Questions tagged [oauth2]
OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
80
questions with no upvoted or accepted answers
7
votes
0answers
517 views
FB Oauth CSRF security, PHP website
I am experimenting with third party login, using Twitter and Facebook.
After getting access token from these parties, and confirming its validity, I then issue my own JWT token thats used within my ...
6
votes
2answers
259 views
Non Confidential OAuth2 flow
I've been going through some documents regarding OAuth2 confidential and non-confidential authorisation flows, namely this and the RFC.
From my understanding, the non-confidential flow does not ...
5
votes
0answers
57 views
Poor Man's OAuth Grant - Review
A 3rd party company has requested that we implement single sign-on with them using the below approach. I'm familiar with OAuth grants and OIDC flows but this seems rather odd to me.
The user has ...
5
votes
2answers
288 views
Using third party authentication like google/facebook to login to a site, is there any security risk when the site is hacked?
Sites like stackoverflow, quora, and many more offers sign in from Google/Facebook. In the event that there is a data breach or the site is hacked, is there any security risk to your Google/Facebook ...
5
votes
1answer
177 views
Authorize transitive communication between applications on behalf of the user
I'm trying to wrap my head around to following web security question for a while now. Say we have a system set up as depicted in the picture below.
There is one main application with which the user ...
5
votes
0answers
43 views
Is there a good way to store OAuth2 tokens for a native application?
Currently I have a native PC application that builds and uploads a configuration to an embedded Linux device (i.e. the client). This device connects to Google Calendar via their OAuth2 API. The ...
5
votes
0answers
898 views
Using the authorization code grant without using cookies?
I've been reading up on this for months and it seems like the whole thing could converge on what I'm summarizing below. I'm trying to arrive at the most ideal:
OAuth2
OpenID Connect
SPA / Mobile ...
4
votes
0answers
53 views
Architecting a solution with native login and 3rd party login via OAuth/OpenID Connect using dotnet core
I am building an API driven application that will have a native login with username and password, and will also need to grant 3rd party access via OAuth/OpenID Connect in the near future.
A pattern I ...
4
votes
2answers
757 views
Is it ok to write OidC Bearer token to log?
During development we added to error logs details of http requests, including headers, to have better understanding for error investigation. Our architect pointed that we should not place sensitive ...
3
votes
1answer
60 views
Does the browser get the access_token in OAuth2?
I've spent more than 10 days trying to understand the Authorization Code Flow for a web application where I'm supposed to implement OpenID Connect for a single sign on. It feels that there is a lot of ...
3
votes
1answer
200 views
Is there any way for server side to verify the application integrity during OAuth2 workflow
During OAuth2 PKCE workflow, the native application (installed on Android/iOS device) issues the authorize request to server and exchange the OAuthtokens.
For server side, is there any way that we ...
3
votes
0answers
917 views
Token Exchange at a REST API Gateway to federate authentication while maintaining detailed authorization (think ABAC) within the API?
I'm on the verge of creating a service within our resource server that would exchange an externally generated access token for an internally generated access token. However, this feels wrong. I have ...
3
votes
0answers
370 views
Is passing claims about the user in an access token “abusing” OpenID Connect?
First, let me assure you that I have read a number of posts on the topic before asking this question, but I am still confused and would appreciate more insights.
So, here's the premise:
There is a ...
3
votes
0answers
559 views
OAuth 2.0 - using client secret in a native app if refresh token is stored securely
I am developing a native app that needs to access protected resources using OAuth 2. There is a business requirement so that a user has to enter his credentials manually as rarely as possible and the ...
2
votes
0answers
31 views
How exactly do mobile apps achieve authorization code flow with PKCE?
Let's imagine the following:
I've developed a mobile app using Xamarin (iOS/Android compatible)
I want it to support OAuth2 + OpenID connect's authorization code flow with PKCE, so that the user's ...
2
votes
0answers
54 views
OAuth2: what to return when revoking a token which is not the client's? RFC7009
In RFC7009 - section 2.1, it is stated that:
The authorization server first validates the client credentials (in
case of a confidential client) and then verifies whether the token
was ...
2
votes
0answers
387 views
Using Google Authentication with Lambda@Edge and S3 Static Sites
I am looking to set up authentication on an S3 hosted static site. The configuration is:
S3 bucket configured to allow access via cloudfront
AWS Cloudfront distribution with HTTPS configured and a ...
2
votes
0answers
351 views
How to provide granular API security using OAuth scopes and claims
I'm trying to work out how best to secure an API using oAuth scopes and/or claims. I'm unsure on which I should be using.
My setup is as follows:
All users sign in to signin.domain.com
There are ...
2
votes
0answers
778 views
Auth0 vs Firebase = oidc vs Firebase Tokens
I am trying to choose between Auth0 and Firebase as my identity provider. I am building a SPA with a Backend API and I would like to use Auth0 or Firebase for all the logic regarding users/passwords/...
2
votes
0answers
108 views
OAuth2 Implicit Flow. Additional protection for access_token from interception
We have a one-page JavaScript application that authenticates the user on our server using the OAuth 2.0 protocol (and the AddId-Connect add-in). After authentication, the server issues an access_token ...
2
votes
0answers
264 views
Is OAuth2 Implicit secure?
I have built an authorisation server using OWIN based OAuth2. I understand that the Implicit grant is basically only authenticating the redirect_URL and Client_ID when making the request. I thought, ...
2
votes
0answers
732 views
JWT as a nonce in sessionless backends
I'm creating an API server (a gateway) with two restrictions in mind:
It has to be sessionless (no session id in a cookie or anywhere, no Redis or anything like that)
I have to use an implicit grant ...
2
votes
0answers
361 views
OAuth2 password analog (private, unique, & static) – Encryption
I’m making a webapp which encrypts each user’s data, using AES-256, with a unique key for each account. I’m thinking about adding external signon via the “Sign in with Google” scheme. However, I’ve ...
1
vote
0answers
21 views
Websockets: Is it safe to allow tokens in url parameters?
For an API, I know that passing tokens in the url has the following security implications:
They get saved in browser history
They’re probably saved in your server’s logs and memory
Users might post ...
1
vote
0answers
31 views
Shopify OAuth: State parameter useful when the auth server also returns a signed shop id?
Background: I think I understand how the state parameter is used in oAuth to prevent CSFR attacks against the redirect_uri.
Situation: I am looking at this in the context of implementing a Shopify ...
1
vote
0answers
52 views
Why does OAuth have two separate tokens (access and refresh)?
In the OAuth2 protocol, two kind of tokens are used:
access_token: Granted by authorization server, used by resources servers to decide whether access should be granted for the resource
...
1
vote
1answer
47 views
How verify id_token from the browser in OAuth2?
I have been dwelling into OAuth2 and and OpenID Connect for Authorization flow. And I'm still a bit confused.
I do understand that during the code exchange for an access token the user receives an ...
1
vote
1answer
43 views
Could Redirection URI be a Client URI in OAuth2 Autorization code flow?
For Authorization code grant flow, RFC says the authorization server will send back the code to the redirect_uri specified.
I believe it means the browser will recieve a URL like http://webapp/?code=...
1
vote
0answers
53 views
API protection - JWT vs HMAC signing vs OAuth
Lets say you are designing a new API. The consumer of your API is a mobile app that periodically sends requests in the background, but you expect other consumers as well, such as web apps or servers.
...
1
vote
0answers
518 views
how does logging into myaccount.google.com automatically log you into youtube.com
You sign into myaccount.google.com.
Somewhere along the line your browser is redirected to
https://accounts.youtube.com/accounts/SetSID?ssdc=1&sidt=<reallyLongBase64>&continue=https://...
1
vote
2answers
78 views
Secure API key mechanism for identification
In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using ...
1
vote
0answers
69 views
Designing distributed authentication/authorisation system
I'm trying to design a system that has the following elements:
the main backend REST API (currently one, probably multiple in the future)
front-channel client(s) -- JS-based single-page app(s)
back-...
1
vote
0answers
34 views
Oauth2/OIDC: I know the address of a resource server, is there a standard for querying which authorization servers it accepts?
I have a bunch of what are essentially IOT devices that will authenticate connections using oauth 2 tokens and/or openid connect (depending on use-case). Each IOT device is individually configurable ...
1
vote
1answer
144 views
Why is there a redirect to the native app in PKCE?
Why even have a redirect or even use the browser? Wouldn't just a normal TLS/HTTPS request/response in the app protect the requests and token?
The one argument I have heard against solely relying on ...
1
vote
1answer
81 views
what is the scope of google drive's OAuth credentials?
I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
1
vote
0answers
52 views
Is it secure to expose OAuth2 credentials for a test application
I have created an application in which it is possible to login using GitLab. This requires an OAuth2 app id and secret.
I created a test application in GitLab UI with the redirect set to https://...
1
vote
0answers
304 views
Using Cognito access token to pass claims
I am working on migrating all our users from our DB to a managed service, and we're considering AWS Cognito.
We want to use Cognito for Authentication and Access Control.
For access control, we're ...
1
vote
1answer
701 views
OpenID Connect: Is storing access token in browser secure?
I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
1
vote
0answers
49 views
Is the OAuth implicit flow too insecure for serverless single page web applications?
Assuming the need for OAuth
Imagine an application that is:
A single page web application hosted on S3
Authenticated using implicit OAuth flow implicit
Have the web application access resources ...
1
vote
0answers
27 views
When is OAuth1 preferred over OAuth2
Scenario:
I need to build a new API for a third party company who are building a tool to capture information of new users wishing to create accounts on our enterprise platform.
-x-
My preferred ...
1
vote
0answers
53 views
Tunelling an Authenticated User Across Microservices Securely
On a platform which follows the OAuth 2.0 framework for authorization and a microserivce based architecture, what is a secure way to pass a user from one microservice to another on the same platform ...
1
vote
0answers
270 views
How to properly store OAuth 2.0 client_id and client_secret in a web application?
In the PoC (Proof of Concept) that I'm currently developing, data from an API is consumed and OAuth 2.0 is required for authentication. The application is already working as expected, the users are ...
1
vote
0answers
35 views
Nested API security
What are best practices for securing nested APIs?
Here is an example:
User browser (Authenticated already) -> REST API A -> REST API B (internal and may or may not be exposed to internet)
Typically,...
1
vote
0answers
41 views
OAuth2.0 and RESTful API
So I'm creating some RESTful API endpoints which use Bearer tokens for authorization. I want to use OAuth2.0 to get the access tokens for these. But I can't get my head around how to get the OAuth2.0 ...
1
vote
1answer
986 views
Should OAuth2 Access Token support multiple audiences?
I am considering a usecase where an OAuth2 client obtains an access token to access multiple resource servers.
Based on spec, to protect against token redirect attack:
to deal with token redirect,...
1
vote
0answers
71 views
OAuth2 auth server reusing the access token
I found some implementations of OAuth2 provider (auth server) which issues the same access token (for same user & scope) for different authentication request. Does the OAuth2 spec allows it?
Any ...
1
vote
0answers
353 views
OAuth2 Implicit Flow and silent autologin by Windows Identity. Possible new attack vectors?
We have a typical Single-Page js application that authenticates to our own authentication server using the OAuth 2.0 protocol (and the OpenId-Connect add-in). The customer sent a request to implement ...
1
vote
0answers
65 views
Oauth2 for mobile apps vs Google Digital Asset Links
I'm working on new authentication service for my company. We've got web app (asp.net) and separate API. API is consumed by third party integrators and also by our own mobile apps.
For mobile apps, ...
1
vote
0answers
361 views
Micro Service - Outh2 Workflow with a SPA, Facebook Login and JWT
Introduction
We are currently trying to figure out a way to implement token based authentication and authorisation with Facebook Connect combined with maybe JWT within the micro service architecture.
...
1
vote
1answer
261 views
How does a user get authenticated on server B if they are already authenticated on server A through OAuth2?
Lets say I have server A (a web server). Users initially use an external provider such as Google to get authenticated on that server. An entry is created in my database saying that this user has ...
