Questions tagged [oauth2]
OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
322
questions
0
votes
1answer
31 views
Is there any additional overhead over using Oauth vs Client Certificates?
I have a requirement to add security between service to API communication. The current implementation is client certificates. The client gets a certificate and just sends it in a cookie to the API. ...
0
votes
0answers
28 views
client security separate from user context
Consider the following set up applications and services:
apps:
mycompany.com webapp
apis:
products api
orders api
mycompany.com's webapp uses OAuth2/openidconnect with an IdP (such as auth0) to ...
0
votes
1answer
41 views
I found that I could delete the state parameter in an OAuth request and the response was validated and e-mail was still verified
I was fiddling around with an OAuth2.0 request on burpsuite and I found that it validated the account even after I deleted the state parameter completely and forwarded the request through burpsuite. I ...
0
votes
1answer
44 views
Sharing oauth2 token with AJAX request to be sent to resource server
I am a little confused on how the token is shared from the client to an AJAX script to the resource server in the oauth2 flow.
To explain the scenario I am trying to set up, I have
a client (http://...
1
vote
0answers
60 views
Zero-Trust alternative to google sign-in, is this a feasable design?
I was thinking about zero-trust systems over the last few weeks and it seems like there are many things that could be implemented that way. With password managers being one of those things, I was ...
1
vote
0answers
37 views
Keycloak and Open ID Connect best practices
I'm a bit lost as to the best practice surrounding a production-ready access management based on keycloak and open id connect.
My understanding is that if you use Keycloak's provided adapters, instead ...
1
vote
0answers
30 views
What prevents an app impersonating another native windows client with Oauth2/PKCE
Given a native windows app, with a redirect URL of example://redirect, what prevents a malicious user from taking the Client ID (public), and creating a new app that sets itself up to be the target of ...
2
votes
0answers
34 views
client_id vs distinguished name in mutual tls
i am reading this in the OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
What is the difference between a client_id and a distinguished name? I see in the PKI Mutual-TLS ...
1
vote
0answers
42 views
Difference between JSON web token, bearer token, and MAC token in OAuth2
I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
where the authorization server issues a client a JSON web token with the following format
{
"iss&...
0
votes
0answers
50 views
validation of an access token from the resource server
I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Boun Access Tokens
The client after receives an access token (which is also entails his certificate in a hash format) from ...
0
votes
0answers
22 views
method for optaining access token from an authorization server [migrated]
I am reading this Auth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
The manual states that the client asks the auth server for an access token. However, the manual does not ...
0
votes
1answer
43 views
symmetric keys during mutual TLS
I have a client how asks a token from an auth server in order to use it to an endpoint which serves as the resource server.
Between the client and the server, a handshake is utilized in order the two ...
0
votes
1answer
44 views
Client — CertificateVerify during handshake
I am trying to understand how the client is authenticated to the server during mutual tls
So during the handshake, the client sends this message
Client — CertificateVerify
This message is used by the ...
0
votes
0answers
32 views
Certificate and public key flows in mutual TLS
I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
I am interested to know how the certificates and public keys are exchanged between the client and the ...
0
votes
1answer
125 views
What is an endpoint in the context of TLS?
What is the purpose of endpoints in mutual TLS authentication? Actually, what do we mean by an endpoint? I am following this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access ...
0
votes
1answer
50 views
OpenID Connect with a chain of Relying Parties
Is there a usage of OpenID Connect (OIDC) that allows for a chain of RP (terminology reference)
user -> RP#1
user <-redirect to chosen OP- RP#1
user -> OP: verifies identity
user <-...
0
votes
1answer
65 views
OAuth alternative for two-party scenario?
I'm trying to come up with an authentication/authorization system for what seems like a really simple scenario, but as far as I can tell it's virtually unsupported.
There are two parties, total; ...
1
vote
0answers
33 views
OAuth Authorization Request Leakage Examples
The OAuth attacker model (see https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15#section-3, A4) states that
(A4) Attackers that can read, but not modify, the contents of the ...
1
vote
1answer
50 views
Why using “state” variable in OAuth 2
I am building an application that is integrated with a 3rd party service provider and uses OAuth 2 to obtain permission from other users using the service to access their account information. Based on ...
2
votes
1answer
67 views
Is oauth client credentials flow safer than basic authentication with preshared secret?
Assuming that both travel over the latest version of TLS, why should I use client credentials?
The obvious answer is:
The access token will expire at some point
The client id and secret will travel ...
0
votes
1answer
93 views
Secure a REST API
I want to build a REST API where applications can authenticate using an OAuth2 Bearer Token, so they get access only to resources related to one user or they can access by itself accessing resources ...
0
votes
0answers
56 views
OAuth 2.0: programmatically authenticate Resource Server user after Authorization Code grant
The requirement: have a user, existing in an IDP, be automatically authenticated on a Resource server. IDP app can then provide web view for resource server user.
OAuth 2.0 Approach:
IDP nudges ...
0
votes
1answer
56 views
Where does a scope get defined?
According to RFC 6749 the strings [scopes] are defined by the authorization server.
However isn't it really the resource server who defines the scopes? I mean scopes vary from resource server to ...
0
votes
1answer
69 views
Best practices for generating and storing authorization codes and access tokens in OAuth server
I've recently implemented an OAuth server functionality to our service. I've consulted OAuth 2.0 Threat Model and Security Considerations and addressed most of the concerns. I am curious about any ...
1
vote
0answers
52 views
How is PKCE secure?
I feel like I am missing an important point here, I have been reading up a bit on the PKCE flow but something doesn't sit quite right.
How is PKCE secure on public devices? If I understand this ...
0
votes
1answer
63 views
Authorization Code: Is there a specific format it has to follow?
I am currently digging into OAuth 2.0 and especially the authorization code grant. What I couldn't find from within RFC6749 is if the authorization code has to follow a specific format.
The RFC says ...
0
votes
1answer
66 views
Who initiates an authorization code flow?
I'd like to understand OAuth 2.0 in more detail and especially the authorization code flow. This might be nit-picking but according to RFC6749 the client initiates the flow.
(A) The client initiates ...
0
votes
0answers
41 views
Oauth2: should I increase the refresh token expiring date?
I want my clients to be able to schedule a purchase for a given date. When they perform this scheduling action, they are authenticated with an oauth2 token. However the date could be so far from now ...
0
votes
0answers
52 views
Scope Narrowing Access Token with Refresh token
I have recently picked up the oauth2 spec and decided to use keycloak as an auth server. I am facing difficulties in a certain aspect. I want to be able to request multiple access tokens with narrow ...
0
votes
0answers
23 views
Why it is _the client_ (and not _the authorization server_) who is to validate the anti-CSRF state in OAuth workflow?
The client MUST implement CSRF protection for its redirection URI.
This is typically accomplished by requiring any request sent to the
redirection URI endpoint to include a value that binds the ...
0
votes
1answer
55 views
OAuth 2.0: what's stopping a client from lying to the Resource owner about scopes
I'm seeing token scopes as more of a contract between what a third-party application can do on behalf of some user's consent.
Therefore, let's say a client asks a Resource owner to authenticate and ...
1
vote
0answers
19 views
SPA Oauth2 and Backchannel (Client)
I am having a problems defining the flow of an application that is supposed to be authenticated / authorized securely with an SPA frontend. Currently using an SPA with a Spring application server as a ...
0
votes
2answers
74 views
Is it safe to pass an OpenID Connect ID token to my back-end API for verification?
I am currently adding single sign-on functionality between my application and an electronic health record (EHR) system. The SSO is done using the OpenID Connect authorization code flow, but unlike a ...
0
votes
1answer
70 views
Is OAuth 1 less secure than OAuth 2 in an SPA
We are writing a pure javascript front-end (in angular) for an API that still uses OAuth 1 for legacy reasons. Being pure javascript means the consumer secret is part of the code that gets downloaded ...
0
votes
1answer
56 views
OAuth2, SAML, OpenID connect - Which one to use for my scenario?
I work for a company where we give customer (hundreds/thousands of users) access to 2 sites. One owned by a 3rd party SaaS and one owned by us. Customers spend alot of time registering for both sites ...
0
votes
0answers
23 views
OAuth device code grant - JWT
I am looking at implementing an API Gateway for a system using WS02 as the IdP. Users will be signing in using OAuth via federated SSO with social providers (initially Google). The users will also ...
0
votes
1answer
102 views
App-to-app or service-to-service authentication using federated login
I have an application Foo that exposes a web-based portal as well as a REST API service via HTTPS.
When a human user connects to the app Foo to use its web-based portal, the human user is first ...
0
votes
0answers
44 views
What if session cookie is stolen? Doesn't it have a similar effect with getting access token stolen
Most security specialist teams, OWASP, Auth0, Okta to name some, agree on that keeping access token in browser should be avoided. And one of the alternatives to this approach is having a proxy server ...
2
votes
0answers
32 views
What is the right way to let user retrieve client secret in OAuth 2?
In the OAuth website here it says "Most services provide a way for developers to retrieve the secret of an existing application, although some will only display the secret one time and require ...
0
votes
0answers
32 views
Recommendation for managing OAuth2 user consent
I went through RFC6749 to learn about OAuth2 but I found that the RFC didn't talk much about how to store/manage the user consent at the authorization server. A common question when handling the user ...
1
vote
2answers
88 views
How do I make sure access token comes from authenticated user?
My problem boils down to the use of Okta's access tokens to secure api endpoint.
I followed this okta guide to set up a react single-page application with their wiget.
When I log into the site I get a ...
0
votes
0answers
44 views
Facebook/Google OAuth - need a constant string for E2EE
The clients can use Google and Facebook OAuth for authentication
I need to implement a chat application where the messages are end-to-end encrypted
When the user changes device, the client should be ...
1
vote
0answers
52 views
Oauth2.0 | How to manage user session in Single Page application running in an iframe?
I'm new to security domain, and recently I have learned about Oauth2.0/OpenID connect and JWT tokens. I have an existing REST based web application where I need to implement security.
Server
...
0
votes
0answers
84 views
Sign-in with Apple user verification
I want to enable "Sign-in with apple" in my application.
As you can see here App sends Token authorization code to the backend, and then backend needs to talk with Apple ID to verify the ...
0
votes
0answers
34 views
Registration process by OAuth2
I have been analyzing the security process in 3gpp specs (pg 11) and the registration process in the spec explained with that flow. The flow represents the registration of a client to the server..
I ...
0
votes
0answers
30 views
Choosing oauth flow-type for on-prem installations
So according to the resources found here and in the official protocol documents I have a good grasp on what flow-types to use for what client-type. According to the following picture (credit: https://...
1
vote
1answer
20 views
Should OAuth2 proprietary client authorization prompt a confirmation window?
Given a company named X.
X has an OAuth 2 API available for its proprietary clients and also for 3rd party clients.
When a user P enters the process of authorizing a client, it is prompted with a ...
1
vote
1answer
66 views
Is it ok to share relevant login information on an API's public endpoint?
I have an (https-only) API that uses OAuth2 for authentication and authorization via access tokens.
Any request to the API needs an access token to the Authorization header. The API validates that ...
0
votes
0answers
24 views
How does Firebase app SHA-1 verification work?
Firebase iOS and Android applications authenticate with their servers using OAuth 2. Google makes this easy by providing a JSON file with the credentials and a library that handles authentication. ...
0
votes
1answer
44 views
OpenID Connect with user bound roles and M2M access
I'm trying to get my head straight about how to properly design a OpenID connect provider and the roles to use with it. I understand the basic of scopes, claims and the different flow one can use. ...
