Questions tagged [oauth2]
OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
194
questions
0
votes
1answer
90 views
What's the concrete case for code flow being more secure than implicit flow?
It's seeming like the extra loop via the client backend in code flow only adds obscurity - not security. If, in the end, the client backend dishes out the same access token to the front end as the ...
0
votes
0answers
42 views
Potential problems not verifying the JWT signature if wrapped in another JWT depending on HTTPS
Say that we have an authentication system that generates JWT to authenticate users to other systems. This JWT contains an inner token that can be made by multiple IDP's. The signature of this JWT is ...
1
vote
1answer
36 views
Why do we need the refresh_token OAuth flow?
In OAuth 2.0, I'm confused about hwy we need a refresh token flow. Per my understanding, when you submit a "refresh_token" grant type, you receive an access token, its expiration, and a refresh token....
0
votes
1answer
61 views
OIDC: should the provider have the same address as the issuer?
I'm using Coreos OIDC library for Go. When setting up an OIDC config (coming from PROVIDER_URL/.well-known/openid-configuration), I'm getting this error:
Could not initialize OIDC provider:oidc: ...
1
vote
3answers
105 views
Is it wise to completely rely OAuth2 for new users and not have our own login(with username and password) system
My question is: Is it fine to build applications where the user login is completely handled by OAuth2 and services like that. That way we do not have to have our own password database for the users. ...
0
votes
2answers
74 views
How do you actully secure OAuth tokens? [closed]
Lets say you have the following curl :
curl -k \
-d "grant_type=password&username=Username&password=Password"
-H "Authorization: Basic <Base64Encoded(client-id:client-secret)>"
...
0
votes
0answers
16 views
Deterministic private entropy from OAuth2
On web-cryptocurrency-wallet some users don't want to store private keys for small sums of money and want to authorize via google/twitter.
As far as I understand the typical way is to have some sort ...
0
votes
0answers
35 views
What are security/privacy implications when using WeChat as OAuth provider?
Account information of the chinese WeChat service can be used to authenticate on other websites/services (like discussion forums) by the OAuth protocol. Since WeChat plays a major role in surveillance ...
0
votes
2answers
52 views
OAuth 2.0, what should it be returned in the authorize endpoint if the client_id is wrong and no redirect_uri is passed
We have been working on a OAuth 2.0 IDP implementation, and during the implementation of the authorize endpoint, i couldnt find in the RFC 6749, what should happen if the client_id is not passed in ...
0
votes
0answers
37 views
Tomcat OIDC Authenticated Realm
I am currently using a tomcat authenticator implementation (https://github.com/boylesoftware/tomcat-oidcauth). The authenticator is implemented as a tomcat valve. This implementation still requires a ...
1
vote
0answers
66 views
Designing distributed authentication/authorisation system
I'm trying to design a system that has the following elements:
the main backend REST API (currently one, probably multiple in the future)
front-channel client(s) -- JS-based single-page app(s)
back-...
4
votes
3answers
193 views
Distribute Program with Sheets API Credentials
I am trying to write a program that uses the Google Sheets API to read spreadsheets and operate on the data.
My program contains a credentials.json file which I obtained from the Java Quickstart page ...
2
votes
2answers
99 views
Attacker models of long-term logins: how should sensitive server endpoints require re-authentication?
Let's see the following scenario:
"GutHib" is a fictional hosting service in the form of an online webapp for the fictional DVCS software "Gut".
Alice logged in to GutHib with her password and 2FA, ...
0
votes
2answers
102 views
How client-side OAuth is secure?
I want to make a static webpage, but secure it with a login.
In order to do this, I looked at this link. Basically, I want users to log in their Google account to be able to view the webpage.
But I ...
1
vote
1answer
63 views
Is it recommended to send an authentication request to the Resource Owner (by the Authorization Server) if it already has an active session?
In OAuth 2.0 Authorization Code Flow (Grant Type), is it recommended (or is it maybe even a best practice) to send an authentication request (e.g. a login-request form) to the Resource Owner (by the ...
1
vote
0answers
29 views
Oauth2/OIDC: I know the address of a resource server, is there a standard for querying which authorization servers it accepts?
I have a bunch of what are essentially IOT devices that will authenticate connections using oauth 2 tokens and/or openid connect (depending on use-case). Each IOT device is individually configurable ...
0
votes
0answers
31 views
Implementing OAuth 2 refresh token rotation on web clients
I'm looking to implement refresh token rotation for unauthenticated clients of my OAuth 2 provider.
Things are all implemented on the server side, but I'm concerned that web clients will be unable to ...
2
votes
0answers
52 views
OAuth2: what to return when revoking a token which is not the client's? RFC7009
In RFC7009 - section 2.1, it is stated that:
The authorization server first validates the client credentials (in
case of a confidential client) and then verifies whether the token
was ...
0
votes
0answers
62 views
OpenId Connect Authorization Code Flow in Microservice Scenario (API-Gateway?)
Im building a SPA with a couple of backend-microservices and i want to authenticate using OIdC.
I'm aware of the fact that the implicit flow is not recommended anymore for this. So the recommended ...
5
votes
1answer
226 views
Can websites detect if visitors are logged in to mainstream ID providers and collect their IDs?
Logging in to websites using mainstream IDs (Google/Facebook/Github etc.) by means of OAuth (or similar) has nowadays become a feature that people expect.
Not that long ago the corresponding user ...
1
vote
1answer
94 views
Why is there a redirect to the native app in PKCE?
Why even have a redirect or even use the browser? Wouldn't just a normal TLS/HTTPS request/response in the app protect the requests and token?
The one argument I have heard against solely relying on ...
2
votes
1answer
75 views
What are the security risks associated with leaking client_secret in OAuth2?
There is an API that openly returns client_secret for each existing user, as long as you pass an email address.
Is that a vulnerability?
What are the risks?
0
votes
1answer
44 views
what is the scope of google drive's OAuth credentials?
I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
0
votes
1answer
17 views
Can a service be Oauth2 provider and Oauth2 client at the same time?
Let's say a new application X is an Oauth2 client and allows it's user to signup/login with other Oauth2 providers like Google. So a user U signs up using Google and regularly logins using Google to ...
0
votes
0answers
24 views
OIDC Protocol :: Different OIDC Server End points
OIDC Specifications:
Authorization Code Grant Flow.
As OIDC Server is shall list the various end points (Auth EP, Token EP, Token validation EP etc.)
In this scenario, Can Auth End Point and Token End ...
0
votes
1answer
108 views
OAuth2 Client Credentials Flow with assertion JWT: How to share the client's public key?
I'm having a deeper look into OAuth 2.0 and especially the Client Credentials Flow that is intended to authenticate a client application or device without user interaction (the client is accessing its ...
1
vote
0answers
52 views
Is it secure to expose OAuth2 credentials for a test application
I have created an application in which it is possible to login using GitLab. This requires an OAuth2 app id and secret.
I created a test application in GitLab UI with the redirect set to https://...
1
vote
1answer
144 views
Why is PKCE secure against man-in-the-middle attacks?
In attempting to implement OAuth2 into a natively installed client application, we face the problem that we cannot securely store the pre-shared client secret. After doing some research, I came across ...
2
votes
2answers
157 views
Microservices and RBAC using OIDC
I am currently working on migrating our users from an internal DB to an OIDC service (considering Cognito/Auth0/etc.), and I am trying to implement RBAC.
Our backend is basically a bunch of ...
0
votes
0answers
118 views
Using Cognito access token to pass claims
I am working on migrating all our users from our DB to a managed service, and we're considering AWS Cognito.
We want to use Cognito for Authentication and Access Control.
For access control, we're ...
1
vote
1answer
348 views
OpenID Connect: Is storing access token in browser secure?
I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
0
votes
0answers
142 views
OAuth2 refresh token flow with mobile app
I'm having some issue with an access token not being refreshed in my mobile application. I'm trying to figure out what would be the best approach to fix it.
This is the scenario faced by some mobile ...
0
votes
0answers
39 views
Is it ok to forward a JWT between two custom services?
I'm using Azure AD Implicit Flow for authentication between a SPA and a WebApi.
I want to know if it would be ok/save to redirect from the SPA to a intermediary service of my own as well with the ...
0
votes
0answers
19 views
How does access delegation work - Access Token work?
I'm trying to understand how do access tokens work. What is the mechanism used to generate access tokens similar to AWS Secure Token Service or OAuth Tokens.
I am assuming the algorithm is as follows:...
1
vote
2answers
194 views
Invalidate API tokens when LDAP user is invalid
I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below.
User sends LDAP username and password (with password grand type) to
the server.
Server ...
0
votes
0answers
120 views
Alternative OAuth 2 flow?
I have an implementation of the OAuth 2.0 authorization code flow, but I'm wondering if I can securely introduce a new flow. I'd like a flow that doesn't require the resource owner to ever need to ...
2
votes
1answer
37 views
OAuth2 - Obtaining Refresh Tokens
Given a valid access token alone (you don't know username+password), should you be able to get a refresh token?
2
votes
1answer
137 views
OAuth: how to prevent phishing with malicious redirect URIs
To quote the OAuth spec:
If the resource owner denies the access request or if the request fails for reasons other than a missing or invalid redirection URI, the authorization server informs the ...
0
votes
0answers
34 views
Do I have to use two OAuth/OpenIdConnect bearer token with PKCE?
We have some REST APIs exposed to public applications. Those applications are registered with an (application protocol scheme) redirect URL and we provide to the developer a client secret and client ...
3
votes
0answers
45 views
Architecting a solution with native login and 3rd party login via OAuth/OpenID Connect using dotnet core
I am building an API driven application that will have a native login with username and password, and will also need to grant 3rd party access via OAuth/OpenID Connect in the near future.
A pattern I ...
0
votes
1answer
129 views
capture authorization code programmatically in OAuth 2.0
In a standard OAuth auth code Grant flow, user is redirected to authorization server page where he provides consent to allow the requesting app to perform some actions on his behalf, after which a ...
0
votes
2answers
222 views
Does an authorization code grant rely on sessions?
It's my (possibly flawed) understanding that the authorisation code grant is attractive because it keeps access tokens away from a potentially insecure user agent. I understand how this would work ...
0
votes
0answers
49 views
What's the attack vector for authenticated wildcard CORS origin for a public API?
I have
a public API (intended to be used by third-party websites)
authentication only via JWT bearer tokens (no cookie authentication). SPAs have to add the Authorization header for every API request....
0
votes
1answer
56 views
Is it safe to just forget OAuth tokens, and not invalidate them in a mobile app?
I have a mobile application that a user signs into using OpenId Connect and OAuth 2.0. Currently when the user logs out, I open up a webpage to the end_session_endpoint (http://docs.identityserver.io/...
0
votes
0answers
138 views
Node.js Cookies/Tokens (Access & Refresh) - OAUTH2 - How to store tokens and time/function refreshing
1) I am currently building a RESTful API which acts as a middleman between clients and an authentication server. A client gives me some account details and my server passes them to the auth server who ...
1
vote
2answers
52 views
Is it dangerous not to verify the signature of an id token issued by an external authorization server?
I need to retrieve some values from an id token issued by an external authorization server inside a private network.
I asked for the certificate used to sign the jwt in order to verify it but I've ...
4
votes
0answers
51 views
Poor Man's OAuth Grant - Review
A 3rd party company has requested that we implement single sign-on with them using the below approach. I'm familiar with OAuth grants and OIDC flows but this seems rather odd to me.
The user has ...
1
vote
0answers
42 views
Is the OAuth implicit flow too insecure for serverless single page web applications?
Assuming the need for OAuth
Imagine an application that is:
A single page web application hosted on S3
Authenticated using implicit OAuth flow implicit
Have the web application access resources ...
0
votes
0answers
55 views
Is Oauth2 Implicit grant two-legged or three-legged?
In implicit grant, the resource owner has to provide consent to allow the application to access the resources on user's behalf. Doesn't this make Implicit grant a 3-legged flow?
This video states ...
1
vote
1answer
250 views
How can I securely disable CSRF validation for native clients when browser clients access the same API?
I have an API endpoint that is accessible by both native (console, mobile apps) and Javascript based clients.
How do I ensure that the CSRF AntiForgeryToken is only invoked during Javascript calls?
...
