Questions tagged [oauth2]

OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0

80 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
7
votes
0answers
517 views

FB Oauth CSRF security, PHP website

I am experimenting with third party login, using Twitter and Facebook. After getting access token from these parties, and confirming its validity, I then issue my own JWT token thats used within my ...
6
votes
2answers
259 views

Non Confidential OAuth2 flow

I've been going through some documents regarding OAuth2 confidential and non-confidential authorisation flows, namely this and the RFC. From my understanding, the non-confidential flow does not ...
5
votes
0answers
57 views

Poor Man's OAuth Grant - Review

A 3rd party company has requested that we implement single sign-on with them using the below approach. I'm familiar with OAuth grants and OIDC flows but this seems rather odd to me. The user has ...
5
votes
2answers
288 views

Using third party authentication like google/facebook to login to a site, is there any security risk when the site is hacked?

Sites like stackoverflow, quora, and many more offers sign in from Google/Facebook. In the event that there is a data breach or the site is hacked, is there any security risk to your Google/Facebook ...
5
votes
1answer
177 views

Authorize transitive communication between applications on behalf of the user

I'm trying to wrap my head around to following web security question for a while now. Say we have a system set up as depicted in the picture below. There is one main application with which the user ...
5
votes
0answers
43 views

Is there a good way to store OAuth2 tokens for a native application?

Currently I have a native PC application that builds and uploads a configuration to an embedded Linux device (i.e. the client). This device connects to Google Calendar via their OAuth2 API. The ...
5
votes
0answers
898 views

Using the authorization code grant without using cookies?

I've been reading up on this for months and it seems like the whole thing could converge on what I'm summarizing below. I'm trying to arrive at the most ideal: OAuth2 OpenID Connect SPA / Mobile ...
4
votes
0answers
53 views

Architecting a solution with native login and 3rd party login via OAuth/OpenID Connect using dotnet core

I am building an API driven application that will have a native login with username and password, and will also need to grant 3rd party access via OAuth/OpenID Connect in the near future. A pattern I ...
4
votes
2answers
757 views

Is it ok to write OidC Bearer token to log?

During development we added to error logs details of http requests, including headers, to have better understanding for error investigation. Our architect pointed that we should not place sensitive ...
3
votes
1answer
60 views

Does the browser get the access_token in OAuth2?

I've spent more than 10 days trying to understand the Authorization Code Flow for a web application where I'm supposed to implement OpenID Connect for a single sign on. It feels that there is a lot of ...
3
votes
1answer
200 views

Is there any way for server side to verify the application integrity during OAuth2 workflow

During OAuth2 PKCE workflow, the native application (installed on Android/iOS device) issues the authorize request to server and exchange the OAuthtokens. For server side, is there any way that we ...
3
votes
0answers
917 views

Token Exchange at a REST API Gateway to federate authentication while maintaining detailed authorization (think ABAC) within the API?

I'm on the verge of creating a service within our resource server that would exchange an externally generated access token for an internally generated access token. However, this feels wrong. I have ...
3
votes
0answers
370 views

Is passing claims about the user in an access token “abusing” OpenID Connect?

First, let me assure you that I have read a number of posts on the topic before asking this question, but I am still confused and would appreciate more insights. So, here's the premise: There is a ...
3
votes
0answers
559 views

OAuth 2.0 - using client secret in a native app if refresh token is stored securely

I am developing a native app that needs to access protected resources using OAuth 2. There is a business requirement so that a user has to enter his credentials manually as rarely as possible and the ...
2
votes
0answers
31 views

How exactly do mobile apps achieve authorization code flow with PKCE?

Let's imagine the following: I've developed a mobile app using Xamarin (iOS/Android compatible) I want it to support OAuth2 + OpenID connect's authorization code flow with PKCE, so that the user's ...
2
votes
0answers
54 views

OAuth2: what to return when revoking a token which is not the client's? RFC7009

In RFC7009 - section 2.1, it is stated that: The authorization server first validates the client credentials (in case of a confidential client) and then verifies whether the token was ...
2
votes
0answers
387 views

Using Google Authentication with Lambda@Edge and S3 Static Sites

I am looking to set up authentication on an S3 hosted static site. The configuration is: S3 bucket configured to allow access via cloudfront AWS Cloudfront distribution with HTTPS configured and a ...
2
votes
0answers
351 views

How to provide granular API security using OAuth scopes and claims

I'm trying to work out how best to secure an API using oAuth scopes and/or claims. I'm unsure on which I should be using. My setup is as follows: All users sign in to signin.domain.com There are ...
2
votes
0answers
778 views

Auth0 vs Firebase = oidc vs Firebase Tokens

I am trying to choose between Auth0 and Firebase as my identity provider. I am building a SPA with a Backend API and I would like to use Auth0 or Firebase for all the logic regarding users/passwords/...
2
votes
0answers
108 views

OAuth2 Implicit Flow. Additional protection for access_token from interception

We have a one-page JavaScript application that authenticates the user on our server using the OAuth 2.0 protocol (and the AddId-Connect add-in). After authentication, the server issues an access_token ...
2
votes
0answers
264 views

Is OAuth2 Implicit secure?

I have built an authorisation server using OWIN based OAuth2. I understand that the Implicit grant is basically only authenticating the redirect_URL and Client_ID when making the request. I thought, ...
2
votes
0answers
732 views

JWT as a nonce in sessionless backends

I'm creating an API server (a gateway) with two restrictions in mind: It has to be sessionless (no session id in a cookie or anywhere, no Redis or anything like that) I have to use an implicit grant ...
2
votes
0answers
361 views

OAuth2 password analog (private, unique, & static) – Encryption

I’m making a webapp which encrypts each user’s data, using AES-256, with a unique key for each account. I’m thinking about adding external signon via the “Sign in with Google” scheme. However, I’ve ...
1
vote
0answers
21 views

Websockets: Is it safe to allow tokens in url parameters?

For an API, I know that passing tokens in the url has the following security implications: They get saved in browser history They’re probably saved in your server’s logs and memory Users might post ...
1
vote
0answers
31 views

Shopify OAuth: State parameter useful when the auth server also returns a signed shop id?

Background: I think I understand how the state parameter is used in oAuth to prevent CSFR attacks against the redirect_uri. Situation: I am looking at this in the context of implementing a Shopify ...
1
vote
0answers
52 views

Why does OAuth have two separate tokens (access and refresh)?

In the OAuth2 protocol, two kind of tokens are used: access_token: Granted by authorization server, used by resources servers to decide whether access should be granted for the resource ...
1
vote
1answer
47 views

How verify id_token from the browser in OAuth2?

I have been dwelling into OAuth2 and and OpenID Connect for Authorization flow. And I'm still a bit confused. I do understand that during the code exchange for an access token the user receives an ...
1
vote
1answer
43 views

Could Redirection URI be a Client URI in OAuth2 Autorization code flow?

For Authorization code grant flow, RFC says the authorization server will send back the code to the redirect_uri specified. I believe it means the browser will recieve a URL like http://webapp/?code=...
1
vote
0answers
53 views

API protection - JWT vs HMAC signing vs OAuth

Lets say you are designing a new API. The consumer of your API is a mobile app that periodically sends requests in the background, but you expect other consumers as well, such as web apps or servers. ...
1
vote
0answers
518 views

how does logging into myaccount.google.com automatically log you into youtube.com

You sign into myaccount.google.com. Somewhere along the line your browser is redirected to https://accounts.youtube.com/accounts/SetSID?ssdc=1&sidt=<reallyLongBase64>&continue=https://...
1
vote
2answers
78 views

Secure API key mechanism for identification

In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using ...
1
vote
0answers
69 views

Designing distributed authentication/authorisation system

I'm trying to design a system that has the following elements: the main backend REST API (currently one, probably multiple in the future) front-channel client(s) -- JS-based single-page app(s) back-...
1
vote
0answers
34 views

Oauth2/OIDC: I know the address of a resource server, is there a standard for querying which authorization servers it accepts?

I have a bunch of what are essentially IOT devices that will authenticate connections using oauth 2 tokens and/or openid connect (depending on use-case). Each IOT device is individually configurable ...
1
vote
1answer
144 views

Why is there a redirect to the native app in PKCE?

Why even have a redirect or even use the browser? Wouldn't just a normal TLS/HTTPS request/response in the app protect the requests and token? The one argument I have heard against solely relying on ...
1
vote
1answer
81 views

what is the scope of google drive's OAuth credentials?

I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
1
vote
0answers
52 views

Is it secure to expose OAuth2 credentials for a test application

I have created an application in which it is possible to login using GitLab. This requires an OAuth2 app id and secret. I created a test application in GitLab UI with the redirect set to https://...
1
vote
0answers
304 views

Using Cognito access token to pass claims

I am working on migrating all our users from our DB to a managed service, and we're considering AWS Cognito. We want to use Cognito for Authentication and Access Control. For access control, we're ...
1
vote
1answer
701 views

OpenID Connect: Is storing access token in browser secure?

I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
1
vote
0answers
49 views

Is the OAuth implicit flow too insecure for serverless single page web applications?

Assuming the need for OAuth Imagine an application that is: A single page web application hosted on S3 Authenticated using implicit OAuth flow implicit Have the web application access resources ...
1
vote
0answers
27 views

When is OAuth1 preferred over OAuth2

Scenario: I need to build a new API for a third party company who are building a tool to capture information of new users wishing to create accounts on our enterprise platform. -x- My preferred ...
1
vote
0answers
53 views

Tunelling an Authenticated User Across Microservices Securely

On a platform which follows the OAuth 2.0 framework for authorization and a microserivce based architecture, what is a secure way to pass a user from one microservice to another on the same platform ...
1
vote
0answers
270 views

How to properly store OAuth 2.0 client_id and client_secret in a web application?

In the PoC (Proof of Concept) that I'm currently developing, data from an API is consumed and OAuth 2.0 is required for authentication. The application is already working as expected, the users are ...
1
vote
0answers
35 views

Nested API security

What are best practices for securing nested APIs? Here is an example: User browser (Authenticated already) -> REST API A -> REST API B (internal and may or may not be exposed to internet) Typically,...
1
vote
0answers
41 views

OAuth2.0 and RESTful API

So I'm creating some RESTful API endpoints which use Bearer tokens for authorization. I want to use OAuth2.0 to get the access tokens for these. But I can't get my head around how to get the OAuth2.0 ...
1
vote
1answer
986 views

Should OAuth2 Access Token support multiple audiences?

I am considering a usecase where an OAuth2 client obtains an access token to access multiple resource servers. Based on spec, to protect against token redirect attack: to deal with token redirect,...
1
vote
0answers
71 views

OAuth2 auth server reusing the access token

I found some implementations of OAuth2 provider (auth server) which issues the same access token (for same user & scope) for different authentication request. Does the OAuth2 spec allows it? Any ...
1
vote
0answers
353 views

OAuth2 Implicit Flow and silent autologin by Windows Identity. Possible new attack vectors?

We have a typical Single-Page js application that authenticates to our own authentication server using the OAuth 2.0 protocol (and the OpenId-Connect add-in). The customer sent a request to implement ...
1
vote
0answers
65 views

Oauth2 for mobile apps vs Google Digital Asset Links

I'm working on new authentication service for my company. We've got web app (asp.net) and separate API. API is consumed by third party integrators and also by our own mobile apps. For mobile apps, ...
1
vote
0answers
361 views

Micro Service - Outh2 Workflow with a SPA, Facebook Login and JWT

Introduction We are currently trying to figure out a way to implement token based authentication and authorisation with Facebook Connect combined with maybe JWT within the micro service architecture. ...
1
vote
1answer
261 views

How does a user get authenticated on server B if they are already authenticated on server A through OAuth2?

Lets say I have server A (a web server). Users initially use an external provider such as Google to get authenticated on that server. An entry is created in my database saying that this user has ...