Questions tagged [oauth2]
OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
348
questions
0
votes
1answer
36 views
Is a consent screen in an OAuth 2.0 implementation optional
I've read through RFC 6749: https://datatracker.ietf.org/doc/html/rfc6749
The only mention of consent is in this bit:
The authorization server MUST implement CSRF protection for its
authorization ...
0
votes
0answers
35 views
How to authenticate OAuth2 confidential client is making a REST call?
We are looking to implement some REST services to be called from partner servers (not end users via a browser).
The out-of-the-box implementation seems to flow thusly:
Partner server passes a client ...
1
vote
0answers
32 views
Where should I store an OAuth refresh token for a third party?
I am connecting to a third party which authenticates with OAuth2. Once the user has logged in, I want to store the access & refresh tokens for the user. Which is more secure & proper - to save ...
0
votes
1answer
47 views
How to pentest oAuth2/oidc clients
imagine the following problem:
As a developer, I would like to check if my oAuth2 or OpenID Connect client is really secure.
I would like to check if it validates the JWT signature, uses the nonce etc....
0
votes
1answer
54 views
How is pop token more secure than bearer token?
I tried reading few articles, however I'm not able to understand the merit of POP over Bearer token. Bearer token if lost (during transit over the wire) can give the holder of the token same ...
1
vote
1answer
60 views
Whose fault/bug is it in the below case?
Say there are 2 servers a.example and b.example.
b.example uses 3rd party authentication from a.example via OAuth or other protocols.
Now a user user1 with account xyz@a.example logs in and sets up a ...
1
vote
0answers
47 views
Is Google OAuth login in 3rd party applications via system browser secure?
Numerous mobile applications allow me to "Login with Google".
From technical perspective, I assume this would usually follow those OAuth native app login integration guidelines: https://...
0
votes
0answers
27 views
What stops an attacker from simply using your client_id in their own auth code flow with PKCE
Ok so I get the benefit that PKCE provides. Without it, the attacker knows your client_secret and by registering the same URL scheme as your application on mobile, can intercept the redirect with the ...
1
vote
0answers
60 views
Alternatives to OAuth 2 for first-party native applications
I am currently thinking about alternative ways for my native iOS Application (written in Swift) to receive access- & refresh-tokens. As of now, user sessions are established using revokable JWTs, ...
0
votes
0answers
33 views
Storing an OAuth 2.0 access token
I'm in a debate of where to securely store an OAuth 2.0 access token. There are two opinions:
On the browser (inside of a HttpOnly cookie)
On the server/inside the a database
The argument against ...
4
votes
4answers
231 views
Is a “magic link” a kind of authentication?
From what am I reading, magic links require users to provide their email and the user will be sent an email with the link to sign-in, and the users can use this link to log into the system.
Can this ...
0
votes
0answers
47 views
Authentication & Authorization for multiple separated APIs
Architecture Overview:
Single Authentication Server and a separate API for each group of users, that can access their API through multiple SPAs with SSO feature. Let’s say we have three APIs A, B and ...
0
votes
0answers
40 views
Rest Services Aunthentication and Authorization with AWS Cognito
I am designing the authentication and authorization flow of my mobile and web applications. I plan to use the AWS Cognito identity provider.
Use AWS Amplify and signup the user from the front-end.
...
1
vote
0answers
52 views
OAuth for command line application
I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
0
votes
1answer
45 views
Okta backend verification of Access Token generated in PKCE flow
I'm looking to verify the security of the OAuth mechanism for an application I'm testing. The application uses Okta for SSO and the PKCE OAuth flow.
What I'm not clear on is how the backend is ...
1
vote
0answers
38 views
Isolating permissions available to browser JS via oauth and referer
This proposal concerns a strategy for isolating the permissions given to plugins in a plugin architecture. I'm looking for insight into whether this design can succeed in isolating those permissions.
...
0
votes
1answer
72 views
Is PKCE really protecting public facing clients? Can't a rogue app steal the ClientID and Secret and make a AuthCode request of its own?
From what I have understood, for public facing clients such as JavaScript apps that run on the browser or mobile apps which have no backend there is no secure place to store client id and secret. ...
1
vote
0answers
61 views
Implement an SPA with IFrames, but with Single Sign-on
I want to build an SPA with ASP.NET Core (Blazor server side) which some IFrames redirecting to other applications. In this example I have f.e. the SPA, Grafana to show graphs and Node-Red, but there ...
1
vote
0answers
48 views
How can OAuth2 (tokens) fit into dynamic sites that still wants to call protected API's via JavaScript?
(I try to understand different concepts regarding web development in general)
Most information I find is about Single Page Applications, but how does a dynamic site make use of (for example) OAuth2/...
0
votes
0answers
31 views
Permissions & Scopes in OAuth2 API
I‘m writing an oauth2 authorization Server at the moment and I‘m know at a point where I need other opinions/knowledge on how to implement Scopes. I decided to do a permission system where both is ...
1
vote
1answer
81 views
Why does PKCE for Oauth2.0 hash the ascii bytes instead of the original bytes?
Maybe this is not a useful question, but I got a little hung up on this because it seems a little strange. In the example of the PKCE verification in RFC-7636 it details the following:
The client uses ...
1
vote
1answer
71 views
SSL certificate for desktop app?
I built an app, which authenticates users via oauth2. I have a simple server that can accept requests.
After authentication, the user is redirected to https://127.0.0.1:1234/token=<token> and ...
0
votes
0answers
59 views
authorization token is not bound to client
I have examined a web application, and I have found some strange behaviour of tokens. I will try to explain it.
I think OAuth2 is used for authorization.
User Alice will login to the app, in the HTTP ...
1
vote
2answers
38 views
Is access token confidentiality also ensured in the Authorization Code grant type in Oauth2.0
One of the really nice articles I came across while trying to understand the various grant types in Oauth2.0 was this. The author really has done a good job at explaining quite clearly what various ...
1
vote
1answer
78 views
What are the best practices to create a safe and performant user registration and validation with Nodejs and Postgres? [closed]
I've been asked to write an app with registration and login systems. In essence, I've already wrote the first version of their app using PHP, some javascript/jquery and storing data in MySQL. It ...
2
votes
2answers
86 views
Does signing in via OAuth 2.0 compromise account security if the OAuth 2.0 service decides to become malicious?
Say we signup and login to an OAuth 2.0 enabled security application called "AI Car Command Center" via Google OAuth 2.0
We then logout.
Does Google then have the capability to then grant ...
1
vote
1answer
62 views
Additional check for request integrity
I'm building a REST API resource server with JWT authorization for an Angular web app. I'm looking for a method to perform an additional check if the request body sent from the client application has ...
1
vote
0answers
86 views
API keys or Client Credentials flow? Good practice to control application access to a deployed web component
Company A developed a widget (Web Component) deployed on several clients/partners.
Only clients/partners must be authorized to use the widget.
No need to distinguish between each end users (clients' ...
0
votes
1answer
43 views
Why have a refresh_token with an OAuth2 Client Credentials grant type?
Can someone explain to me the purpose of the refresh token when you're using the Client Credentials grant type with OAuth2? I'm confused because you can easily generate a new access token without one, ...
1
vote
1answer
45 views
Standard Protocols or secure mechanism to authenticate users offline
We have a use case wherein a mobile app that can be used by multiple users on the same device needs to authenticate the users in some offline scenarios. We were using Password grant as in OAuth2 to ...
1
vote
1answer
284 views
When using PKCE, are the state and nonce parameters still necessary protection from csrf and code injection?
When I'm using the authorization code flow with PKCE do I still need state and nonce?
For state (that prevents login-csrf), if an attacker sends me a malicious Authorization Response, the client may ...
1
vote
0answers
24 views
Should I consider migrating away from OAuth 2.0 Implicit Flow for an internal application relying on Azure AD?
I have recently migrated an internal application (API + SPA) security from Windows Authentication (done by IIS) to Azure A/D authentication using the implicit flow.
Now, every user must enter an e-...
0
votes
1answer
47 views
Is creating asymmetric keys dynamically and storing in memory safe?
I want to make an application that uses oauth2 and JWT as access tokens for securing some apis and providing authentication mechanisms. The application is a microservice architecture and wirtten in ...
1
vote
0answers
114 views
SAML/oauth2/openid-connect login via proxy as another user
I manage a set of service providers (SP1, SP2, SP3, etc), and we currently have this SAML SSO flow working where the SP causes a POST submit to the SAML IDP with an XML SAML request which includes an ...
0
votes
0answers
27 views
Securing a third party REST service
We are using an application that exposes several REST endpoints. The service offers a very simple but insecure authentication using plain text HTTP headers. The network that this service will be ...
2
votes
2answers
164 views
How could a server to server rest api communication be more secure, by using OAuth 2?
I created a large backend+frontend project for a client. They recently started a different project, and contracted an other company to develop and host it. Since they need some of the data from my ...
0
votes
0answers
55 views
JWE and the key management modes
Wrapping my head around JWE and the key management modes.
The point of JWE is to prevent third parties to see/change the token. Only the token issuer and resource server should be able to use it. (Is ...
3
votes
1answer
95 views
Protected APIs for public clients without end-user authentication
A simple question which I cannot find any guidance on the RFC6749 (or related) spec.
I have an eCommerce public client (SPA & mobile), where I want to postpone as much as possible the ...
0
votes
1answer
39 views
OAuth2 - Benefits for using Grant-Type:Password for machine-to-machine web-service calls
I'm using a 3rd party service developed by the Experian Credit Bureau. Looking at their documentation, they are using OAuth2 & are expecting Grant_type: password in order for external developers ...
0
votes
2answers
69 views
Is there any additional overhead over using Oauth vs Client Certificates?
I have a requirement to add security between service to API communication. The current implementation is client certificates. The client gets a certificate and just sends it in a cookie to the API. ...
0
votes
0answers
32 views
client security separate from user context
Consider the following set up applications and services:
apps:
mycompany.com webapp
apis:
products api
orders api
mycompany.com's webapp uses OAuth2/openidconnect with an IdP (such as auth0) to ...
0
votes
2answers
101 views
I found that I could delete the state parameter in an OAuth request and the response was validated and e-mail was still verified
I was fiddling around with an OAuth2.0 request on burpsuite and I found that it validated the account even after I deleted the state parameter completely and forwarded the request through burpsuite. I ...
0
votes
1answer
70 views
Sharing oauth2 token with AJAX request to be sent to resource server
I am a little confused on how the token is shared from the client to an AJAX script to the resource server in the oauth2 flow.
To explain the scenario I am trying to set up, I have
a client (http://...
1
vote
0answers
71 views
Zero-Trust alternative to google sign-in, is this a feasable design?
I was thinking about zero-trust systems over the last few weeks and it seems like there are many things that could be implemented that way. With password managers being one of those things, I was ...
2
votes
0answers
341 views
Keycloak and Open ID Connect best practices
I'm a bit lost as to the best practice surrounding a production-ready access management based on keycloak and open id connect.
My understanding is that if you use Keycloak's provided adapters, instead ...
1
vote
0answers
53 views
What prevents an app impersonating another native windows client with Oauth2/PKCE
Given a native windows app, with a redirect URL of example://redirect, what prevents a malicious user from taking the Client ID (public), and creating a new app that sets itself up to be the target of ...
2
votes
1answer
105 views
client_id vs distinguished name in mutual tls
i am reading this in the OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
What is the difference between a client_id and a distinguished name? I see in the PKI Mutual-TLS ...
1
vote
0answers
138 views
Difference between JSON web token, bearer token, and MAC token in OAuth2
I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
where the authorization server issues a client a JSON web token with the following format
{
"iss&...
0
votes
0answers
69 views
validation of an access token from the resource server
I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Boun Access Tokens
The client after receives an access token (which is also entails his certificate in a hash format) from ...
0
votes
1answer
65 views
symmetric keys during mutual TLS
I have a client how asks a token from an auth server in order to use it to an endpoint which serves as the resource server.
Between the client and the server, a handshake is utilized in order the two ...
