Questions tagged [oauth2]
OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
371
questions
0
votes
1
answer
24
views
OAuth 2.0 POST to Authorization Endpoint
The OAuth 2.0 specification states:
The authorization server MUST support the use of the HTTP "GET" method [RFC2616] for the authorization endpoint and MAY support the use of the "POST&...
0
votes
0
answers
51
views
What are the risks of using wildcard in context path of OIDC/OAuth redirect_uri?
I'm using Keycloak for my authentication needs. It allows me to use * as wildcard when whitelisting redirect_uris for OIDC clients. What are the risks of using * in context path of redirect_uri? For ...
0
votes
0
answers
17
views
Safe way to allow authorized application to generate a new key after one is broken?
I've run into an OAuth issue where I received a key from the provider with an expiration that was literally set for the same moment I received it. The refresh token's expiration was also set for that ...
- 181
0
votes
0
answers
21
views
What is the 'domain name' in PKCE Auth flow for mobile apps?
I'm interested in building a mobile app that authenticates with a service using OAuth2 so that my app can use their API's. Documentation
To apply for an application key, I need to enter my application'...
-1
votes
1
answer
23
views
Definition of Authorization according to OAuth2
I am trying to understand OAuth2 and OIDC. The OIDC glossary is a good starting point, and while it defines "Authentication", but does not actually define "Authorization". I ...
- 95
3
votes
1
answer
122
views
Adding SSO to an existing website - should SSO login link to matching email address?
I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and ...
- 131
0
votes
2
answers
50
views
Revoke all refresh tokens when account locked?
Scenario: a user enters his password incorrectly x times, so his account is locked for y minutes.
Should I revoke all his refresh tokens?
Problems:
user is logged out of all devices, not just the one ...
- 333
0
votes
0
answers
16
views
Downside of resource owner password flow for native mobile apps?
I have seen some similar questions a few years old and I am not sure if there are any new changing views on this.
I see that this flow is not recommended for mobile native apps. What are the practical ...
- 101
0
votes
1
answer
90
views
3rd party mobile app access our service via our APIs
We have a microservice backend system & we expose APIs for our customers to use. We are now developing our Authentication system with our identity provider service.
We have a customer(a company), ...
- 51
0
votes
0
answers
82
views
Using oauth2 to implement SSO between a desktop application and a web application
Is oauth2 designed to handle single-sign-on between a desktop application and a webapp?
The scenario looks like this:
The desktop app has a username/password login
After a user is authenticated in ...
- 43
0
votes
0
answers
25
views
Why can't an email or profile scope used to authenticate in OAuth?
I am trying to learn OAuth and I keep reading that "OAuth is only used for authorization." However, if you add an email or profile scope, doesn't that identify who the user is? So can it be ...
- 131
1
vote
0
answers
43
views
Auth0 token exchange vs Google Firebase token exchange
I'm researching our options for securing access to a single-page web app and a mobile app. The apps communicate with a REST API which, based on the authenticated user's identity, will return ...
- 111
0
votes
1
answer
40
views
Multifactor auth in OAuth2 Password flow
This resource (and others) mention that OAuth2 Password flow doesn't provide mechanism for multi-factor authentication.
Does that mean other flows do?
How does MFA fit in the OAuth2 framework?
What ...
0
votes
0
answers
60
views
HTTP Bearer authentication with multiple identity providers?
Suppose I have a web application that uses OpenID Connect to enable users to log in with one of several 3rd party identity providers (e.g., "log in with Google", "log in with Facebook&...
- 376
3
votes
0
answers
129
views
Implement state parameter in OAuth2.0 code flow server-side
I have a scenario where I need to implement OAuth 2.0 authorization code flow on the server side - the user authorizes a backend service against Microsoft, the service receives a token, saves it in a ...
- 81
2
votes
3
answers
171
views
Detecting session sharing with OAuth2
In the OAuth2 Implict Grant flow, the access token is added to the URL fragment as part of the redirect from the Authorization Server to the Relying Party. Since this access token is made visible to ...
- 125
-1
votes
1
answer
269
views
How to secure backend API access?
In the good old days, you made server-side websites using PHP or something like that, now we have modern web apps divided into front-end and back-end (usually API Rest), you can't rely on CORS because ...
- 143
0
votes
0
answers
69
views
GitLab with api scope and confidentiality unchecked. What are the privacy risks?
I just created a GitLab application to connect it with StackEdit.io. I created it by following the instructions on this GitLab docs page. I had to create the GitLab application with api scope and I ...
- 101
0
votes
0
answers
146
views
OpenId with Biometrics - should I write a custom login + OIDC
We are trying to arrive at a solution for an enterprise app
Different Users have different Authentication Methods
User Type 1 - Password + Captcha
User type 2 - Biometric [Not device-based] + ...
0
votes
0
answers
60
views
I have a non-Oauth service and am using this approach with Server initiated HttpOnly cookies with stripped JWT
My question is : Is this approach correct given I have a non-Oauth service? My goal is to use the simplest amount of security features while still being as strong as possible.
My approach is as ...
- 101
0
votes
1
answer
111
views
Modern security flow/process for trusted Mobile and SPA apps with self-hosted OIDC
Currently, there are two common auth flows i know:
Resource Owner Password Flow
Authentication Code Flow + PKCE (didn't mention other, since this one is more robust within redirect-based)
This theme ...
- 101
0
votes
1
answer
122
views
Wouldn't the OAuth 2.0 client credentials flow be more secure with the option of using refresh tokens?
The OAuth 2.0 specification states that "A refresh token SHOULD NOT be included" in responses to access token requests in the client credentials flow and that, even if they were used, the ...
- 101
0
votes
0
answers
90
views
Access to JWT session after OAuth redirects
I have a stateless backend app, session data is stored on the front-end in a JWT token, so the front-end app passes this token in Authorization header to all the requests.
I need to add 3rd party API ...
- 1
0
votes
0
answers
123
views
how to avoid Oauth2 timeouts with orchestrator REST API
I have a REST API, which I'll call "R". R uses Oauth2 Bearer tokens for auth.
However, R has a fairly complex API, so we're designing a new system called "O" that provides a ...
- 51
1
vote
1
answer
88
views
Password Based Encryption with Social Login
I have a question about implementing user password-based encryption in a database injunction with the Social Login feature.
User private data in my database should be encrypted in order to provide ...
2
votes
3
answers
443
views
OAuth2 - using Id Token for authentication to a backend service
Many resources on the internet state that you should use Access Token and not Id Token to authenticate to an API, but do not provide explicit reasons why. Are there any real drawbacks to use an Id ...
- 229
2
votes
1
answer
174
views
Why is PKCE "RECOMMENDED" for authorization codes with confidential clients?
Section 2.1.1 of IETF's OAuth 2.0 Security Best Current Practice begins as follows:
Clients MUST prevent injection (replay) of authorization codes into
the authorization response by attackers. ...
- 441
0
votes
1
answer
57
views
A Native Desktop App using PKCE - Can an id_token be consider valid authentication when passed to another protected server resource?
My understanding is that client impersonation cannot be prevented for Native Desktop Apps. If all standard controls: State, PKCE, Redirect_URI confirmation etc are in place, to prevent auth_code ...
- 13
0
votes
1
answer
163
views
Is there a risk involved in refreshing a JWT token every time you refocus the webpage?
I am currently testing a website that appears to make a refresh token request every time I focus away from the web browser and back, or away from the tab the website is open in and back to it. I've ...
- 173
1
vote
1
answer
123
views
What is a pre-warmed secret?
As described here: https://tools.ietf.org/id/draft-ietf-oauth-security-topics-13.html#proposed-countermeasures-2
Note on pre-warmed secrets: An attacker can circumvent the
countermeasures described ...
- 13
1
vote
0
answers
181
views
Openid nonce replay attack in auth code flow
Looking at this question Openid connect nonce replay attack and the answer by @benbotto. I understand the replay attack in implicit flow but unable to understand it for auth code flow. Let's say an ...
- 11
1
vote
1
answer
267
views
Is OAuth2.0 Authorization Code Grant flow with PKCE really secure?
CONTEXT
There is a SPA that uses Authorization Code Grant flow with PKCE to get info from an API all the info is highly sensitive
RESEARCH
Here is what I found of how Authorization Code Grant flow ...
- 143
1
vote
0
answers
79
views
Authorise access to hierarchical data
Consider a scenario in which you offer service access based on a hierarchy of authority. i.e., a HEAD can register his subordinates. The authenticated HEAD has the previledge to read and update data ...
- 121
0
votes
0
answers
73
views
Strategies for segregating anonymous and secure access to APIs
Traditionally, we used either path-based access control or a separate DNS for public and private content segregation. In the modern era of standard-based auth, what are the best auth strategies for ...
- 121
0
votes
1
answer
107
views
Which OAuth2 flow should I use?
Context
I'm trying to build an hybrid multi-tenant API using OAuth2.0 using Laravel 8 Passport, so my system has 2 parts: one process the request from the tenant application, and the other part ...
- 143
0
votes
2
answers
161
views
Is a consent screen in an OAuth 2.0 implementation optional
I've read through RFC 6749: https://datatracker.ietf.org/doc/html/rfc6749
The only mention of consent is in this bit:
The authorization server MUST implement CSRF protection for its
authorization ...
- 121
0
votes
0
answers
83
views
How to authenticate OAuth2 confidential client is making a REST call?
We are looking to implement some REST services to be called from partner servers (not end users via a browser).
The out-of-the-box implementation seems to flow thusly:
Partner server passes a client ...
- 101
1
vote
0
answers
83
views
Where should I store an OAuth refresh token for a third party?
I am connecting to a third party which authenticates with OAuth2. Once the user has logged in, I want to store the access & refresh tokens for the user. Which is more secure & proper - to save ...
- 111
0
votes
1
answer
461
views
How to pentest oAuth2/oidc clients
imagine the following problem:
As a developer, I would like to check if my oAuth2 or OpenID Connect client is really secure.
I would like to check if it validates the JWT signature, uses the nonce etc....
- 2,383
0
votes
1
answer
921
views
How is pop token more secure than bearer token?
I tried reading few articles, however I'm not able to understand the merit of POP over Bearer token. Bearer token if lost (during transit over the wire) can give the holder of the token same ...
- 141
1
vote
1
answer
115
views
Whose fault/bug is it in the below case?
Say there are 2 servers a.example and b.example.
b.example uses 3rd party authentication from a.example via OAuth or other protocols.
Now a user user1 with account xyz@a.example logs in and sets up a ...
- 11
1
vote
0
answers
97
views
Is Google OAuth login in 3rd party applications via system browser secure?
Numerous mobile applications allow me to "Login with Google".
From technical perspective, I assume this would usually follow those OAuth native app login integration guidelines: https://...
- 153
1
vote
0
answers
80
views
What stops an attacker from simply using your client_id in their own auth code flow with PKCE [duplicate]
Ok so I get the benefit that PKCE provides. Without it, the attacker knows your client_secret and by registering the same URL scheme as your application on mobile, can intercept the redirect with the ...
- 121
1
vote
0
answers
253
views
Alternatives to OAuth 2 for first-party native applications
I am currently thinking about alternative ways for my native iOS Application (written in Swift) to receive access- & refresh-tokens. As of now, user sessions are established using revokable JWTs, ...
- 111
0
votes
0
answers
117
views
Storing an OAuth 2.0 access token
I'm in a debate of where to securely store an OAuth 2.0 access token. There are two opinions:
On the browser (inside of a HttpOnly cookie)
On the server/inside the a database
The argument against ...
- 111
5
votes
4
answers
417
views
Is a "magic link" a kind of authentication?
From what am I reading, magic links require users to provide their email and the user will be sent an email with the link to sign-in, and the users can use this link to log into the system.
Can this ...
- 51
1
vote
0
answers
133
views
OAuth for command line application
I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
- 1,445
0
votes
1
answer
126
views
Okta backend verification of Access Token generated in PKCE flow
I'm looking to verify the security of the OAuth mechanism for an application I'm testing. The application uses Okta for SSO and the PKCE OAuth flow.
What I'm not clear on is how the backend is ...
- 175
1
vote
0
answers
74
views
Isolating permissions available to browser JS via oauth and referer
This proposal concerns a strategy for isolating the permissions given to plugins in a plugin architecture. I'm looking for insight into whether this design can succeed in isolating those permissions.
...
- 111
0
votes
1
answer
331
views
Is PKCE really protecting public facing clients? Can't a rogue app steal the ClientID and Secret and make a AuthCode request of its own?
From what I have understood, for public facing clients such as JavaScript apps that run on the browser or mobile apps which have no backend there is no secure place to store client id and secret. ...
- 101