Questions tagged [oauth2]
OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
1
vote
0answers
4 views
How to provide granular API security using OAuth scopes and claims
I'm trying to work out how best to secure an API using oAuth scopes and/or claims. I'm unsure on which I should be using.
My setup is as follows:
All users sign in to signin.domain.com
There are ...
0
votes
1answer
18 views
What is the example parameter in the OAuth 2.0 RFC
In section 4.1.4 of the OAuth 2.0 RFC, it gives an example of an access token response:
An example successful response:
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
...
0
votes
1answer
27 views
A Method for Generating Un-Guessable Client Identifiers
I am implementing an OAuth 2.0 authorisation server. As part of client registration process I want to generate the unique client identifier for this client.
The method I have chosen is to take all ...
1
vote
0answers
21 views
Nested API security
What are best practices for securing nested APIs?
Here is an example:
User browser (Authenticated already) -> REST API A -> REST API B (internal and may or may not be exposed to internet)
Typically,...
2
votes
1answer
48 views
What is the proper flow for authentication?
I'm tasked with migrating a group of .Net WebForms applications from a current custom username/password login scheme to an oauth2/openid connect based authentication and authorization. This specific ...
1
vote
1answer
76 views
Why do we use Oauth2 instead of Basic Auth in server to server communication using SSL?
Why do some API providers ask you to implement Oauth2 in server to server communication that's available only over HTTPS?
In the frontend (app or webapp), Oauth2 is useful to protect the user ...
4
votes
1answer
53 views
Can oauth2 “state” parameter be used to avoid using session cookies to identify user
https://tools.ietf.org/html/rfc6749#section-4.1.1 states:
4.1.1. Authorization Request"
"state"
RECOMMENDED. An opaque value used by the client to maintain
state between the ...
2
votes
1answer
31 views
Why should authorization servers document the size of client identifiers?
In section 2.1 of the OAuth2.0 RFC, it states the following regarding the client identifier:
The authorization server SHOULD document the size of any identifier it issues.
What is the point of ...
0
votes
1answer
72 views
What a malicious user could do with a refresh token that cannot be revoked and has 1 year expiry time?
In ADFS 4.0 a refresh token cannot be renowed without passing through an authorization request flow (asking the user again for credentials) and cannot be revoked.
I'm forced to put a 1 year lifetime ...
0
votes
0answers
25 views
Oauth2 vulnerable authentication flow with state parameter
As per my understanding, this is the standard authentication flow to log in a user using auth service provider;
But I've seen some framework and examples, where they build authentication URI at ...
0
votes
1answer
44 views
OAuth 2 Implicit grant type for first party SPA - Most secure and sensible way
My aim is to secure my stateless API and only allow the registered first-party clients (SPA) to consume my resources. There is not going to be any third party clients in my scenario.
I know Oauth 2 ...
-1
votes
0answers
13 views
Microservices and ID token
In micro-services architecture, some articles suggest that ID token can be passed between clients in order to implement "distributed sessions". This way, clients use ID token during OAuth 2.0 dance to ...
1
vote
0answers
28 views
OAuth2.0 and RESTful API
So I'm creating some RESTful API endpoints which use Bearer tokens for authorization. I want to use OAuth2.0 to get the access tokens for these. But I can't get my head around how to get the OAuth2.0 ...
0
votes
0answers
26 views
OAuth 2 Client Credentials within Mobile App
I am currently developing a mobile app that communicates with an OAuth server. The server I am trying to access provides two grants: Authorisation Code and a device PIN grant (not sure if it's part of ...
0
votes
1answer
29 views
How does the authorization work after authentication using OpenID Connect
Suppose that a client gets an ID token and access token from the auth server after successful authentication. The client now sends a request to the application server (request contains access token ...
0
votes
0answers
32 views
What oauth grant type should I use after social sign in
I have an application which has its own oauth microservice to issue access tokens. The flow runs as below:
User enters username and password to register, which makes api call to
user-microservice
...
1
vote
2answers
192 views
Storing OAuth access and refresh tokens in non HttpOnly cookies
I am using OAuth auth code flow to generate access and refresh tokens and then I store them in two browser cookies that are not HttpOnly and send them back too the client.
The cookies need to be non ...
3
votes
1answer
89 views
Google login button - what prevents an rogue app from stealing a token?
Here are steps to setup a Google login button on a web client:
https://developers.google.com/identity/sign-in/web/sign-in
When click on the Google login button this pops up:
All the interactions are ...
1
vote
1answer
65 views
How to use Oauth2 and JWT to secure microservice architecture?
We have been investigating proper mechanism to secure microservises that we are going to provide as API endpoints via API manager application.
Fundamentally we need stateless security mechanism like ...
0
votes
1answer
125 views
Reasons to transition Kerberos secured web applications to OAuth2/OpenId
We have five internal web applications written in Java / AngularJs that are secured via Kerberos/ Spnego ( Spring Security implementation) . We are looking to transition these apps to AWS ( EBS) .
...
1
vote
1answer
74 views
Is the OAuth2 authentication code long enough to be secure?
I have recently started working with the OAuth2 authentication flow. In using it, I see that in the authcode flow, the client allows the AuthServer to authenticate a user, and then returns an ...
1
vote
0answers
26 views
OAuth2 and linking resources of one owner to another person account
I'm implementing client side OAuth and I'm worried about the following scenario.
There is application A registered with service B that is offering access to its user resources - authorized by OAuth (...
0
votes
0answers
37 views
Which OAuth 2 flow is used by larger companies like Twitter and Facebook and why did they choose it?
Based on the user experience it seems like Twitter and Facebook use the resource owner password credential flow. From what I've read authorization code flow is the most secure option for a standard ...
0
votes
0answers
282 views
Auth0 vs Firebase = oidc vs Firebase Tokens
I am trying to choose between Auth0 and Firebase as my identity provider. I am building a SPA with a Backend API and I would like to use Auth0 or Firebase for all the logic regarding users/passwords/...
0
votes
0answers
26 views
How to safely store OAuth2 credentials in a Desktop application
I've been searching for a good answer to this problem for a while now, and have seen questions that could be duplicates, but none of them seem to have good/definitive answers that work for my case.
I ...
0
votes
0answers
101 views
In google OAuth callback, is providing redirect_uri by client a security risk?
for example, at callback url of google oauth,to convert 'code' to access_token, I need:
Client side href:
https://accounts.google.com/o/oauth2/auth?scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%...
0
votes
1answer
38 views
OIDC - what is the point of two separate tokens - access and id?
I struggle to understand why don't we just have a single token that serves both purposes - authorisation and authentication?
In some sense, the access token does more than just authorisation. It also ...
5
votes
1answer
328 views
Do I need CSRF protection in this setup with a REST API backed with oauth2 and a basic auth SSO auth server?
I've seen the answer Is CSRF possible if I don't even use cookies? but there are 2 conflicting answers and the question itself doesn't provide that much information either.
I am creating a REST ...
1
vote
0answers
276 views
Token Exchange at a REST API Gateway to federate authentication while maintaining detailed authorization (think ABAC) within the API?
I'm on the verge of creating a service within our resource server that would exchange an externally generated access token for an internally generated access token. However, this feels wrong. I have ...
0
votes
0answers
19 views
Why is auth_code server over redirect URI than on a webpage in OAuth 2.0?
Per three-legged OAuth standard, an auth_code is served as an URL parameter, while the URL being the redirect_uri specified during client registration. I guess it's an HTTP 302 response sent by the ...
0
votes
0answers
330 views
Should OAuth2 Access Token support multiple audiences?
I am considering a usecase where an OAuth2 client obtains an access token to access multiple resource servers.
Based on spec, to protect against token redirect attack:
to deal with token redirect,...
2
votes
2answers
515 views
OAuth - How does the Resource Server validate the access token is not for any other Resource Server?
Let's take an example where there are two resource servers - RS1 and RS2 and there is one authorization server - AS.
Both resource servers - RS1 and RS2 use authorization server - AS
If a client ...
4
votes
1answer
168 views
Need of scope in OAuth Client Credentials Flow
For me, Client Credential flow is like client is asking access token for itself - not on behalf of some user.
Then, why would client like to limit its own scope? What is the benefit of scopes in ...
2
votes
1answer
242 views
How to get better IAM understanding
I'm getting interested in Identity and Access Management (IAM), but I find it hard to find complete and understandable explanations that suit me, surely because I started wrong.
I began with ...
2
votes
1answer
230 views
Why CORS preflight is not available for POST requests when Content-Type is application/x-www-form-urlencoded
In oauth2 for single page application(SPA), we can revoke the access tokens of the implicit grant type by using an ajax request(this is not recommended now). I tried to do a request like below from ...
0
votes
1answer
122 views
What is the risk of sharing the client_secret.json in a public repo?
I have a python script which writes data into a public google sheets file and for using the google sheets API I need to have a user authorize my script. I want to share the script with others and thus ...
4
votes
1answer
84 views
Authorize transitive communication between applications on behalf of the user
I'm trying to wrap my head around to following web security question for a while now. Say we have a system set up as depicted in the picture below.
There is one main application with which the user ...
2
votes
1answer
85 views
Why can't the client server speak directly to an identity provider like Facebook in OAauth 2.0
OAuth 2.0 used for authentication by Google makes sense given that the server and client both trust Google but not each other.
As I understand the authorization code is passed back to the server (in ...
1
vote
1answer
436 views
OAuth2 for mobile apps with confidential backend client (Is PKCE required?)
I'm wondering why neither rfc6749 nor rfc8252 seem to consider the case where the mobile app does not make protected resource requests (and is therefore not a client) but instead relies on a backend ...
3
votes
1answer
52 views
How does security work in a cloud-to-cloud backup scenario?
I'm thinking of using Spinbackup which is a cloud-to-cloud backup of gmail, but I was resistant to the idea of telling Spinbackup my gmail password for obvious reasons. However, on the Spinbackup ...
0
votes
1answer
75 views
Best practice to share google drive API credentials for being used by a script?
In a nutshell: Shall I share oauth2-credentials in our source code with the scope of full write-access to a google drive from a dedicated single-purpose google-account?
so, I've written a python ...
2
votes
0answers
88 views
Is passing claims about the user in an access token “abusing” OpenID Connect?
First, let me assure you that I have read a number of posts on the topic before asking this question, but I am still confused and would appreciate more insights.
So, here's the premise:
There is a ...
2
votes
1answer
380 views
How to prevent refreshing a stolen access token
The scenario is: you have refresh token that is valid for a longer period of time and an access token that is valid for a shorter period of time.
The setup: There is a client, application server and ...
1
vote
1answer
149 views
Why using oAuth2 refresh token is more secure then regenerate an access_token?
I'm implementing an oAuth2 authentification to secure my REST Api.
As I am implementing oAuth2, I need to generate an access_token which will give me a temporary access to my REST datas.
To do it, I ...
0
votes
0answers
40 views
How to do authentication of SaaS implementation for uploading, processing, and retrieving documents
We would like to provide a B2B SaaS with the following flow:
Our customer's end-users upload their document using our custom
upload UI which should be embedded using an iframe
Once the user finishes ...
0
votes
1answer
30 views
Non-standard OIDC flow: How safe is this?
I have been made aware of an application, at a client, that claims to use OIDC to authenticate users. This is however done via a non-standard flow that I find hard to assess from a security standpoint....
11
votes
1answer
2k views
Why isn't PKCE encouraged for Single-Page Apps?
A lot of services today still recommend the implicit flow for an OpenID Connect/Oauth2 token exchange when developing Single-Page Apps. (See Okta, Google, Auth0)
Some newer guidance out there points ...
1
vote
1answer
66 views
OpenID Connect, OAuth2, and deleted accounts
If I use OpenID Connect or OAuth2 for authentication, and a customer deletes his/her OAuth2 provider (Facebook) account, how can I safely associate a new authentication with a different OAuth2 ...
0
votes
0answers
163 views
How to store `client_secret` privately on frontend applications?
I am trying to understand how authentication and authorization should work with a REST API given that the API will be available to be used by third-party applications.
I realize that if we allow ...
3
votes
1answer
234 views
Is using OAuth2 services like Google or Facebook Single Sign-On a privacy concern?
With all the coverage of Cambridge Analytica scandal, it seems like this wasn't a data breach or hack, it was just that Cambridge Analytica did not properly disclose how they would use the data.
Is ...
