth service and am using this approach with Server initiated HttpOnly cookies with stripped JWT
My question is : Is this approach correct given I have a non-Oauth service? My goal is to use the simplest amount of security features while still being as strong as possible.
My approach is as ...
0
votes
0answers
46 views
Modern security flow/process for trusted Mobile and SPA apps with self-hosted OIDC
Currently, there are two common auth flows i know:
Resource Owner Password Flow
Authentication Code Flow + PKCE (didn't mention other, since this one is more robust within redirect-based)
This theme ...
0
votes
0answers
36 views
Wouldn't the OAuth 2.0 client credentials flow be more secure with the option of using refresh tokens?
The OAuth 2.0 specification states that "A refresh token SHOULD NOT be included" in responses to access token requests in the client credentials flow and that, even if they were used, the ...
0
votes
0answers
30 views
Access to JWT session after OAuth redirects
I have a stateless backend app, session data is stored on the front-end in a JWT token, so the front-end app passes this token in Authorization header to all the requests.
I need to add 3rd party API ...
0
votes
0answers
78 views
how to avoid Oauth2 timeouts with orchestrator REST API
I have a REST API, which I'll call "R". R uses Oauth2 Bearer tokens for auth.
However, R has a fairly complex API, so we're designing a new system called "O" that provides a ...
1
vote
1answer
56 views
Password Based Encryption with Social Login
I have a question about implementing user password-based encryption in a database injunction with the Social Login feature.
User private data in my database should be encrypted in order to provide ...
2
votes
3answers
226 views
OAuth2 - using Id Token for authentication to a backend service
Many resources on the internet state that you should use Access Token and not Id Token to authenticate to an API, but do not provide explicit reasons why. Are there any real drawbacks to use an Id ...
1
vote
0answers
62 views
Why is PKCE "RECOMMENDED" for authorization codes with confidential clients?
Section 2.1.1 of IETF's OAuth 2.0 Security Best Current Practice begins as follows:
Clients MUST prevent injection (replay) of authorization codes into
the authorization response by attackers. ...
0
votes
0answers
18 views
A Native Desktop App using PKCE - Can an id_token be consider valid authentication when passed to another protected server resource?
My understanding is that client impersonation cannot be prevented for Native Desktop Apps. If all standard controls: State, PKCE, Redirect_URI confirmation etc are in place, to prevent auth_code ...
0
votes
1answer
74 views
Is there a risk involved in refreshing a JWT token every time you refocus the webpage?
I am currently testing a website that appears to make a refresh token request every time I focus away from the web browser and back, or away from the tab the website is open in and back to it. I've ...
1
vote
1answer
96 views
What is a pre-warmed secret?
As described here: https://tools.ietf.org/id/draft-ietf-oauth-security-topics-13.html#proposed-countermeasures-2
Note on pre-warmed secrets: An attacker can circumvent the
countermeasures described ...
0
votes
0answers
84 views
Openid nonce replay attack in auth code flow
Looking at this question Openid connect nonce replay attack and the answer by @benbotto. I understand the replay attack in implicit flow but unable to understand it for auth code flow. Let's say an ...
0
votes
0answers
98 views
Is OAuth2.0 Authorization Code Grant flow with PKCE really secure?
CONTEXT
There is a SPA that uses Authorization Code Grant flow with PKCE to get info from an API all the info is highly sensitive
RESEARCH
Here is what I found of how Authorization Code Grant flow ...
1
vote
0answers
52 views
Authorise access to hierarchical data
Consider a scenario in which you offer service access based on a hierarchy of authority. i.e., a HEAD can register his subordinates. The authenticated HEAD has the previledge to read and update data ...
0
votes
0answers
51 views
Strategies for segregating anonymous and secure access to APIs
Traditionally, we used either path-based access control or a separate DNS for public and private content segregation. In the modern era of standard-based auth, what are the best auth strategies for ...
0
votes
0answers
59 views
Which OAuth2 flow should I use?
Context
I'm trying to build an hybrid multi-tenant API using OAuth2.0 using Laravel 8 Passport, so my system has 2 parts: one process the request from the tenant application, and the other part ...
0
votes
1answer
86 views
Is a consent screen in an OAuth 2.0 implementation optional
I've read through RFC 6749: https://datatracker.ietf.org/doc/html/rfc6749
The only mention of consent is in this bit:
The authorization server MUST implement CSRF protection for its
authorization ...
0
votes
0answers
54 views
How to authenticate OAuth2 confidential client is making a REST call?
We are looking to implement some REST services to be called from partner servers (not end users via a browser).
The out-of-the-box implementation seems to flow thusly:
Partner server passes a client ...
1
vote
0answers
48 views
Where should I store an OAuth refresh token for a third party?
I am connecting to a third party which authenticates with OAuth2. Once the user has logged in, I want to store the access & refresh tokens for the user. Which is more secure & proper - to save ...
0
votes
1answer
180 views
How to pentest oAuth2/oidc clients
imagine the following problem:
As a developer, I would like to check if my oAuth2 or OpenID Connect client is really secure.
I would like to check if it validates the JWT signature, uses the nonce etc....
0
votes
1answer
311 views
How is pop token more secure than bearer token?
I tried reading few articles, however I'm not able to understand the merit of POP over Bearer token. Bearer token if lost (during transit over the wire) can give the holder of the token same ...
1
vote
1answer
90 views
Whose fault/bug is it in the below case?
Say there are 2 servers a.example and b.example.
b.example uses 3rd party authentication from a.example via OAuth or other protocols.
Now a user user1 with account xyz@a.example logs in and sets up a ...
1
vote
0answers
71 views
Is Google OAuth login in 3rd party applications via system browser secure?
Numerous mobile applications allow me to "Login with Google".
From technical perspective, I assume this would usually follow those OAuth native app login integration guidelines: https://...
0
votes
0answers
41 views
What stops an attacker from simply using your client_id in their own auth code flow with PKCE
Ok so I get the benefit that PKCE provides. Without it, the attacker knows your client_secret and by registering the same URL scheme as your application on mobile, can intercept the redirect with the ...
1
vote
0answers
140 views
Alternatives to OAuth 2 for first-party native applications
I am currently thinking about alternative ways for my native iOS Application (written in Swift) to receive access- & refresh-tokens. As of now, user sessions are established using revokable JWTs, ...
0
votes
0answers
55 views
Storing an OAuth 2.0 access token
I'm in a debate of where to securely store an OAuth 2.0 access token. There are two opinions:
On the browser (inside of a HttpOnly cookie)
On the server/inside the a database
The argument against ...
5
votes
4answers
320 views
Is a "magic link" a kind of authentication?
From what am I reading, magic links require users to provide their email and the user will be sent an email with the link to sign-in, and the users can use this link to log into the system.
Can this ...
0
votes
0answers
57 views
Authentication & Authorization for multiple separated APIs
Architecture Overview:
Single Authentication Server and a separate API for each group of users, that can access their API through multiple SPAs with SSO feature. Let’s say we have three APIs A, B and ...
0
votes
0answers
118 views
Rest Services Aunthentication and Authorization with AWS Cognito
I am designing the authentication and authorization flow of my mobile and web applications. I plan to use the AWS Cognito identity provider.
Use AWS Amplify and signup the user from the front-end.
...
1
vote
0answers
75 views
OAuth for command line application
I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
0
votes
1answer
72 views
Okta backend verification of Access Token generated in PKCE flow
I'm looking to verify the security of the OAuth mechanism for an application I'm testing. The application uses Okta for SSO and the PKCE OAuth flow.
What I'm not clear on is how the backend is ...
1
vote
0answers
51 views
Isolating permissions available to browser JS via oauth and referer
This proposal concerns a strategy for isolating the permissions given to plugins in a plugin architecture. I'm looking for insight into whether this design can succeed in isolating those permissions.
...
0
votes
1answer
163 views
Is PKCE really protecting public facing clients? Can't a rogue app steal the ClientID and Secret and make a AuthCode request of its own?
From what I have understood, for public facing clients such as JavaScript apps that run on the browser or mobile apps which have no backend there is no secure place to store client id and secret. ...
1
vote
0answers
106 views
Implement an SPA with IFrames, but with Single Sign-on
I want to build an SPA with ASP.NET Core (Blazor server side) which some IFrames redirecting to other applications. In this example I have f.e. the SPA, Grafana to show graphs and Node-Red, but there ...
1
vote
0answers
58 views
How can OAuth2 (tokens) fit into dynamic sites that still wants to call protected API's via JavaScript?
(I try to understand different concepts regarding web development in general)
Most information I find is about Single Page Applications, but how does a dynamic site make use of (for example) OAuth2/...
0
votes
0answers
46 views
Permissions & Scopes in OAuth2 API
I‘m writing an oauth2 authorization Server at the moment and I‘m know at a point where I need other opinions/knowledge on how to implement Scopes. I decided to do a permission system where both is ...
1
vote
1answer
110 views
Why does PKCE for Oauth2.0 hash the ascii bytes instead of the original bytes?
Maybe this is not a useful question, but I got a little hung up on this because it seems a little strange. In the example of the PKCE verification in RFC-7636 it details the following:
The client uses ...
1
vote
1answer
93 views
SSL certificate for desktop app?
I built an app, which authenticates users via oauth2. I have a simple server that can accept requests.
After authentication, the user is redirected to https://127.0.0.1:1234/token=<token> and ...
0
votes
0answers
75 views
authorization token is not bound to client
I have examined a web application, and I have found some strange behaviour of tokens. I will try to explain it.
I think OAuth2 is used for authorization.
User Alice will login to the app, in the HTTP ...
1
vote
2answers
63 views
Is access token confidentiality also ensured in the Authorization Code grant type in Oauth2.0
One of the really nice articles I came across while trying to understand the various grant types in Oauth2.0 was this. The author really has done a good job at explaining quite clearly what various ...
1
vote
1answer
111 views
What are the best practices to create a safe and performant user registration and validation with Nodejs and Postgres? [closed]
I've been asked to write an app with registration and login systems. In essence, I've already wrote the first version of their app using PHP, some javascript/jquery and storing data in MySQL. It ...
2
votes
2answers
109 views
Does signing in via OAuth 2.0 compromise account security if the OAuth 2.0 service decides to become malicious?
Say we signup and login to an OAuth 2.0 enabled security application called "AI Car Command Center" via Google OAuth 2.0
We then logout.
Does Google then have the capability to then grant ...
1
vote
1answer
100 views
Additional check for request integrity
I'm building a REST API resource server with JWT authorization for an Angular web app. I'm looking for a method to perform an additional check if the request body sent from the client application has ...
1
vote
0answers
110 views
API keys or Client Credentials flow? Good practice to control application access to a deployed web component
Company A developed a widget (Web Component) deployed on several clients/partners.
Only clients/partners must be authorized to use the widget.
No need to distinguish between each end users (clients' ...
0
votes
1answer
100 views
Why have a refresh_token with an OAuth2 Client Credentials grant type?
Can someone explain to me the purpose of the refresh token when you're using the Client Credentials grant type with OAuth2? I'm confused because you can easily generate a new access token without one, ...
1
vote
1answer
58 views
Standard Protocols or secure mechanism to authenticate users offline
We have a use case wherein a mobile app that can be used by multiple users on the same device needs to authenticate the users in some offline scenarios. We were using Password grant as in OAuth2 to ...
1
vote
1answer
682 views
When using PKCE, are the state and nonce parameters still necessary protection from csrf and code injection?
When I'm using the authorization code flow with PKCE do I still need state and nonce?
For state (that prevents login-csrf), if an attacker sends me a malicious Authorization Response, the client may ...
