Questions tagged [oauth2]
OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
170 questions
-1
votes
0answers
39 views
how does Google login differentiate between it's own apps and third party apps?
When you're using one of the Google apps, you enter your credentials and the app can now access all the relevant Google APIs..
When you're using a third party app and using "Login with Google", ...
0
votes
0answers
39 views
OpenID Connect: Is storing access token in browser sercure?
I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
0
votes
0answers
21 views
oAuth2 and LDAP integration
I have set of APIs which are written based on oauth 2.0. in my system currently all the user accounts are saved in MySQL DB. Now I want to integrate LDAP with this system to verify users through LDAP ...
0
votes
0answers
29 views
OAuth2 refresh token flow with mobile app
I'm having some issue with an access token not being refreshed in my mobile application. I'm trying to figure out what would be the best approach to fix it.
This is the scenario faced by some mobile ...
0
votes
0answers
35 views
Is it ok to forward a JWT between two custom services?
I'm using Azure AD Implicit Flow for authentication between a SPA and a WebApi.
I want to know if it would be ok/save to redirect from the SPA to a intermediary service of my own as well with the ...
0
votes
0answers
18 views
How does access delegation work - Access Token work?
I'm trying to understand how do access tokens work. What is the mechanism used to generate access tokens similar to AWS Secure Token Service or OAuth Tokens.
I am assuming the algorithm is as follows:...
1
vote
1answer
77 views
+50
Invalidate API tokens when LDAP user is invalid
I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below.
User sends LDAP username and password (with password grand type) to
the server.
Server ...
0
votes
0answers
67 views
Alternative OAuth 2 flow?
I have an implementation of the OAuth 2.0 authorization code flow, but I'm wondering if I can securely introduce a new flow. I'd like a flow that doesn't require the resource owner to ever need to ...
2
votes
1answer
31 views
OAuth2 - Obtaining Refresh Tokens
Given a valid access token alone (you don't know username+password), should you be able to get a refresh token?
2
votes
1answer
68 views
OAuth: how to prevent phishing with malicious redirect URIs
To quote the OAuth spec:
If the resource owner denies the access request or if the request fails for reasons other than a missing or invalid redirection URI, the authorization server informs the ...
0
votes
0answers
29 views
Do I have to use two OAuth/OpenIdConnect bearer token with PKCE?
We have some REST APIs exposed to public applications. Those applications are registered with an (application protocol scheme) redirect URL and we provide to the developer a client secret and client ...
3
votes
0answers
36 views
Architecting a solution with native login and 3rd party login via OAuth/OpenID Connect using dotnet core
I am building an API driven application that will have a native login with username and password, and will also need to grant 3rd party access via OAuth/OpenID Connect in the near future.
A pattern I ...
0
votes
1answer
31 views
capture authorization code programmatically in OAuth 2.0
In a standard OAuth auth code Grant flow, user is redirected to authorization server page where he provides consent to allow the requesting app to perform some actions on his behalf, after which a ...
0
votes
0answers
12 views
Does an authorization code grant rely on sessions?
It's my (possibly flawed) understanding that the authorisation code grant is attractive because it keeps access tokens away from a potentially insecure user agent. I understand how this would work ...
1
vote
0answers
94 views
OAuth 2.0 + OpenID for authentication in mobile apps
Current Way
We have a mobile application that uses SMS based OTP for logins. Till now, since the app was considered as trusted party, we had no authorization flow like in OAuth. Our flow was (similar ...
0
votes
0answers
12 views
What's the attack vector for authenticated wildcard CORS origin for a public API?
I have
a public API (intended to be used by third-party websites)
authentication only via JWT bearer tokens (no cookie authentication). SPAs have to add the Authorization header for every API request....
0
votes
1answer
52 views
Is it safe to just forget OAuth tokens, and not invalidate them in a mobile app?
I have a mobile application that a user signs into using OpenId Connect and OAuth 2.0. Currently when the user logs out, I open up a webpage to the end_session_endpoint (http://docs.identityserver.io/...
0
votes
0answers
19 views
Node.js Cookies/Tokens (Access & Refresh) - OAUTH2 - How to store tokens and time/function refreshing
1) I am currently building a RESTful API which acts as a middleman between clients and an authentication server. A client gives me some account details and my server passes them to the auth server who ...
1
vote
2answers
47 views
Is it dangerous not to verify the signature of an id token issued by an external authorization server?
I need to retrieve some values from an id token issued by an external authorization server inside a private network.
I asked for the certificate used to sign the jwt in order to verify it but I've ...
4
votes
0answers
44 views
Poor Man's OAuth Grant - Review
A 3rd party company has requested that we implement single sign-on with them using the below approach. I'm familiar with OAuth grants and OIDC flows but this seems rather odd to me.
The user has ...
1
vote
0answers
32 views
Is the OAuth implicit flow too insecure for serverless single page web applications?
Assuming the need for OAuth
Imagine an application that is:
A single page web application hosted on S3
Authenticated using implicit OAuth flow implicit
Have the web application access resources ...
0
votes
0answers
24 views
Is Oauth2 Implicit grant two-legged or three-legged?
In implicit grant, the resource owner has to provide consent to allow the application to access the resources on user's behalf. Doesn't this make Implicit grant a 3-legged flow?
This video states ...
1
vote
1answer
50 views
How can I securely disable CSRF validation for native clients when browser clients access the same API?
I have an API endpoint that is accessible by both native (console, mobile apps) and Javascript based clients.
How do I ensure that the CSRF AntiForgeryToken is only invoked during Javascript calls?
...
1
vote
0answers
77 views
Using Google Authentication with Lambda@Edge and S3 Static Sites
I am looking to set up authentication on an S3 hosted static site. The configuration is:
S3 bucket configured to allow access via cloudfront
AWS Cloudfront distribution with HTTPS configured and a ...
0
votes
0answers
22 views
How does SupportsCredentials, Access-Control-Allow-Credentials, and CORS Origin=* relate?
I'm investigating CSRF implementations in ASP.NET, MVC, WebAPI the relationship between the headers that are sent:
A Javascript client call of XMLHttpRequest.withCredentials
A server response of ...
1
vote
1answer
53 views
OAuth 2.0 when and how to use the client id and secret
The OAuth 2.0 protocol uses the client id and secret. It considers the client id to be public while the secret is private. Anyway it also considers to generate the client id randomly with a certain ...
2
votes
2answers
65 views
Why refresh token if I can reauthenticate?
So I have a backend service (batch service, no user access), everytime I make a request I need to call the token endpoint and send my username/password in the header then it returns an access token ...
0
votes
1answer
47 views
Mobile apps that use OAuth2 to offload authentication to a 3rd party: are they misusing OAuth2?
I have been tasked with building a mobile app that requires users to login to a 3rd party service via OAuth2 to obtain some data about them. This mobile app also requires its own backend database ...
0
votes
1answer
88 views
Should I use TOTP when using OAuth2
I'm implementing TOTP in my application to allow users to use two factor authentication with Google authenticator and the like.
However I've also implemented "social login" using OAuth, should the ...
1
vote
0answers
23 views
When is OAuth1 preferred over OAuth2
Scenario:
I need to build a new API for a third party company who are building a tool to capture information of new users wishing to create accounts on our enterprise platform.
-x-
My preferred ...
1
vote
3answers
134 views
How Secure is OAuth2 for Web Applications?
Let’s consider a single page client side application, developed using HTML and Javascript.
In this case, even if the implicit or authentication code flow is being used to request Access Tokes, still ...
1
vote
1answer
73 views
Is it a good idea to notify a user that they signed up with a social-login account?
Say my website provides three main ways to signup/signin: Google, Facebook and typical username/password. Is it a good idea to flash "Please login using your Google account" if a user tries to login ...
0
votes
1answer
31 views
Revoke OAuth2 Token For Mobile App
When a user logs into my mobile app it uses OAuth to authenticate them and generates a token. The token is then checked against each subsequent request. Each user account in my application has an ...
2
votes
1answer
46 views
Is it secure to handle the OAuth 2 Authorization callback from a CDN?
This question is in the context of the OAuth 2.0 Authorization Framework.
Consider a web application that is backed by a first-party API but relies on a third-party authorization server for SSO.
Say ...
1
vote
0answers
47 views
Tunelling an Authenticated User Across Microservices Securely
On a platform which follows the OAuth 2.0 framework for authorization and a microserivce based architecture, what is a secure way to pass a user from one microservice to another on the same platform ...
0
votes
0answers
57 views
How to properly store OAuth 2.0 client_id and client_secret in a web application?
In the PoC (Proof of Concept) that I'm currently developing, data from an API is consumed and OAuth 2.0 is required for authentication. The application is already working as expected, the users are ...
0
votes
0answers
17 views
implementing push api for files using oauth2
i want to implement a push api similar to Garmin Connect API.
this api allows the clients to get the data of garmin users, as garmin will push to the clients the user's files whenever created.
we ...
3
votes
1answer
103 views
Is there any way for server side to verify the application integrity during OAuth2 workflow
During OAuth2 PKCE workflow, the native application (installed on Android/iOS device) issues the authorize request to server and exchange the OAuthtokens.
For server side, is there any way that we ...
0
votes
0answers
12 views
Clarification needed on OAuth 2.0 Framework RFC content
In the introduction part of OAuth 2.0 RFC document, the 4th bullet mentions as follows:
Resource owners cannot revoke access to an individual third party
without revoking access to all ...
1
vote
1answer
97 views
Found how to get Oauth2 client_id along matching secret but redirect_uri is whitelisted as requirement. Is it still safe?
If you get an OAuth 2.0 client_id along with a matching secret, you can in theory impersonate the target website.
You trick the victim into visiting your URL;
Through the client_id and the matching ...
1
vote
1answer
90 views
JWT access tokens: Too much information?
I've recently encountered the practice of systems using JWTs as Access Tokens. I have a concern and I'm not sure if it's unfounded:
I associate JWTs with the OpenID Connect protocol, where there are ...
2
votes
4answers
146 views
How can a OAuth2 resource server relate an access token to the user that authorized it to prevent unauthorized access to other user resources?
I'd appreciate if someone could clear up if, according to the OAuth2 RFC, the resource server could infer the user associated to an access token or not, or even if that is expected.
Let’s assume the ...
2
votes
1answer
172 views
Using third party authentication like google/facebook to login to a site, is there any security risk when the site is hacked?
Sites like stackoverflow, quora, and many more offers sign in from Google/Facebook. In the event that there is a data breach or the site is hacked, is there any security risk to your Google/Facebook ...
2
votes
1answer
82 views
Oauth2 PKCE - Can the refresh_token be trusted?
If a have a mobile that is authorized against my server using PKCE, which allows it to get a access_token and a refresh_token, to what extent should I trust that the app can use the refresh_token from ...
1
vote
1answer
39 views
What are the pieces of information delivered in a user profile at the end of a OpenID Connect flow?
From what I understand about using OpenID Connect (over OAuth2), is that we end up with some JSON containing information about the user. That information is transported as a JSON Web Token.
➥ What ...
0
votes
1answer
42 views
How to implement magic link sign in with oAuth2
We have two web applications. One is developed in Django, let's call it portal (oAuth2 provider). Another is developed in PHP, let's call it client.
We want to display a link for authenticated users ...
2
votes
0answers
149 views
How to provide granular API security using OAuth scopes and claims
I'm trying to work out how best to secure an API using oAuth scopes and/or claims. I'm unsure on which I should be using.
My setup is as follows:
All users sign in to signin.domain.com
There are ...
0
votes
1answer
124 views
What is the example parameter in the OAuth 2.0 RFC
In section 4.1.4 of the OAuth 2.0 RFC, it gives an example of an access token response:
An example successful response:
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
...
0
votes
1answer
30 views
A Method for Generating Un-Guessable Client Identifiers
I am implementing an OAuth 2.0 authorisation server. As part of client registration process I want to generate the unique client identifier for this client.
The method I have chosen is to take all ...
1
vote
0answers
28 views
Nested API security
What are best practices for securing nested APIs?
Here is an example:
User browser (Authenticated already) -> REST API A -> REST API B (internal and may or may not be exposed to internet)
Typically,...
