Questions tagged [oauth2]

OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0

Filter by
Sorted by
Tagged with
0
votes
1answer
36 views

Is a consent screen in an OAuth 2.0 implementation optional

I've read through RFC 6749: https://datatracker.ietf.org/doc/html/rfc6749 The only mention of consent is in this bit: The authorization server MUST implement CSRF protection for its authorization ...
0
votes
0answers
35 views

How to authenticate OAuth2 confidential client is making a REST call?

We are looking to implement some REST services to be called from partner servers (not end users via a browser). The out-of-the-box implementation seems to flow thusly: Partner server passes a client ...
1
vote
0answers
32 views

Where should I store an OAuth refresh token for a third party?

I am connecting to a third party which authenticates with OAuth2. Once the user has logged in, I want to store the access & refresh tokens for the user. Which is more secure & proper - to save ...
0
votes
1answer
47 views

How to pentest oAuth2/oidc clients

imagine the following problem: As a developer, I would like to check if my oAuth2 or OpenID Connect client is really secure. I would like to check if it validates the JWT signature, uses the nonce etc....
0
votes
1answer
54 views

How is pop token more secure than bearer token?

I tried reading few articles, however I'm not able to understand the merit of POP over Bearer token. Bearer token if lost (during transit over the wire) can give the holder of the token same ...
1
vote
1answer
60 views

Whose fault/bug is it in the below case?

Say there are 2 servers a.example and b.example. b.example uses 3rd party authentication from a.example via OAuth or other protocols. Now a user user1 with account xyz@a.example logs in and sets up a ...
1
vote
0answers
47 views

Is Google OAuth login in 3rd party applications via system browser secure?

Numerous mobile applications allow me to "Login with Google". From technical perspective, I assume this would usually follow those OAuth native app login integration guidelines: https://...
0
votes
0answers
27 views

What stops an attacker from simply using your client_id in their own auth code flow with PKCE

Ok so I get the benefit that PKCE provides. Without it, the attacker knows your client_secret and by registering the same URL scheme as your application on mobile, can intercept the redirect with the ...
1
vote
0answers
60 views

Alternatives to OAuth 2 for first-party native applications

I am currently thinking about alternative ways for my native iOS Application (written in Swift) to receive access- & refresh-tokens. As of now, user sessions are established using revokable JWTs, ...
0
votes
0answers
33 views

Storing an OAuth 2.0 access token

I'm in a debate of where to securely store an OAuth 2.0 access token. There are two opinions: On the browser (inside of a HttpOnly cookie) On the server/inside the a database The argument against ...
4
votes
4answers
231 views

Is a “magic link” a kind of authentication?

From what am I reading, magic links require users to provide their email and the user will be sent an email with the link to sign-in, and the users can use this link to log into the system. Can this ...
0
votes
0answers
47 views

Authentication & Authorization for multiple separated APIs

Architecture Overview: Single Authentication Server and a separate API for each group of users, that can access their API through multiple SPAs with SSO feature. Let’s say we have three APIs A, B and ...
0
votes
0answers
40 views

Rest Services Aunthentication and Authorization with AWS Cognito

I am designing the authentication and authorization flow of my mobile and web applications. I plan to use the AWS Cognito identity provider. Use AWS Amplify and signup the user from the front-end. ...
1
vote
0answers
52 views

OAuth for command line application

I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
0
votes
1answer
45 views

Okta backend verification of Access Token generated in PKCE flow

I'm looking to verify the security of the OAuth mechanism for an application I'm testing. The application uses Okta for SSO and the PKCE OAuth flow. What I'm not clear on is how the backend is ...
1
vote
0answers
38 views

Isolating permissions available to browser JS via oauth and referer

This proposal concerns a strategy for isolating the permissions given to plugins in a plugin architecture. I'm looking for insight into whether this design can succeed in isolating those permissions. ...
0
votes
1answer
72 views

Is PKCE really protecting public facing clients? Can't a rogue app steal the ClientID and Secret and make a AuthCode request of its own?

From what I have understood, for public facing clients such as JavaScript apps that run on the browser or mobile apps which have no backend there is no secure place to store client id and secret. ...
1
vote
0answers
61 views

Implement an SPA with IFrames, but with Single Sign-on

I want to build an SPA with ASP.NET Core (Blazor server side) which some IFrames redirecting to other applications. In this example I have f.e. the SPA, Grafana to show graphs and Node-Red, but there ...
1
vote
0answers
48 views

How can OAuth2 (tokens) fit into dynamic sites that still wants to call protected API's via JavaScript?

(I try to understand different concepts regarding web development in general) Most information I find is about Single Page Applications, but how does a dynamic site make use of (for example) OAuth2/...
0
votes
0answers
31 views

Permissions & Scopes in OAuth2 API

I‘m writing an oauth2 authorization Server at the moment and I‘m know at a point where I need other opinions/knowledge on how to implement Scopes. I decided to do a permission system where both is ...
1
vote
1answer
81 views

Why does PKCE for Oauth2.0 hash the ascii bytes instead of the original bytes?

Maybe this is not a useful question, but I got a little hung up on this because it seems a little strange. In the example of the PKCE verification in RFC-7636 it details the following: The client uses ...
1
vote
1answer
71 views

SSL certificate for desktop app?

I built an app, which authenticates users via oauth2. I have a simple server that can accept requests. After authentication, the user is redirected to https://127.0.0.1:1234/token=<token> and ...
0
votes
0answers
59 views

authorization token is not bound to client

I have examined a web application, and I have found some strange behaviour of tokens. I will try to explain it. I think OAuth2 is used for authorization. User Alice will login to the app, in the HTTP ...
1
vote
2answers
38 views

Is access token confidentiality also ensured in the Authorization Code grant type in Oauth2.0

One of the really nice articles I came across while trying to understand the various grant types in Oauth2.0 was this. The author really has done a good job at explaining quite clearly what various ...
1
vote
1answer
78 views

What are the best practices to create a safe and performant user registration and validation with Nodejs and Postgres? [closed]

I've been asked to write an app with registration and login systems. In essence, I've already wrote the first version of their app using PHP, some javascript/jquery and storing data in MySQL. It ...
2
votes
2answers
86 views

Does signing in via OAuth 2.0 compromise account security if the OAuth 2.0 service decides to become malicious?

Say we signup and login to an OAuth 2.0 enabled security application called "AI Car Command Center" via Google OAuth 2.0 We then logout. Does Google then have the capability to then grant ...
1
vote
1answer
62 views

Additional check for request integrity

I'm building a REST API resource server with JWT authorization for an Angular web app. I'm looking for a method to perform an additional check if the request body sent from the client application has ...
1
vote
0answers
86 views

API keys or Client Credentials flow? Good practice to control application access to a deployed web component

Company A developed a widget (Web Component) deployed on several clients/partners. Only clients/partners must be authorized to use the widget. No need to distinguish between each end users (clients' ...
0
votes
1answer
43 views

Why have a refresh_token with an OAuth2 Client Credentials grant type?

Can someone explain to me the purpose of the refresh token when you're using the Client Credentials grant type with OAuth2? I'm confused because you can easily generate a new access token without one, ...
1
vote
1answer
45 views

Standard Protocols or secure mechanism to authenticate users offline

We have a use case wherein a mobile app that can be used by multiple users on the same device needs to authenticate the users in some offline scenarios. We were using Password grant as in OAuth2 to ...
1
vote
1answer
284 views

When using PKCE, are the state and nonce parameters still necessary protection from csrf and code injection?

When I'm using the authorization code flow with PKCE do I still need state and nonce? For state (that prevents login-csrf), if an attacker sends me a malicious Authorization Response, the client may ...
1
vote
0answers
24 views

Should I consider migrating away from OAuth 2.0 Implicit Flow for an internal application relying on Azure AD?

I have recently migrated an internal application (API + SPA) security from Windows Authentication (done by IIS) to Azure A/D authentication using the implicit flow. Now, every user must enter an e-...
0
votes
1answer
47 views

Is creating asymmetric keys dynamically and storing in memory safe?

I want to make an application that uses oauth2 and JWT as access tokens for securing some apis and providing authentication mechanisms. The application is a microservice architecture and wirtten in ...
1
vote
0answers
114 views

SAML/oauth2/openid-connect login via proxy as another user

I manage a set of service providers (SP1, SP2, SP3, etc), and we currently have this SAML SSO flow working where the SP causes a POST submit to the SAML IDP with an XML SAML request which includes an ...
0
votes
0answers
27 views

Securing a third party REST service

We are using an application that exposes several REST endpoints. The service offers a very simple but insecure authentication using plain text HTTP headers. The network that this service will be ...
2
votes
2answers
164 views

How could a server to server rest api communication be more secure, by using OAuth 2?

I created a large backend+frontend project for a client. They recently started a different project, and contracted an other company to develop and host it. Since they need some of the data from my ...
0
votes
0answers
55 views

JWE and the key management modes

Wrapping my head around JWE and the key management modes. The point of JWE is to prevent third parties to see/change the token. Only the token issuer and resource server should be able to use it. (Is ...
3
votes
1answer
95 views

Protected APIs for public clients without end-user authentication

A simple question which I cannot find any guidance on the RFC6749 (or related) spec. I have an eCommerce public client (SPA & mobile), where I want to postpone as much as possible the ...
0
votes
1answer
39 views

OAuth2 - Benefits for using Grant-Type:Password for machine-to-machine web-service calls

I'm using a 3rd party service developed by the Experian Credit Bureau. Looking at their documentation, they are using OAuth2 & are expecting Grant_type: password in order for external developers ...
0
votes
2answers
69 views

Is there any additional overhead over using Oauth vs Client Certificates?

I have a requirement to add security between service to API communication. The current implementation is client certificates. The client gets a certificate and just sends it in a cookie to the API. ...
0
votes
0answers
32 views

client security separate from user context

Consider the following set up applications and services: apps: mycompany.com webapp apis: products api orders api mycompany.com's webapp uses OAuth2/openidconnect with an IdP (such as auth0) to ...
0
votes
2answers
101 views

I found that I could delete the state parameter in an OAuth request and the response was validated and e-mail was still verified

I was fiddling around with an OAuth2.0 request on burpsuite and I found that it validated the account even after I deleted the state parameter completely and forwarded the request through burpsuite. I ...
0
votes
1answer
70 views

Sharing oauth2 token with AJAX request to be sent to resource server

I am a little confused on how the token is shared from the client to an AJAX script to the resource server in the oauth2 flow. To explain the scenario I am trying to set up, I have a client (http://...
1
vote
0answers
71 views

Zero-Trust alternative to google sign-in, is this a feasable design?

I was thinking about zero-trust systems over the last few weeks and it seems like there are many things that could be implemented that way. With password managers being one of those things, I was ...
2
votes
0answers
341 views

Keycloak and Open ID Connect best practices

I'm a bit lost as to the best practice surrounding a production-ready access management based on keycloak and open id connect. My understanding is that if you use Keycloak's provided adapters, instead ...
1
vote
0answers
53 views

What prevents an app impersonating another native windows client with Oauth2/PKCE

Given a native windows app, with a redirect URL of example://redirect, what prevents a malicious user from taking the Client ID (public), and creating a new app that sets itself up to be the target of ...
2
votes
1answer
105 views

client_id vs distinguished name in mutual tls

i am reading this in the OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens What is the difference between a client_id and a distinguished name? I see in the PKI Mutual-TLS ...
1
vote
0answers
138 views

Difference between JSON web token, bearer token, and MAC token in OAuth2

I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens where the authorization server issues a client a JSON web token with the following format { "iss&...
0
votes
0answers
69 views

validation of an access token from the resource server

I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Boun Access Tokens The client after receives an access token (which is also entails his certificate in a hash format) from ...
0
votes
1answer
65 views

symmetric keys during mutual TLS

I have a client how asks a token from an auth server in order to use it to an endpoint which serves as the resource server. Between the client and the server, a handshake is utilized in order the two ...

1
2 3 4 5
7