Questions tagged [oauth2]

OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0

Filter by
Sorted by
Tagged with
0 votes
0 answers
12 views

Azure AD has an "issuer" attribute on JWK keys in the JWK Set but Google ID does not, what is its purpose?

The Google Identity openid discovery url https://accounts.google.com/.well-known/openid-configuration, has a .jwks_uri of https://www.googleapis.com/oauth2/v3/certs. If we look at the first key in ...
user avatar
0 votes
0 answers
25 views

oauth2 with additional secret

I'm using Spring boot to create an application that stores user secrets in a database (I have to store the secrets); each secret is stored in the database after being encrypted with the user's ...
user avatar
  • 1
0 votes
0 answers
18 views

Are there security concerns with IMAP when used with OAuth2 and MFA?

Several organizations using Outlook365 (the hosted/managed MS Exchange service from Microsoft) seem to be disabling IMAP and SMTP entirely, forcing users to only use the Outlook client. I get that ...
user avatar
0 votes
1 answer
39 views

Fully Qualified Domain Name (FQDN) based authentication

IP addresses can change and the FQDN is slightly more constant. So I thought that FQDN based authentication instead of IP based authentication might be a good idea, but I didn't find any information ...
user avatar
0 votes
1 answer
48 views

refresh token without client_id and client_secret

I was reading the OAuth protocol docs https://datatracker.ietf.org/doc/html/rfc6749#section-6 where it implies that you don't need a client_id and client_secret to refresh an access token, just a ...
user avatar
  • 113
0 votes
0 answers
20 views

Using public OAuth tokens to authorize access to internal services

Here's the deal. This might probably be a known best practice, but I haven't been able to find anything on the matter. Suppose company X has a public facing web API server, and a public OAuth Identity ...
user avatar
  • 23
0 votes
0 answers
15 views

Act as another google cloud platform user in a web app

I want to set up an OAuth2.0 flow on a web application for users that have access to GCP. The user will login to a web app. Then, the OAuth2.0 flow will need to ask for the consent that will allow the ...
user avatar
  • 103
0 votes
1 answer
52 views

Is it acceptable to send an access token back to a browser client?

I am currently following the instructions for getting an access token on behalf of a Twilio user described here The part that is confusing me where it seems to generate an access token then proxy it ...
user avatar
  • 161
0 votes
2 answers
33 views

Is it safe to use email from OAuth for authentication?

I am implementing OAuth (more specifically "Sign in with Google") for a website that has been using only email and password for years. Now the guide that I'm reading suggests to read the uid ...
user avatar
0 votes
0 answers
48 views

Using `react-oidc-context` and storing the `access_token` and `refresh_token` together

I am looking for a "best practises" approach for creating SPAs protected using OIDC + PKCE. Most of our applications are hosted on two independent web servers with a load balancer routing ...
user avatar
0 votes
0 answers
49 views

Why is OIDC more secure than oauth2?

If oauth2 is used with the state parameter (I know it's not required by the standard), wouldn't this ensure freshness, i.e. that authentication just happened? What additional security can OIDC bring?
user avatar
0 votes
0 answers
19 views

What risks are there in using an OAuth2 access_token from an IdP that I do not control to secure an API that I do control?

Imagine I host some API. Its exact function is irrelevant to the question, but it needs to have some sort of authorization put in front of it. I want to call Google's APIs, so users can interact with ...
user avatar
1 vote
2 answers
57 views

OAuth2 - What is the advantage of using certificate over client secret credentials? (Azure)

When using OAuth2 in Azure, why Certificates are more secure than using Secrets? The Secrets have expiration and are strong, and generated automatically. The application needs to send a JWT containing ...
user avatar
  • 111
0 votes
1 answer
50 views

Validating CSRF state with an OAuth2 POST Callback

I am setting up OAuth2 for Apple, and it requires a POST response to the callback URL if certain scopes (e.g. email address) are included. My intended process for preventing CSRF: Set a cookie with a ...
user avatar
0 votes
1 answer
49 views

OAuth 2.0 POST to Authorization Endpoint

The OAuth 2.0 specification states: The authorization server MUST support the use of the HTTP "GET" method [RFC2616] for the authorization endpoint and MAY support the use of the "POST&...
user avatar
0 votes
0 answers
154 views

What are the risks of using wildcard in context path of OIDC/OAuth redirect_uri?

I'm using Keycloak for my authentication needs. It allows me to use * as wildcard when whitelisting redirect_uris for OIDC clients. What are the risks of using * in context path of redirect_uri? For ...
user avatar
0 votes
0 answers
19 views

Safe way to allow authorized application to generate a new key after one is broken?

I've run into an OAuth issue where I received a key from the provider with an expiration that was literally set for the same moment I received it. The refresh token's expiration was also set for that ...
user avatar
  • 181
0 votes
0 answers
21 views

What is the 'domain name' in PKCE Auth flow for mobile apps?

I'm interested in building a mobile app that authenticates with a service using OAuth2 so that my app can use their API's. Documentation To apply for an application key, I need to enter my application'...
user avatar
-1 votes
1 answer
24 views

Definition of Authorization according to OAuth2

I am trying to understand OAuth2 and OIDC. The OIDC glossary is a good starting point, and while it defines "Authentication", but does not actually define "Authorization". I ...
user avatar
3 votes
1 answer
137 views

Adding SSO to an existing website - should SSO login link to matching email address?

I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and ...
user avatar
0 votes
2 answers
87 views

Revoke all refresh tokens when account locked?

Scenario: a user enters his password incorrectly x times, so his account is locked for y minutes. Should I revoke all his refresh tokens? Problems: user is logged out of all devices, not just the one ...
user avatar
  • 363
0 votes
1 answer
46 views

Downside of resource owner password flow for native mobile apps?

I have seen some similar questions a few years old and I am not sure if there are any new changing views on this. I see that this flow is not recommended for mobile native apps. What are the practical ...
user avatar
  • 101
1 vote
1 answer
103 views

3rd party mobile app access our service via our APIs

We have a microservice backend system & we expose APIs for our customers to use. We are now developing our Authentication system with our identity provider service. We have a customer(a company), ...
user avatar
0 votes
0 answers
98 views

Using oauth2 to implement SSO between a desktop application and a web application

Is oauth2 designed to handle single-sign-on between a desktop application and a webapp? The scenario looks like this: The desktop app has a username/password login After a user is authenticated in ...
user avatar
  • 43
0 votes
0 answers
36 views

Why can't an email or profile scope used to authenticate in OAuth?

I am trying to learn OAuth and I keep reading that "OAuth is only used for authorization." However, if you add an email or profile scope, doesn't that identify who the user is? So can it be ...
user avatar
1 vote
0 answers
55 views

Auth0 token exchange vs Google Firebase token exchange

I'm researching our options for securing access to a single-page web app and a mobile app. The apps communicate with a REST API which, based on the authenticated user's identity, will return ...
user avatar
  • 111
0 votes
1 answer
44 views

Multifactor auth in OAuth2 Password flow

This resource (and others) mention that OAuth2 Password flow doesn't provide mechanism for multi-factor authentication. Does that mean other flows do? How does MFA fit in the OAuth2 framework? What ...
user avatar
0 votes
0 answers
76 views

HTTP Bearer authentication with multiple identity providers?

Suppose I have a web application that uses OpenID Connect to enable users to log in with one of several 3rd party identity providers (e.g., "log in with Google", "log in with Facebook&...
user avatar
3 votes
0 answers
198 views

Implement state parameter in OAuth2.0 code flow server-side

I have a scenario where I need to implement OAuth 2.0 authorization code flow on the server side - the user authorizes a backend service against Microsoft, the service receives a token, saves it in a ...
user avatar
2 votes
3 answers
213 views

Detecting session sharing with OAuth2

In the OAuth2 Implict Grant flow, the access token is added to the URL fragment as part of the redirect from the Authorization Server to the Relying Party. Since this access token is made visible to ...
user avatar
-1 votes
1 answer
423 views

How to secure backend API access?

In the good old days, you made server-side websites using PHP or something like that, now we have modern web apps divided into front-end and back-end (usually API Rest), you can't rely on CORS because ...
user avatar
  • 143
0 votes
0 answers
92 views

GitLab with api scope and confidentiality unchecked. What are the privacy risks?

I just created a GitLab application to connect it with StackEdit.io. I created it by following the instructions on this GitLab docs page. I had to create the GitLab application with api scope and I ...
user avatar
  • 101
0 votes
0 answers
239 views

OpenId with Biometrics - should I write a custom login + OIDC

We are trying to arrive at a solution for an enterprise app Different Users have different Authentication Methods User Type 1 - Password + Captcha User type 2 - Biometric [Not device-based] + ...
user avatar
0 votes
0 answers
61 views

I have a non-Oauth service and am using this approach with Server initiated HttpOnly cookies with stripped JWT

My question is : Is this approach correct given I have a non-Oauth service? My goal is to use the simplest amount of security features while still being as strong as possible. My approach is as ...
user avatar
  • 101
0 votes
1 answer
122 views

Modern security flow/process for trusted Mobile and SPA apps with self-hosted OIDC

Currently, there are two common auth flows i know: Resource Owner Password Flow Authentication Code Flow + PKCE (didn't mention other, since this one is more robust within redirect-based) This theme ...
user avatar
  • 101
0 votes
1 answer
162 views

Wouldn't the OAuth 2.0 client credentials flow be more secure with the option of using refresh tokens?

The OAuth 2.0 specification states that "A refresh token SHOULD NOT be included" in responses to access token requests in the client credentials flow and that, even if they were used, the ...
user avatar
  • 101
0 votes
0 answers
128 views

Access to JWT session after OAuth redirects

I have a stateless backend app, session data is stored on the front-end in a JWT token, so the front-end app passes this token in Authorization header to all the requests. I need to add 3rd party API ...
user avatar
  • 1
0 votes
0 answers
138 views

how to avoid Oauth2 timeouts with orchestrator REST API

I have a REST API, which I'll call "R". R uses Oauth2 Bearer tokens for auth. However, R has a fairly complex API, so we're designing a new system called "O" that provides a ...
user avatar
  • 51
1 vote
1 answer
96 views

Password Based Encryption with Social Login

I have a question about implementing user password-based encryption in a database injunction with the Social Login feature. User private data in my database should be encrypted in order to provide ...
user avatar
2 votes
3 answers
605 views

OAuth2 - using Id Token for authentication to a backend service

Many resources on the internet state that you should use Access Token and not Id Token to authenticate to an API, but do not provide explicit reasons why. Are there any real drawbacks to use an Id ...
user avatar
  • 229
2 votes
1 answer
246 views

Why is PKCE "RECOMMENDED" for authorization codes with confidential clients?

Section 2.1.1 of IETF's OAuth 2.0 Security Best Current Practice begins as follows: Clients MUST prevent injection (replay) of authorization codes into the authorization response by attackers. ...
user avatar
0 votes
1 answer
62 views

A Native Desktop App using PKCE - Can an id_token be consider valid authentication when passed to another protected server resource?

My understanding is that client impersonation cannot be prevented for Native Desktop Apps. If all standard controls: State, PKCE, Redirect_URI confirmation etc are in place, to prevent auth_code ...
user avatar
0 votes
1 answer
212 views

Is there a risk involved in refreshing a JWT token every time you refocus the webpage?

I am currently testing a website that appears to make a refresh token request every time I focus away from the web browser and back, or away from the tab the website is open in and back to it. I've ...
user avatar
  • 173
1 vote
1 answer
123 views

What is a pre-warmed secret?

As described here: https://tools.ietf.org/id/draft-ietf-oauth-security-topics-13.html#proposed-countermeasures-2 Note on pre-warmed secrets: An attacker can circumvent the countermeasures described ...
user avatar
1 vote
0 answers
200 views

Openid nonce replay attack in auth code flow

Looking at this question Openid connect nonce replay attack and the answer by @benbotto. I understand the replay attack in implicit flow but unable to understand it for auth code flow. Let's say an ...
user avatar
1 vote
1 answer
340 views

Is OAuth2.0 Authorization Code Grant flow with PKCE really secure?

CONTEXT There is a SPA that uses Authorization Code Grant flow with PKCE to get info from an API all the info is highly sensitive RESEARCH Here is what I found of how Authorization Code Grant flow ...
user avatar
  • 143
1 vote
0 answers
82 views

Authorise access to hierarchical data

Consider a scenario in which you offer service access based on a hierarchy of authority. i.e., a HEAD can register his subordinates. The authenticated HEAD has the previledge to read and update data ...
user avatar
0 votes
0 answers
75 views

Strategies for segregating anonymous and secure access to APIs

Traditionally, we used either path-based access control or a separate DNS for public and private content segregation. In the modern era of standard-based auth, what are the best auth strategies for ...
user avatar
0 votes
1 answer
113 views

Which OAuth2 flow should I use?

Context I'm trying to build an hybrid multi-tenant API using OAuth2.0 using Laravel 8 Passport, so my system has 2 parts: one process the request from the tenant application, and the other part ...
user avatar
  • 143
0 votes
2 answers
196 views

Is a consent screen in an OAuth 2.0 implementation optional

I've read through RFC 6749: https://datatracker.ietf.org/doc/html/rfc6749 The only mention of consent is in this bit: The authorization server MUST implement CSRF protection for its authorization ...
user avatar
  • 111

1
2 3 4 5
8