Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [oauth2]

OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0

Filter by
Sorted by
Tagged with
0 votes
1 answer
24 views

OAuth 2.0 POST to Authorization Endpoint

The OAuth 2.0 specification states: The authorization server MUST support the use of the HTTP "GET" method [RFC2616] for the authorization endpoint and MAY support the use of the "POST&...
user avatar
0 votes
0 answers
51 views

What are the risks of using wildcard in context path of OIDC/OAuth redirect_uri?

I'm using Keycloak for my authentication needs. It allows me to use * as wildcard when whitelisting redirect_uris for OIDC clients. What are the risks of using * in context path of redirect_uri? For ...
user avatar
0 votes
0 answers
17 views

Safe way to allow authorized application to generate a new key after one is broken?

I've run into an OAuth issue where I received a key from the provider with an expiration that was literally set for the same moment I received it. The refresh token's expiration was also set for that ...
user avatar
  • 181
0 votes
0 answers
21 views

What is the 'domain name' in PKCE Auth flow for mobile apps?

I'm interested in building a mobile app that authenticates with a service using OAuth2 so that my app can use their API's. Documentation To apply for an application key, I need to enter my application'...
user avatar
-1 votes
1 answer
23 views

Definition of Authorization according to OAuth2

I am trying to understand OAuth2 and OIDC. The OIDC glossary is a good starting point, and while it defines "Authentication", but does not actually define "Authorization". I ...
user avatar
3 votes
1 answer
122 views

Adding SSO to an existing website - should SSO login link to matching email address?

I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and ...
user avatar
0 votes
2 answers
50 views

Revoke all refresh tokens when account locked?

Scenario: a user enters his password incorrectly x times, so his account is locked for y minutes. Should I revoke all his refresh tokens? Problems: user is logged out of all devices, not just the one ...
user avatar
  • 333
0 votes
0 answers
16 views

Downside of resource owner password flow for native mobile apps?

I have seen some similar questions a few years old and I am not sure if there are any new changing views on this. I see that this flow is not recommended for mobile native apps. What are the practical ...
user avatar
  • 101
0 votes
1 answer
90 views

3rd party mobile app access our service via our APIs

We have a microservice backend system & we expose APIs for our customers to use. We are now developing our Authentication system with our identity provider service. We have a customer(a company), ...
user avatar
0 votes
0 answers
82 views

Using oauth2 to implement SSO between a desktop application and a web application

Is oauth2 designed to handle single-sign-on between a desktop application and a webapp? The scenario looks like this: The desktop app has a username/password login After a user is authenticated in ...
user avatar
  • 43
0 votes
0 answers
25 views

Why can't an email or profile scope used to authenticate in OAuth?

I am trying to learn OAuth and I keep reading that "OAuth is only used for authorization." However, if you add an email or profile scope, doesn't that identify who the user is? So can it be ...
user avatar
1 vote
0 answers
43 views

Auth0 token exchange vs Google Firebase token exchange

I'm researching our options for securing access to a single-page web app and a mobile app. The apps communicate with a REST API which, based on the authenticated user's identity, will return ...
user avatar
  • 111
0 votes
1 answer
40 views

Multifactor auth in OAuth2 Password flow

This resource (and others) mention that OAuth2 Password flow doesn't provide mechanism for multi-factor authentication. Does that mean other flows do? How does MFA fit in the OAuth2 framework? What ...
user avatar
0 votes
0 answers
60 views

HTTP Bearer authentication with multiple identity providers?

Suppose I have a web application that uses OpenID Connect to enable users to log in with one of several 3rd party identity providers (e.g., "log in with Google", "log in with Facebook&...
user avatar
3 votes
0 answers
129 views

Implement state parameter in OAuth2.0 code flow server-side

I have a scenario where I need to implement OAuth 2.0 authorization code flow on the server side - the user authorizes a backend service against Microsoft, the service receives a token, saves it in a ...
user avatar
2 votes
3 answers
171 views

Detecting session sharing with OAuth2

In the OAuth2 Implict Grant flow, the access token is added to the URL fragment as part of the redirect from the Authorization Server to the Relying Party. Since this access token is made visible to ...
user avatar
-1 votes
1 answer
269 views

How to secure backend API access?

In the good old days, you made server-side websites using PHP or something like that, now we have modern web apps divided into front-end and back-end (usually API Rest), you can't rely on CORS because ...
user avatar
  • 143
0 votes
0 answers
69 views

GitLab with api scope and confidentiality unchecked. What are the privacy risks?

I just created a GitLab application to connect it with StackEdit.io. I created it by following the instructions on this GitLab docs page. I had to create the GitLab application with api scope and I ...
user avatar
  • 101
0 votes
0 answers
146 views

OpenId with Biometrics - should I write a custom login + OIDC

We are trying to arrive at a solution for an enterprise app Different Users have different Authentication Methods User Type 1 - Password + Captcha User type 2 - Biometric [Not device-based] + ...
user avatar
0 votes
0 answers
60 views

I have a non-Oauth service and am using this approach with Server initiated HttpOnly cookies with stripped JWT

My question is : Is this approach correct given I have a non-Oauth service? My goal is to use the simplest amount of security features while still being as strong as possible. My approach is as ...
user avatar
  • 101
0 votes
1 answer
111 views

Modern security flow/process for trusted Mobile and SPA apps with self-hosted OIDC

Currently, there are two common auth flows i know: Resource Owner Password Flow Authentication Code Flow + PKCE (didn't mention other, since this one is more robust within redirect-based) This theme ...
user avatar
  • 101
0 votes
1 answer
122 views

Wouldn't the OAuth 2.0 client credentials flow be more secure with the option of using refresh tokens?

The OAuth 2.0 specification states that "A refresh token SHOULD NOT be included" in responses to access token requests in the client credentials flow and that, even if they were used, the ...
user avatar
  • 101
0 votes
0 answers
90 views

Access to JWT session after OAuth redirects

I have a stateless backend app, session data is stored on the front-end in a JWT token, so the front-end app passes this token in Authorization header to all the requests. I need to add 3rd party API ...
user avatar
  • 1
0 votes
0 answers
123 views

how to avoid Oauth2 timeouts with orchestrator REST API

I have a REST API, which I'll call "R". R uses Oauth2 Bearer tokens for auth. However, R has a fairly complex API, so we're designing a new system called "O" that provides a ...
user avatar
  • 51
1 vote
1 answer
88 views

Password Based Encryption with Social Login

I have a question about implementing user password-based encryption in a database injunction with the Social Login feature. User private data in my database should be encrypted in order to provide ...
user avatar
2 votes
3 answers
443 views

OAuth2 - using Id Token for authentication to a backend service

Many resources on the internet state that you should use Access Token and not Id Token to authenticate to an API, but do not provide explicit reasons why. Are there any real drawbacks to use an Id ...
user avatar
  • 229
2 votes
1 answer
174 views

Why is PKCE "RECOMMENDED" for authorization codes with confidential clients?

Section 2.1.1 of IETF's OAuth 2.0 Security Best Current Practice begins as follows: Clients MUST prevent injection (replay) of authorization codes into the authorization response by attackers. ...
user avatar
0 votes
1 answer
57 views

A Native Desktop App using PKCE - Can an id_token be consider valid authentication when passed to another protected server resource?

My understanding is that client impersonation cannot be prevented for Native Desktop Apps. If all standard controls: State, PKCE, Redirect_URI confirmation etc are in place, to prevent auth_code ...
user avatar
0 votes
1 answer
163 views

Is there a risk involved in refreshing a JWT token every time you refocus the webpage?

I am currently testing a website that appears to make a refresh token request every time I focus away from the web browser and back, or away from the tab the website is open in and back to it. I've ...
user avatar
  • 173
1 vote
1 answer
123 views

What is a pre-warmed secret?

As described here: https://tools.ietf.org/id/draft-ietf-oauth-security-topics-13.html#proposed-countermeasures-2 Note on pre-warmed secrets: An attacker can circumvent the countermeasures described ...
user avatar
1 vote
0 answers
181 views

Openid nonce replay attack in auth code flow

Looking at this question Openid connect nonce replay attack and the answer by @benbotto. I understand the replay attack in implicit flow but unable to understand it for auth code flow. Let's say an ...
user avatar
1 vote
1 answer
267 views

Is OAuth2.0 Authorization Code Grant flow with PKCE really secure?

CONTEXT There is a SPA that uses Authorization Code Grant flow with PKCE to get info from an API all the info is highly sensitive RESEARCH Here is what I found of how Authorization Code Grant flow ...
user avatar
  • 143
1 vote
0 answers
79 views

Authorise access to hierarchical data

Consider a scenario in which you offer service access based on a hierarchy of authority. i.e., a HEAD can register his subordinates. The authenticated HEAD has the previledge to read and update data ...
user avatar
0 votes
0 answers
73 views

Strategies for segregating anonymous and secure access to APIs

Traditionally, we used either path-based access control or a separate DNS for public and private content segregation. In the modern era of standard-based auth, what are the best auth strategies for ...
user avatar
0 votes
1 answer
107 views

Which OAuth2 flow should I use?

Context I'm trying to build an hybrid multi-tenant API using OAuth2.0 using Laravel 8 Passport, so my system has 2 parts: one process the request from the tenant application, and the other part ...
user avatar
  • 143
0 votes
2 answers
161 views

Is a consent screen in an OAuth 2.0 implementation optional

I've read through RFC 6749: https://datatracker.ietf.org/doc/html/rfc6749 The only mention of consent is in this bit: The authorization server MUST implement CSRF protection for its authorization ...
user avatar
  • 121
0 votes
0 answers
83 views

How to authenticate OAuth2 confidential client is making a REST call?

We are looking to implement some REST services to be called from partner servers (not end users via a browser). The out-of-the-box implementation seems to flow thusly: Partner server passes a client ...
user avatar
1 vote
0 answers
83 views

Where should I store an OAuth refresh token for a third party?

I am connecting to a third party which authenticates with OAuth2. Once the user has logged in, I want to store the access & refresh tokens for the user. Which is more secure & proper - to save ...
user avatar
  • 111
0 votes
1 answer
461 views

How to pentest oAuth2/oidc clients

imagine the following problem: As a developer, I would like to check if my oAuth2 or OpenID Connect client is really secure. I would like to check if it validates the JWT signature, uses the nonce etc....
user avatar
  • 2,383
0 votes
1 answer
921 views

How is pop token more secure than bearer token?

I tried reading few articles, however I'm not able to understand the merit of POP over Bearer token. Bearer token if lost (during transit over the wire) can give the holder of the token same ...
user avatar
  • 141
1 vote
1 answer
115 views

Whose fault/bug is it in the below case?

Say there are 2 servers a.example and b.example. b.example uses 3rd party authentication from a.example via OAuth or other protocols. Now a user user1 with account xyz@a.example logs in and sets up a ...
user avatar
1 vote
0 answers
97 views

Is Google OAuth login in 3rd party applications via system browser secure?

Numerous mobile applications allow me to "Login with Google". From technical perspective, I assume this would usually follow those OAuth native app login integration guidelines: https://...
user avatar
1 vote
0 answers
80 views

What stops an attacker from simply using your client_id in their own auth code flow with PKCE [duplicate]

Ok so I get the benefit that PKCE provides. Without it, the attacker knows your client_secret and by registering the same URL scheme as your application on mobile, can intercept the redirect with the ...
user avatar
  • 121
1 vote
0 answers
253 views

Alternatives to OAuth 2 for first-party native applications

I am currently thinking about alternative ways for my native iOS Application (written in Swift) to receive access- & refresh-tokens. As of now, user sessions are established using revokable JWTs, ...
user avatar
0 votes
0 answers
117 views

Storing an OAuth 2.0 access token

I'm in a debate of where to securely store an OAuth 2.0 access token. There are two opinions: On the browser (inside of a HttpOnly cookie) On the server/inside the a database The argument against ...
user avatar
  • 111
5 votes
4 answers
417 views

Is a "magic link" a kind of authentication?

From what am I reading, magic links require users to provide their email and the user will be sent an email with the link to sign-in, and the users can use this link to log into the system. Can this ...
user avatar
  • 51
1 vote
0 answers
133 views

OAuth for command line application

I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
user avatar
0 votes
1 answer
126 views

Okta backend verification of Access Token generated in PKCE flow

I'm looking to verify the security of the OAuth mechanism for an application I'm testing. The application uses Okta for SSO and the PKCE OAuth flow. What I'm not clear on is how the backend is ...
user avatar
  • 175
1 vote
0 answers
74 views

Isolating permissions available to browser JS via oauth and referer

This proposal concerns a strategy for isolating the permissions given to plugins in a plugin architecture. I'm looking for insight into whether this design can succeed in isolating those permissions. ...
user avatar
0 votes
1 answer
331 views

Is PKCE really protecting public facing clients? Can't a rogue app steal the ClientID and Secret and make a AuthCode request of its own?

From what I have understood, for public facing clients such as JavaScript apps that run on the browser or mobile apps which have no backend there is no secure place to store client id and secret. ...
user avatar

1
2 3 4 5
8