Questions tagged [oauth2]

OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0

Filter by
Sorted by
Tagged with
0
votes
0answers
23 views

Is PKCE really protecting public facing clients? Can't a rogue app steal the ClientID and Secret and make a AuthCode request of its own?

From what I have understood, for public facing clients such as JavaScript apps that run on the browser or mobile apps which have no backend there is no secure place to store client id and secret. ...
1
vote
0answers
31 views

Implement an SPA with IFrames, but with Single Sign-on

I want to build an SPA with ASP.NET Core (Blazor server side) which some IFrames redirecting to other applications. In this example I have f.e. the SPA, Grafana to show graphs and Node-Red, but there ...
1
vote
0answers
43 views

How can OAuth2 (tokens) fit into dynamic sites that still wants to call protected API's via JavaScript?

(I try to understand different concepts regarding web development in general) Most information I find is about Single Page Applications, but how does a dynamic site make use of (for example) OAuth2/...
0
votes
0answers
28 views

Permissions & Scopes in OAuth2 API

I‘m writing an oauth2 authorization Server at the moment and I‘m know at a point where I need other opinions/knowledge on how to implement Scopes. I decided to do a permission system where both is ...
0
votes
0answers
38 views

Why does PKCE for Oauth2.0 hash the ascii bytes instead of the original bytes?

Maybe this is not a useful question, but I got a little hung up on this because it seems a little strange. In the example of the PKCE verification in RFC-7636 it details the following: The client uses ...
1
vote
1answer
63 views

SSL certificate for desktop app?

I built an app, which authenticates users via oauth2. I have a simple server that can accept requests. After authentication, the user is redirected to https://127.0.0.1:1234/token=<token> and ...
0
votes
0answers
55 views

authorization token is not bound to client

I have examined a web application, and I have found some strange behaviour of tokens. I will try to explain it. I think OAuth2 is used for authorization. User Alice will login to the app, in the HTTP ...
1
vote
2answers
37 views

Is access token confidentiality also ensured in the Authorization Code grant type in Oauth2.0

One of the really nice articles I came across while trying to understand the various grant types in Oauth2.0 was this. The author really has done a good job at explaining quite clearly what various ...
1
vote
1answer
60 views

What are the best practices to create a safe and performant user registration and validation with Nodejs and Postgres? [closed]

I've been asked to write an app with registration and login systems. In essence, I've already wrote the first version of their app using PHP, some javascript/jquery and storing data in MySQL. It ...
2
votes
2answers
73 views

Does signing in via OAuth 2.0 compromise account security if the OAuth 2.0 service decides to become malicious?

Say we signup and login to an OAuth 2.0 enabled security application called "AI Car Command Center" via Google OAuth 2.0 We then logout. Does Google then have the capability to then grant ...
1
vote
1answer
61 views

Additional check for request integrity

I'm building a REST API resource server with JWT authorization for an Angular web app. I'm looking for a method to perform an additional check if the request body sent from the client application has ...
1
vote
0answers
75 views

API keys or Client Credentials flow? Good practice to control application access to a deployed web component

Company A developed a widget (Web Component) deployed on several clients/partners. Only clients/partners must be authorized to use the widget. No need to distinguish between each end users (clients' ...
0
votes
1answer
34 views

Why have a refresh_token with an OAuth2 Client Credentials grant type?

Can someone explain to me the purpose of the refresh token when you're using the Client Credentials grant type with OAuth2? I'm confused because you can easily generate a new access token without one, ...
1
vote
1answer
42 views

Standard Protocols or secure mechanism to authenticate users offline

We have a use case wherein a mobile app that can be used by multiple users on the same device needs to authenticate the users in some offline scenarios. We were using Password grant as in OAuth2 to ...
1
vote
1answer
89 views

When using PKCE, are the state and nonce parameters still necessary protection from csrf and code injection?

When I'm using the authorization code flow with PKCE do I still need state and nonce? For state (that prevents login-csrf), if an attacker sends me a malicious Authorization Response, the client may ...
1
vote
0answers
22 views

Should I consider migrating away from OAuth 2.0 Implicit Flow for an internal application relying on Azure AD?

I have recently migrated an internal application (API + SPA) security from Windows Authentication (done by IIS) to Azure A/D authentication using the implicit flow. Now, every user must enter an e-...
0
votes
1answer
41 views

Is creating asymmetric keys dynamically and storing in memory safe?

I want to make an application that uses oauth2 and JWT as access tokens for securing some apis and providing authentication mechanisms. The application is a microservice architecture and wirtten in ...
1
vote
0answers
57 views

SAML/oauth2/openid-connect login via proxy as another user

I manage a set of service providers (SP1, SP2, SP3, etc), and we currently have this SAML SSO flow working where the SP causes a POST submit to the SAML IDP with an XML SAML request which includes an ...
0
votes
0answers
26 views

Securing a third party REST service

We are using an application that exposes several REST endpoints. The service offers a very simple but insecure authentication using plain text HTTP headers. The network that this service will be ...
2
votes
2answers
78 views

How could a server to server rest api communication be more secure, by using OAuth 2?

I created a large backend+frontend project for a client. They recently started a different project, and contracted an other company to develop and host it. Since they need some of the data from my ...
0
votes
0answers
31 views

JWE and the key management modes

Wrapping my head around JWE and the key management modes. The point of JWE is to prevent third parties to see/change the token. Only the token issuer and resource server should be able to use it. (Is ...
3
votes
1answer
75 views

Protected APIs for public clients without end-user authentication

A simple question which I cannot find any guidance on the RFC6749 (or related) spec. I have an eCommerce public client (SPA & mobile), where I want to postpone as much as possible the ...
0
votes
1answer
38 views

OAuth2 - Benefits for using Grant-Type:Password for machine-to-machine web-service calls

I'm using a 3rd party service developed by the Experian Credit Bureau. Looking at their documentation, they are using OAuth2 & are expecting Grant_type: password in order for external developers ...
0
votes
2answers
54 views

Is there any additional overhead over using Oauth vs Client Certificates?

I have a requirement to add security between service to API communication. The current implementation is client certificates. The client gets a certificate and just sends it in a cookie to the API. ...
0
votes
0answers
32 views

client security separate from user context

Consider the following set up applications and services: apps: mycompany.com webapp apis: products api orders api mycompany.com's webapp uses OAuth2/openidconnect with an IdP (such as auth0) to ...
0
votes
1answer
63 views

I found that I could delete the state parameter in an OAuth request and the response was validated and e-mail was still verified

I was fiddling around with an OAuth2.0 request on burpsuite and I found that it validated the account even after I deleted the state parameter completely and forwarded the request through burpsuite. I ...
0
votes
1answer
51 views

Sharing oauth2 token with AJAX request to be sent to resource server

I am a little confused on how the token is shared from the client to an AJAX script to the resource server in the oauth2 flow. To explain the scenario I am trying to set up, I have a client (http://...
1
vote
0answers
68 views

Zero-Trust alternative to google sign-in, is this a feasable design?

I was thinking about zero-trust systems over the last few weeks and it seems like there are many things that could be implemented that way. With password managers being one of those things, I was ...
2
votes
0answers
147 views

Keycloak and Open ID Connect best practices

I'm a bit lost as to the best practice surrounding a production-ready access management based on keycloak and open id connect. My understanding is that if you use Keycloak's provided adapters, instead ...
1
vote
0answers
38 views

What prevents an app impersonating another native windows client with Oauth2/PKCE

Given a native windows app, with a redirect URL of example://redirect, what prevents a malicious user from taking the Client ID (public), and creating a new app that sets itself up to be the target of ...
2
votes
1answer
74 views

client_id vs distinguished name in mutual tls

i am reading this in the OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens What is the difference between a client_id and a distinguished name? I see in the PKI Mutual-TLS ...
1
vote
0answers
72 views

Difference between JSON web token, bearer token, and MAC token in OAuth2

I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens where the authorization server issues a client a JSON web token with the following format { "iss&...
0
votes
0answers
60 views

validation of an access token from the resource server

I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Boun Access Tokens The client after receives an access token (which is also entails his certificate in a hash format) from ...
0
votes
1answer
51 views

symmetric keys during mutual TLS

I have a client how asks a token from an auth server in order to use it to an endpoint which serves as the resource server. Between the client and the server, a handshake is utilized in order the two ...
0
votes
1answer
57 views

Client — CertificateVerify during handshake

I am trying to understand how the client is authenticated to the server during mutual tls So during the handshake, the client sends this message Client — CertificateVerify This message is used by the ...
0
votes
1answer
65 views

Certificate and public key flows in mutual TLS

I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens I am interested to know how the certificates and public keys are exchanged between the client and the ...
0
votes
1answer
130 views

What is an endpoint in the context of TLS?

What is the purpose of endpoints in mutual TLS authentication? Actually, what do we mean by an endpoint? I am following this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access ...
0
votes
1answer
62 views

OpenID Connect with a chain of Relying Parties

Is there a usage of OpenID Connect (OIDC) that allows for a chain of RP (terminology reference) user -> RP#1 user <-redirect to chosen OP- RP#1 user -> OP: verifies identity user <-...
0
votes
1answer
79 views

OAuth alternative for two-party scenario?

I'm trying to come up with an authentication/authorization system for what seems like a really simple scenario, but as far as I can tell it's virtually unsupported. There are two parties, total; ...
1
vote
0answers
33 views

OAuth Authorization Request Leakage Examples

The OAuth attacker model (see https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15#section-3, A4) states that (A4) Attackers that can read, but not modify, the contents of the ...
1
vote
1answer
69 views

Why using “state” variable in OAuth 2

I am building an application that is integrated with a 3rd party service provider and uses OAuth 2 to obtain permission from other users using the service to access their account information. Based on ...
2
votes
1answer
73 views

Is oauth client credentials flow safer than basic authentication with preshared secret?

Assuming that both travel over the latest version of TLS, why should I use client credentials? The obvious answer is: The access token will expire at some point The client id and secret will travel ...
0
votes
1answer
94 views

Secure a REST API

I want to build a REST API where applications can authenticate using an OAuth2 Bearer Token, so they get access only to resources related to one user or they can access by itself accessing resources ...
0
votes
0answers
60 views

OAuth 2.0: programmatically authenticate Resource Server user after Authorization Code grant

The requirement: have a user, existing in an IDP, be automatically authenticated on a Resource server. IDP app can then provide web view for resource server user. OAuth 2.0 Approach: IDP nudges ...
0
votes
1answer
64 views

Where does a scope get defined?

According to RFC 6749 the strings [scopes] are defined by the authorization server. However isn't it really the resource server who defines the scopes? I mean scopes vary from resource server to ...
0
votes
1answer
77 views

Best practices for generating and storing authorization codes and access tokens in OAuth server

I've recently implemented an OAuth server functionality to our service. I've consulted OAuth 2.0 Threat Model and Security Considerations and addressed most of the concerns. I am curious about any ...
1
vote
1answer
87 views

How is PKCE secure?

I feel like I am missing an important point here, I have been reading up a bit on the PKCE flow but something doesn't sit quite right. How is PKCE secure on public devices? If I understand this ...
0
votes
1answer
76 views

Authorization Code: Is there a specific format it has to follow?

I am currently digging into OAuth 2.0 and especially the authorization code grant. What I couldn't find from within RFC6749 is if the authorization code has to follow a specific format. The RFC says ...
0
votes
1answer
76 views

Who initiates an authorization code flow?

I'd like to understand OAuth 2.0 in more detail and especially the authorization code flow. This might be nit-picking but according to RFC6749 the client initiates the flow. (A) The client initiates ...
0
votes
0answers
47 views

Oauth2: should I increase the refresh token expiring date?

I want my clients to be able to schedule a purchase for a given date. When they perform this scheduling action, they are authenticated with an oauth2 token. However the date could be so far from now ...

1
2 3 4 5
7