Questions tagged [oauth2]
OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
340
questions
0
votes
0answers
23 views
Is PKCE really protecting public facing clients? Can't a rogue app steal the ClientID and Secret and make a AuthCode request of its own?
From what I have understood, for public facing clients such as JavaScript apps that run on the browser or mobile apps which have no backend there is no secure place to store client id and secret. ...
1
vote
0answers
31 views
Implement an SPA with IFrames, but with Single Sign-on
I want to build an SPA with ASP.NET Core (Blazor server side) which some IFrames redirecting to other applications. In this example I have f.e. the SPA, Grafana to show graphs and Node-Red, but there ...
1
vote
0answers
43 views
How can OAuth2 (tokens) fit into dynamic sites that still wants to call protected API's via JavaScript?
(I try to understand different concepts regarding web development in general)
Most information I find is about Single Page Applications, but how does a dynamic site make use of (for example) OAuth2/...
0
votes
0answers
28 views
Permissions & Scopes in OAuth2 API
I‘m writing an oauth2 authorization Server at the moment and I‘m know at a point where I need other opinions/knowledge on how to implement Scopes. I decided to do a permission system where both is ...
0
votes
0answers
38 views
Why does PKCE for Oauth2.0 hash the ascii bytes instead of the original bytes?
Maybe this is not a useful question, but I got a little hung up on this because it seems a little strange. In the example of the PKCE verification in RFC-7636 it details the following:
The client uses ...
1
vote
1answer
63 views
SSL certificate for desktop app?
I built an app, which authenticates users via oauth2. I have a simple server that can accept requests.
After authentication, the user is redirected to https://127.0.0.1:1234/token=<token> and ...
0
votes
0answers
55 views
authorization token is not bound to client
I have examined a web application, and I have found some strange behaviour of tokens. I will try to explain it.
I think OAuth2 is used for authorization.
User Alice will login to the app, in the HTTP ...
1
vote
2answers
37 views
Is access token confidentiality also ensured in the Authorization Code grant type in Oauth2.0
One of the really nice articles I came across while trying to understand the various grant types in Oauth2.0 was this. The author really has done a good job at explaining quite clearly what various ...
1
vote
1answer
60 views
What are the best practices to create a safe and performant user registration and validation with Nodejs and Postgres? [closed]
I've been asked to write an app with registration and login systems. In essence, I've already wrote the first version of their app using PHP, some javascript/jquery and storing data in MySQL. It ...
2
votes
2answers
73 views
Does signing in via OAuth 2.0 compromise account security if the OAuth 2.0 service decides to become malicious?
Say we signup and login to an OAuth 2.0 enabled security application called "AI Car Command Center" via Google OAuth 2.0
We then logout.
Does Google then have the capability to then grant ...
1
vote
1answer
61 views
Additional check for request integrity
I'm building a REST API resource server with JWT authorization for an Angular web app. I'm looking for a method to perform an additional check if the request body sent from the client application has ...
1
vote
0answers
75 views
API keys or Client Credentials flow? Good practice to control application access to a deployed web component
Company A developed a widget (Web Component) deployed on several clients/partners.
Only clients/partners must be authorized to use the widget.
No need to distinguish between each end users (clients' ...
0
votes
1answer
34 views
Why have a refresh_token with an OAuth2 Client Credentials grant type?
Can someone explain to me the purpose of the refresh token when you're using the Client Credentials grant type with OAuth2? I'm confused because you can easily generate a new access token without one, ...
1
vote
1answer
42 views
Standard Protocols or secure mechanism to authenticate users offline
We have a use case wherein a mobile app that can be used by multiple users on the same device needs to authenticate the users in some offline scenarios. We were using Password grant as in OAuth2 to ...
1
vote
1answer
89 views
When using PKCE, are the state and nonce parameters still necessary protection from csrf and code injection?
When I'm using the authorization code flow with PKCE do I still need state and nonce?
For state (that prevents login-csrf), if an attacker sends me a malicious Authorization Response, the client may ...
1
vote
0answers
22 views
Should I consider migrating away from OAuth 2.0 Implicit Flow for an internal application relying on Azure AD?
I have recently migrated an internal application (API + SPA) security from Windows Authentication (done by IIS) to Azure A/D authentication using the implicit flow.
Now, every user must enter an e-...
0
votes
1answer
41 views
Is creating asymmetric keys dynamically and storing in memory safe?
I want to make an application that uses oauth2 and JWT as access tokens for securing some apis and providing authentication mechanisms. The application is a microservice architecture and wirtten in ...
1
vote
0answers
57 views
SAML/oauth2/openid-connect login via proxy as another user
I manage a set of service providers (SP1, SP2, SP3, etc), and we currently have this SAML SSO flow working where the SP causes a POST submit to the SAML IDP with an XML SAML request which includes an ...
0
votes
0answers
26 views
Securing a third party REST service
We are using an application that exposes several REST endpoints. The service offers a very simple but insecure authentication using plain text HTTP headers. The network that this service will be ...
2
votes
2answers
78 views
How could a server to server rest api communication be more secure, by using OAuth 2?
I created a large backend+frontend project for a client. They recently started a different project, and contracted an other company to develop and host it. Since they need some of the data from my ...
0
votes
0answers
31 views
JWE and the key management modes
Wrapping my head around JWE and the key management modes.
The point of JWE is to prevent third parties to see/change the token. Only the token issuer and resource server should be able to use it. (Is ...
3
votes
1answer
75 views
Protected APIs for public clients without end-user authentication
A simple question which I cannot find any guidance on the RFC6749 (or related) spec.
I have an eCommerce public client (SPA & mobile), where I want to postpone as much as possible the ...
0
votes
1answer
38 views
OAuth2 - Benefits for using Grant-Type:Password for machine-to-machine web-service calls
I'm using a 3rd party service developed by the Experian Credit Bureau. Looking at their documentation, they are using OAuth2 & are expecting Grant_type: password in order for external developers ...
0
votes
2answers
54 views
Is there any additional overhead over using Oauth vs Client Certificates?
I have a requirement to add security between service to API communication. The current implementation is client certificates. The client gets a certificate and just sends it in a cookie to the API. ...
0
votes
0answers
32 views
client security separate from user context
Consider the following set up applications and services:
apps:
mycompany.com webapp
apis:
products api
orders api
mycompany.com's webapp uses OAuth2/openidconnect with an IdP (such as auth0) to ...
0
votes
1answer
63 views
I found that I could delete the state parameter in an OAuth request and the response was validated and e-mail was still verified
I was fiddling around with an OAuth2.0 request on burpsuite and I found that it validated the account even after I deleted the state parameter completely and forwarded the request through burpsuite. I ...
0
votes
1answer
51 views
Sharing oauth2 token with AJAX request to be sent to resource server
I am a little confused on how the token is shared from the client to an AJAX script to the resource server in the oauth2 flow.
To explain the scenario I am trying to set up, I have
a client (http://...
1
vote
0answers
68 views
Zero-Trust alternative to google sign-in, is this a feasable design?
I was thinking about zero-trust systems over the last few weeks and it seems like there are many things that could be implemented that way. With password managers being one of those things, I was ...
2
votes
0answers
147 views
Keycloak and Open ID Connect best practices
I'm a bit lost as to the best practice surrounding a production-ready access management based on keycloak and open id connect.
My understanding is that if you use Keycloak's provided adapters, instead ...
1
vote
0answers
38 views
What prevents an app impersonating another native windows client with Oauth2/PKCE
Given a native windows app, with a redirect URL of example://redirect, what prevents a malicious user from taking the Client ID (public), and creating a new app that sets itself up to be the target of ...
2
votes
1answer
74 views
client_id vs distinguished name in mutual tls
i am reading this in the OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
What is the difference between a client_id and a distinguished name? I see in the PKI Mutual-TLS ...
1
vote
0answers
72 views
Difference between JSON web token, bearer token, and MAC token in OAuth2
I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
where the authorization server issues a client a JSON web token with the following format
{
"iss&...
0
votes
0answers
60 views
validation of an access token from the resource server
I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Boun Access Tokens
The client after receives an access token (which is also entails his certificate in a hash format) from ...
0
votes
1answer
51 views
symmetric keys during mutual TLS
I have a client how asks a token from an auth server in order to use it to an endpoint which serves as the resource server.
Between the client and the server, a handshake is utilized in order the two ...
0
votes
1answer
57 views
Client — CertificateVerify during handshake
I am trying to understand how the client is authenticated to the server during mutual tls
So during the handshake, the client sends this message
Client — CertificateVerify
This message is used by the ...
0
votes
1answer
65 views
Certificate and public key flows in mutual TLS
I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
I am interested to know how the certificates and public keys are exchanged between the client and the ...
0
votes
1answer
130 views
What is an endpoint in the context of TLS?
What is the purpose of endpoints in mutual TLS authentication? Actually, what do we mean by an endpoint? I am following this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access ...
0
votes
1answer
62 views
OpenID Connect with a chain of Relying Parties
Is there a usage of OpenID Connect (OIDC) that allows for a chain of RP (terminology reference)
user -> RP#1
user <-redirect to chosen OP- RP#1
user -> OP: verifies identity
user <-...
0
votes
1answer
79 views
OAuth alternative for two-party scenario?
I'm trying to come up with an authentication/authorization system for what seems like a really simple scenario, but as far as I can tell it's virtually unsupported.
There are two parties, total; ...
1
vote
0answers
33 views
OAuth Authorization Request Leakage Examples
The OAuth attacker model (see https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15#section-3, A4) states that
(A4) Attackers that can read, but not modify, the contents of the ...
1
vote
1answer
69 views
Why using “state” variable in OAuth 2
I am building an application that is integrated with a 3rd party service provider and uses OAuth 2 to obtain permission from other users using the service to access their account information. Based on ...
2
votes
1answer
73 views
Is oauth client credentials flow safer than basic authentication with preshared secret?
Assuming that both travel over the latest version of TLS, why should I use client credentials?
The obvious answer is:
The access token will expire at some point
The client id and secret will travel ...
0
votes
1answer
94 views
Secure a REST API
I want to build a REST API where applications can authenticate using an OAuth2 Bearer Token, so they get access only to resources related to one user or they can access by itself accessing resources ...
0
votes
0answers
60 views
OAuth 2.0: programmatically authenticate Resource Server user after Authorization Code grant
The requirement: have a user, existing in an IDP, be automatically authenticated on a Resource server. IDP app can then provide web view for resource server user.
OAuth 2.0 Approach:
IDP nudges ...
0
votes
1answer
64 views
Where does a scope get defined?
According to RFC 6749 the strings [scopes] are defined by the authorization server.
However isn't it really the resource server who defines the scopes? I mean scopes vary from resource server to ...
0
votes
1answer
77 views
Best practices for generating and storing authorization codes and access tokens in OAuth server
I've recently implemented an OAuth server functionality to our service. I've consulted OAuth 2.0 Threat Model and Security Considerations and addressed most of the concerns. I am curious about any ...
1
vote
1answer
87 views
How is PKCE secure?
I feel like I am missing an important point here, I have been reading up a bit on the PKCE flow but something doesn't sit quite right.
How is PKCE secure on public devices? If I understand this ...
0
votes
1answer
76 views
Authorization Code: Is there a specific format it has to follow?
I am currently digging into OAuth 2.0 and especially the authorization code grant. What I couldn't find from within RFC6749 is if the authorization code has to follow a specific format.
The RFC says ...
0
votes
1answer
76 views
Who initiates an authorization code flow?
I'd like to understand OAuth 2.0 in more detail and especially the authorization code flow. This might be nit-picking but according to RFC6749 the client initiates the flow.
(A) The client initiates ...
0
votes
0answers
47 views
Oauth2: should I increase the refresh token expiring date?
I want my clients to be able to schedule a purchase for a given date. When they perform this scheduling action, they are authenticated with an oauth2 token. However the date could be so far from now ...
