Questions tagged [oauth2]
OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
210
questions
0
votes
0answers
34 views
Best practices for Access Token expired in Regular Web Application after POST Request
I'm using a MVC ASP.Net Application with OWIN OpenId Connect Middleware, according to implicit flow authentication the middleware sets a Session Cookie that expires as the same time as lifetime Access ...
3
votes
2answers
87 views
Why does OAuth 2.0 RFC6749 disallow fragments in redirect URI?
I wasn't able to find a similar question explaining the considerations of the RFC6749 specification when it comes to redirecting the user from the authorization server to the client. In the RFC ...
0
votes
0answers
28 views
How to integrate an Oauth2 based application into a Wordpress plugin?
I'm working on a Wordpress plugin that integrates an external service. This service has an API that authenticates using OAuth 2.0. The plugin is public and can be used by anyone who has an account at ...
1
vote
1answer
40 views
OAuth Authorization Flow without external user agent for iOS application
We are developing an iOS application and server where a user will be able to store some personal information and top up money.
I have been reading about the OAuth Authorization flow using PKCE and ...
0
votes
1answer
31 views
How to store Oauth2 Access Token in a Cookie correctly?
Im working on a small Custom Oauth2 Authorization Server.
I want to send the Access Token in a http only Cookie to the client.
According to 5.1 of the RFC6749 the token has to be in the entity-body of ...
0
votes
0answers
17 views
How to know what type of encryption/encode has used? [duplicate]
is there any way to find the type of encryption/encoding is being used? For example, i'm implementing gmail API application while fetching the storing credentials those are stored in encrypted mode ...
0
votes
0answers
51 views
Does Using Opaque Access Tokens Make My Server Stateful? [migrated]
I am trying to understand statelessness in restful APIs in the context of authentication. Here's the scenario:
The user logs in.
The server verifies the username and the password, and generates an ...
0
votes
0answers
49 views
OAuth access token/API key patterns for large web sites
First off, let me preface this post by saying I'm not a security expert.
I'm trying to build regular expressions to find OAuth 2.0 access tokens and API Keys for common web sites such as Google, ...
0
votes
1answer
43 views
Secure API key mechanism for identification
In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using ...
0
votes
0answers
18 views
Secure API and User Data both with Oauth2.0
We are currently looking at adding API endpoints for a third party to consume and the endpoints will be concerning individual user data.
The current proposed security architecture is to use Oauth2.0 ...
0
votes
0answers
26 views
Can I rely on Google id_token for web session?
I'm building a website without a "server": JavaScript and AWS Lambdas as back-end through API Gateway.
Knowing there is no solution for session when using lambdas, I was wondering if I could only use ...
1
vote
1answer
56 views
OpenIdConnect: Is there an advantage to using code flow over implicit flow with form_post?
Background: a traditional webapp with a server backend and 3rd party sign in. For this we get a validated id_token on our backend from the 3rd party, use that to identify an account in our system, and ...
1
vote
1answer
123 views
Is it a major security risk if your client_secret gets displayed for about 30 min - 1 hour before you notice it showing and you can remove it? [duplicate]
Did something stupid, and asked a question on stackoverflow posted a little too much info without realizing it.
Is it a major security risk if your client_secret gets displayed for about 30 min - 1 ...
0
votes
1answer
63 views
IN OAuth 2.0, how is the client secret supposed to be kept secret?
Using most OAuth 2.0 flows, a client application can identify itself to the authorization server by means of a "client id" and "client secret."
The OAuth 2 specification says that the client secret ...
0
votes
1answer
71 views
Does PKCE replace state in the Authorization Code OAuth flow?
PKCE explanation: https://www.oauth.com/oauth2-servers/pkce/
OAuth Flow example: https://developer.okta.com/docs/guides/implement-auth-code-pkce/use-flow/
My question is more specifically: Is there ...
1
vote
1answer
80 views
Is OAuth2.0 really secure for a mobile application?
I have been doing some research about using OAuth2.0 on our mobile application, but I'm really having trouble deciding whether OAuth2.0 really is the best choice.
Since we are not interacting with ...
0
votes
1answer
74 views
What are the security implications using a Refresh Token in a SPA using Authorisation Code Flow + PKCE
I am considering moving my SPA from Implicit flow to Authorization Code + PKCE extension.
This new flow will provide the SPA with a Refresh Token that doesn't expire.
Let's say a malicious user on ...
0
votes
0answers
36 views
OAauth - Authorize Vs Token Routes
Although I read about the differences between the token route and the authorized route I am not sure exactly when I need to use them.
If I understand correctly the /authorize will be used for clients ...
0
votes
0answers
28 views
OAauth - When To User Refresh Token?
I understand the role of refresh token but I'm not sure when it is enough to provide only access token and when need to provide both access token and refresh token? For example, if a user login to my ...
0
votes
1answer
57 views
JSON Web Encryption (JWE): should one verify the alg and enc similarly to JWS alg whitelisting?
Use of JWS may suffer from flaws when relying on the "alg" attribute as described here: Critical vulnerabilities in JSON Web Token libraries.
The advice is to verify that the signing JWS algorithm is ...
0
votes
2answers
156 views
What's the concrete case for code flow being more secure than implicit flow?
It's seeming like the extra loop via the client backend in code flow only adds obscurity - not security. If, in the end, the client backend dishes out the same access token to the front end as the ...
0
votes
0answers
52 views
Potential problems not verifying the JWT signature if wrapped in another JWT depending on HTTPS
Say that we have an authentication system that generates JWT to authenticate users to other systems. This JWT contains an inner token that can be made by multiple IDP's. The signature of this JWT is ...
1
vote
1answer
41 views
Why do we need the refresh_token OAuth flow?
In OAuth 2.0, I'm confused about hwy we need a refresh token flow. Per my understanding, when you submit a "refresh_token" grant type, you receive an access token, its expiration, and a refresh token....
0
votes
1answer
82 views
OIDC: should the provider have the same address as the issuer?
I'm using Coreos OIDC library for Go. When setting up an OIDC config (coming from PROVIDER_URL/.well-known/openid-configuration), I'm getting this error:
Could not initialize OIDC provider:oidc: ...
1
vote
3answers
110 views
Is it wise to completely rely OAuth2 for new users and not have our own login(with username and password) system
My question is: Is it fine to build applications where the user login is completely handled by OAuth2 and services like that. That way we do not have to have our own password database for the users. ...
0
votes
2answers
85 views
How do you actully secure OAuth tokens? [closed]
Lets say you have the following curl :
curl -k \
-d "grant_type=password&username=Username&password=Password"
-H "Authorization: Basic <Base64Encoded(client-id:client-secret)>"
...
0
votes
0answers
18 views
Deterministic private entropy from OAuth2
On web-cryptocurrency-wallet some users don't want to store private keys for small sums of money and want to authorize via google/twitter.
As far as I understand the typical way is to have some sort ...
0
votes
0answers
40 views
What are security/privacy implications when using WeChat as OAuth provider?
Account information of the chinese WeChat service can be used to authenticate on other websites/services (like discussion forums) by the OAuth protocol. Since WeChat plays a major role in surveillance ...
0
votes
2answers
58 views
OAuth 2.0, what should it be returned in the authorize endpoint if the client_id is wrong and no redirect_uri is passed
We have been working on a OAuth 2.0 IDP implementation, and during the implementation of the authorize endpoint, i couldnt find in the RFC 6749, what should happen if the client_id is not passed in ...
0
votes
0answers
65 views
Tomcat OIDC Authenticated Realm
I am currently using a tomcat authenticator implementation (https://github.com/boylesoftware/tomcat-oidcauth). The authenticator is implemented as a tomcat valve. This implementation still requires a ...
1
vote
0answers
67 views
Designing distributed authentication/authorisation system
I'm trying to design a system that has the following elements:
the main backend REST API (currently one, probably multiple in the future)
front-channel client(s) -- JS-based single-page app(s)
back-...
4
votes
3answers
206 views
Distribute Program with Sheets API Credentials
I am trying to write a program that uses the Google Sheets API to read spreadsheets and operate on the data.
My program contains a credentials.json file which I obtained from the Java Quickstart page ...
2
votes
2answers
102 views
Attacker models of long-term logins: how should sensitive server endpoints require re-authentication?
Let's see the following scenario:
"GutHib" is a fictional hosting service in the form of an online webapp for the fictional DVCS software "Gut".
Alice logged in to GutHib with her password and 2FA, ...
0
votes
2answers
107 views
How client-side OAuth is secure?
I want to make a static webpage, but secure it with a login.
In order to do this, I looked at this link. Basically, I want users to log in their Google account to be able to view the webpage.
But I ...
1
vote
1answer
63 views
Is it recommended to send an authentication request to the Resource Owner (by the Authorization Server) if it already has an active session?
In OAuth 2.0 Authorization Code Flow (Grant Type), is it recommended (or is it maybe even a best practice) to send an authentication request (e.g. a login-request form) to the Resource Owner (by the ...
1
vote
0answers
29 views
Oauth2/OIDC: I know the address of a resource server, is there a standard for querying which authorization servers it accepts?
I have a bunch of what are essentially IOT devices that will authenticate connections using oauth 2 tokens and/or openid connect (depending on use-case). Each IOT device is individually configurable ...
0
votes
0answers
40 views
Implementing OAuth 2 refresh token rotation on web clients
I'm looking to implement refresh token rotation for unauthenticated clients of my OAuth 2 provider.
Things are all implemented on the server side, but I'm concerned that web clients will be unable to ...
2
votes
0answers
54 views
OAuth2: what to return when revoking a token which is not the client's? RFC7009
In RFC7009 - section 2.1, it is stated that:
The authorization server first validates the client credentials (in
case of a confidential client) and then verifies whether the token
was ...
0
votes
0answers
113 views
OpenId Connect Authorization Code Flow in Microservice Scenario (API-Gateway?)
Im building a SPA with a couple of backend-microservices and i want to authenticate using OIdC.
I'm aware of the fact that the implicit flow is not recommended anymore for this. So the recommended ...
5
votes
1answer
228 views
Can websites detect if visitors are logged in to mainstream ID providers and collect their IDs?
Logging in to websites using mainstream IDs (Google/Facebook/Github etc.) by means of OAuth (or similar) has nowadays become a feature that people expect.
Not that long ago the corresponding user ...
1
vote
1answer
115 views
Why is there a redirect to the native app in PKCE?
Why even have a redirect or even use the browser? Wouldn't just a normal TLS/HTTPS request/response in the app protect the requests and token?
The one argument I have heard against solely relying on ...
2
votes
1answer
84 views
What are the security risks associated with leaking client_secret in OAuth2?
There is an API that openly returns client_secret for each existing user, as long as you pass an email address.
Is that a vulnerability?
What are the risks?
0
votes
1answer
45 views
what is the scope of google drive's OAuth credentials?
I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
0
votes
1answer
17 views
Can a service be Oauth2 provider and Oauth2 client at the same time?
Let's say a new application X is an Oauth2 client and allows it's user to signup/login with other Oauth2 providers like Google. So a user U signs up using Google and regularly logins using Google to ...
0
votes
0answers
28 views
OIDC Protocol :: Different OIDC Server End points
OIDC Specifications:
Authorization Code Grant Flow.
As OIDC Server is shall list the various end points (Auth EP, Token EP, Token validation EP etc.)
In this scenario, Can Auth End Point and Token End ...
0
votes
1answer
152 views
OAuth2 Client Credentials Flow with assertion JWT: How to share the client's public key?
I'm having a deeper look into OAuth 2.0 and especially the Client Credentials Flow that is intended to authenticate a client application or device without user interaction (the client is accessing its ...
1
vote
0answers
52 views
Is it secure to expose OAuth2 credentials for a test application
I have created an application in which it is possible to login using GitLab. This requires an OAuth2 app id and secret.
I created a test application in GitLab UI with the redirect set to https://...
1
vote
1answer
213 views
Why is PKCE secure against man-in-the-middle attacks?
In attempting to implement OAuth2 into a natively installed client application, we face the problem that we cannot securely store the pre-shared client secret. After doing some research, I came across ...
2
votes
2answers
323 views
Microservices and RBAC using OIDC
I am currently working on migrating our users from an internal DB to an OIDC service (considering Cognito/Auth0/etc.), and I am trying to implement RBAC.
Our backend is basically a bunch of ...
0
votes
0answers
217 views
Using Cognito access token to pass claims
I am working on migrating all our users from our DB to a managed service, and we're considering AWS Cognito.
We want to use Cognito for Authentication and Access Control.
For access control, we're ...
