Questions tagged [oauth2]
OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
298
questions
0
votes
0answers
36 views
Scope Narrowing Access Token with Refresh token
I have recently picked up the oauth2 spec and decided to use keycloak as an auth server. I am facing difficulties in a certain aspect. I want to be able to request multiple access tokens with narrow ...
0
votes
0answers
20 views
Why it is _the client_ (and not _the authorization server_) who is to validate the anti-CSRF state in OAuth workflow?
The client MUST implement CSRF protection for its redirection URI.
This is typically accomplished by requiring any request sent to the
redirection URI endpoint to include a value that binds the ...
0
votes
0answers
10 views
Dynamic authorization delegation from a third party service to a client application on a given information system [migrated]
As a company that wants to offer access to its services to a third-party known clients, I designed an authentication/permission system.
Here are our needs:
As a service provider (A), I want to ...
0
votes
1answer
48 views
OAuth 2.0: what's stopping a client from lying to the Resource owner about scopes
I'm seeing token scopes as more of a contract between what a third-party application can do on behalf of some user's consent.
Therefore, let's say a client asks a Resource owner to authenticate and ...
0
votes
0answers
16 views
SPA Oauth2 and Backchannel (Client)
I am having a problems defining the flow of an application that is supposed to be authenticated / authorized securely with an SPA frontend. Currently using an SPA with a Spring application server as a ...
0
votes
2answers
57 views
Is it safe to pass an OpenID Connect ID token to my back-end API for verification?
I am currently adding single sign-on functionality between my application and an electronic health record (EHR) system. The SSO is done using the OpenID Connect authorization code flow, but unlike a ...
0
votes
1answer
58 views
Is OAuth 1 less secure than OAuth 2 in an SPA
We are writing a pure javascript front-end (in angular) for an API that still uses OAuth 1 for legacy reasons. Being pure javascript means the consumer secret is part of the code that gets downloaded ...
0
votes
1answer
52 views
OAuth2, SAML, OpenID connect - Which one to use for my scenario?
I work for a company where we give customer (hundreds/thousands of users) access to 2 sites. One owned by a 3rd party SaaS and one owned by us. Customers spend alot of time registering for both sites ...
0
votes
0answers
23 views
OAuth device code grant - JWT
I am looking at implementing an API Gateway for a system using WS02 as the IdP. Users will be signing in using OAuth via federated SSO with social providers (initially Google). The users will also ...
0
votes
1answer
97 views
App-to-app or service-to-service authentication using federated login
I have an application Foo that exposes a web-based portal as well as a REST API service via HTTPS.
When a human user connects to the app Foo to use its web-based portal, the human user is first ...
0
votes
0answers
42 views
What if session cookie is stolen? Doesn't it have a similar effect with getting access token stolen
Most security specialist teams, OWASP, Auth0, Okta to name some, agree on that keeping access token in browser should be avoided. And one of the alternatives to this approach is having a proxy server ...
2
votes
0answers
29 views
What is the right way to let user retrieve client secret in OAuth 2?
In the OAuth website here it says "Most services provide a way for developers to retrieve the secret of an existing application, although some will only display the secret one time and require ...
0
votes
0answers
31 views
Recommendation for managing OAuth2 user consent
I went through RFC6749 to learn about OAuth2 but I found that the RFC didn't talk much about how to store/manage the user consent at the authorization server. A common question when handling the user ...
1
vote
2answers
85 views
How do I make sure access token comes from authenticated user?
My problem boils down to the use of Okta's access tokens to secure api endpoint.
I followed this okta guide to set up a react single-page application with their wiget.
When I log into the site I get a ...
0
votes
0answers
42 views
Facebook/Google OAuth - need a constant string for E2EE
The clients can use Google and Facebook OAuth for authentication
I need to implement a chat application where the messages are end-to-end encrypted
When the user changes device, the client should be ...
1
vote
0answers
43 views
Oauth2.0 | How to manage user session in Single Page application running in an iframe?
I'm new to security domain, and recently I have learned about Oauth2.0/OpenID connect and JWT tokens. I have an existing REST based web application where I need to implement security.
Server
...
0
votes
0answers
57 views
Sign-in with Apple user verification
I want to enable "Sign-in with apple" in my application.
As you can see here App sends Token authorization code to the backend, and then backend needs to talk with Apple ID to verify the ...
0
votes
0answers
33 views
Registration process by OAuth2
I have been analyzing the security process in 3gpp specs (pg 11) and the registration process in the spec explained with that flow. The flow represents the registration of a client to the server..
I ...
0
votes
0answers
28 views
Choosing oauth flow-type for on-prem installations
So according to the resources found here and in the official protocol documents I have a good grasp on what flow-types to use for what client-type. According to the following picture (credit: https://...
1
vote
1answer
20 views
Should OAuth2 proprietary client authorization prompt a confirmation window?
Given a company named X.
X has an OAuth 2 API available for its proprietary clients and also for 3rd party clients.
When a user P enters the process of authorizing a client, it is prompted with a ...
1
vote
1answer
66 views
Is it ok to share relevant login information on an API's public endpoint?
I have an (https-only) API that uses OAuth2 for authentication and authorization via access tokens.
Any request to the API needs an access token to the Authorization header. The API validates that ...
0
votes
0answers
24 views
How does Firebase app SHA-1 verification work?
Firebase iOS and Android applications authenticate with their servers using OAuth 2. Google makes this easy by providing a JSON file with the credentials and a library that handles authentication. ...
0
votes
1answer
35 views
OpenID Connect with user bound roles and M2M access
I'm trying to get my head straight about how to properly design a OpenID connect provider and the roles to use with it. I understand the basic of scopes, claims and the different flow one can use. ...
0
votes
1answer
63 views
Which Authentication mechanism to choose for PCI-DSS system
I want to create Angular 9 + Spring Boot application with strong security complaint to PCI-DSS security standard.
Which security protocol is preferred for user sessions in order to have high security ...
0
votes
0answers
36 views
Securing my own routes with “Login with X” and OAuth2
I have a single page application which communicates with a REST backend. I want to require a user to login before being allowed to access certain routes. I want to offload user authentication to ...
0
votes
2answers
91 views
OAuth2 - Authorization Code Flow - Do I really Need this for simple login/authentication?
I have been reading a lot about OAuth 2 flow recently, and I wanted to ask if this is applicable to the app that I am building, and what type of security I should be using.
Context
We have a native ...
0
votes
0answers
38 views
What is the correct way to implement the OAuth2 state parameter?
I'm trying to understand how to properly implement state in an OAuth2 client, to mitigate CSRF attacks. This answer explains the attack scenario pretty well, to summarize:
The attacker starts the ...
1
vote
1answer
71 views
Can OpenID Connect be used to implement social login?
Using OAuth to implement social login is insecure (https://tools.ietf.org/html/rfc6819#section-4.4.2.6) because OAuth doesn't provide authentication, only authorisation. The issue arises because the ...
1
vote
1answer
40 views
how does spotify do oauth(+open id connect) from the desktop app?
I understand what the workflow would be from the webpage, but how does oauth+open id work for desktop apps as they cannot open a browser page within the app. I see that when I click on log in with ...
1
vote
2answers
52 views
OAuth authorization code grant with exposed client secret
Let's assume that a client has the client secret exposed somewhere.
What are the risks that the client and its users are exposed to?
Are those the same as having implemented the implicit flow from ...
1
vote
1answer
83 views
What are disadvantages of a reverse OTP flow, where OTP is visible on a website and is retyped on authenticated mobile client?
I want to authenticate a user on a 3rd party website (this is more or less an OAuth flow, so this website will be able to perform actions on behalf of my user afterwards, e.g. receive some of her data)...
1
vote
2answers
88 views
Where should 'reset password' functionality be?
We've recently overhauled the backend to our mobile app from having a very basic authentication mechanism that went through the API to having both an authentication server and an API server, with the ...
1
vote
0answers
18 views
Is an “inversed” Device Authorization Grant flow secure for authenticating a daemon/service native app to a web server?
I am working on a hobby project which will involve a web server (hosted and owned by me) and a native app (which will communicate with the web server periodically) an end-user can install via a deb/...
0
votes
0answers
27 views
Are OAuth Authenication Codes meant to be transient or permanent?
I've been learning a bit about the OAuth web application flow.
One thing that is not clear to me is if the Authentication Code generated from step 5 of this diagram is something that can be used ...
0
votes
2answers
97 views
What are the security risks with rolling out your own Authorisation server implementation
Even though I'm working within .Net Core, this question is generally applicable to other platforms as well.
My question is to do with: Using a framework (such as IdentityServer) to manage ...
0
votes
1answer
57 views
Why does Authorization Code flow need the authorization code?
I've implemented Auth Code flow with PKCE on my server, but I'm still not entirely clear on why I'm doing it. I've read through the IETF documentation and I get flashes of what seems like ...
0
votes
1answer
34 views
Authorisation Request & Authorisation Grant In OAuth 2.0
I do not grasp the concept of the first steps in the OAuth process: Authorisation Request and Authorisation Grant. As far as I know:
User wants to access client by authorizing Service API
User clicks ...
1
vote
1answer
72 views
Custom OAuth2 Authorization Server / Identity Provider
I am currently trying to implement my own Authorization Server following the OAuth2 protocol PKCE flow, coupled with my own Identity Provider. The idea is to be able to reuse the same identity ...
4
votes
1answer
62 views
Exploitation of client_id in OAuth
We have a web app where the back end is composed of APIs. We use OAuth to authorize the web app's call to the APIs. We all know that in OAuth, there is always the Authorization endpoint used to get ...
0
votes
1answer
46 views
'confirm old password' OAuth equivalent
I want to allow users to link/unlink several OAuth providers to their account.
How can I mitigate 'office prank' attacks, when someone can access my computer while I am away?
My account: OAuth with ...
0
votes
0answers
44 views
OAuth2.0/OIDC Public Clients: What implementation is recommended for authentication & scopes consent when there is no third-party involved?
Context
I am developing a solution with
Two clients, a mobile one and an SPA.
An authorization server under my control.
A resource server / identity provider, that provides user data and features ...
0
votes
1answer
31 views
Does OAuth2 state parameter need to be cryptographically secure?
In OAuth2, as part of the authorization request, we generate a random string and pass it with the state parameter, so that when we get the response, we can ascertain that the response is a result of ...
2
votes
0answers
112 views
Does my app need authentication in addition to Spotify authorization?
I have an app that revolves entirely around Spotify. I have followed the authorization guide from Spotify and am using the Authorization Code Flow so the access token can be refreshed. My thinking was ...
0
votes
0answers
37 views
openID connect without resource owner authorization
the use case I have is, there are multiple systems that access each other over the internet, all sharing the same user base. openId connect seems to be the way of identity management. this means every ...
0
votes
0answers
55 views
Is it correct to use AWS Cognito groups as user roles?
I trying to implement authN/authZ for my application using Spring Security 5.2.2 and OAuth2/openid connect protocols. I use AWS Cognito as an identity provider and I'm trying to implement role-based ...
0
votes
0answers
24 views
Does OAuth2 state have to be server side?
I have a "stateless" OAuth2 client for the Authorization Code flow written like thus:
Involved parties: Untrusted User, Controlled OAuth2 Client, External OAuth2 Service.
User sends client.invalid/...
2
votes
1answer
95 views
Using the user's password hash as their refresh token (with the password hash in their JWT)?
I'm building an authentication system that I want to be secure. I plan on using JWT tokens as the main authentication mechanism. When the token expires, the server will return a "401 unauthorized" ...
0
votes
1answer
80 views
Difference between Form Post Response and Authorization Code
I am trying to find the best OAuth2 mechanism for our VueJS Single Page Application (SPA) hosted on our own backend. From my research, Authorization Code should be sufficient, as long as the redirect ...
0
votes
1answer
42 views
Risks associated with a compromised external Security token server
Consider the following architecture:
An on premise Web API 2 [Written in C# hosted in IIS] which uses OAuth 2 authentication [ Implicit Flow ] to secure itself. This API acts as the data source by ...
2
votes
1answer
56 views
OIDC/OAuth2 id_token and it's usage in the client application
I've recently migrated my application to use external provider for login so that my application doesn't have to deal with auth and storing user credentials. For this I'm using OpenID Connect (OIDC) ...
