Questions tagged [oauth2]

OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0

Filter by
Sorted by
Tagged with
0
votes
1answer
100 views

Who initiates an authorization code flow?

I'd like to understand OAuth 2.0 in more detail and especially the authorization code flow. This might be nit-picking but according to RFC6749 the client initiates the flow. (A) The client initiates ...
5
votes
2answers
2k views

Is it ok to write OidC Bearer token to log?

During development we added to error logs details of http requests, including headers, to have better understanding for error investigation. Our architect pointed that we should not place sensitive ...
0
votes
1answer
189 views

Combining User Context in Machine-2-Machine OAuth2 Client Credential Flow

I have a REST API that is used by 2 separate application and is authenticating them by M2M OAuth2 Client Credential Flow. One of the two application is an automation service without user context. The ...
1
vote
1answer
363 views

How does a user get authenticated on server B if they are already authenticated on server A through OAuth2?

Lets say I have server A (a web server). Users initially use an external provider such as Google to get authenticated on that server. An entry is created in my database saying that this user has ...
1
vote
1answer
101 views

Additional check for request integrity

I'm building a REST API resource server with JWT authorization for an Angular web app. I'm looking for a method to perform an additional check if the request body sent from the client application has ...
0
votes
1answer
136 views

JWT with a single audience claim accessing a resource server with multiple configured audience values

When a JWT id_token with a single audience is presented to a resource server which has multiple configured audience values, should the resource server reject the validity of the token on the basis of ...
0
votes
1answer
101 views

Why have a refresh_token with an OAuth2 Client Credentials grant type?

Can someone explain to me the purpose of the refresh token when you're using the Client Credentials grant type with OAuth2? I'm confused because you can easily generate a new access token without one, ...
0
votes
2answers
791 views

Should I use TOTP when using OAuth2

I'm implementing TOTP in my application to allow users to use two factor authentication with Google authenticator and the like. However I've also implemented "social login" using OAuth, should the ...
0
votes
1answer
91 views

Where does a scope get defined?

According to RFC 6749 the strings [scopes] are defined by the authorization server. However isn't it really the resource server who defines the scopes? I mean scopes vary from resource server to ...
-1
votes
1answer
101 views

How to secure backend API access?

In the good old days, you made server-side websites using PHP or something like that, now we have modern web apps divided into front-end and back-end (usually API Rest), you can't rely on CORS because ...
0
votes
0answers
22 views

GitLab with api scope and confidentiality unchecked. What are the privacy risks?

I just created a GitLab application to connect it with StackEdit.io. I created it by following the instructions on this GitLab docs page. I had to create the GitLab application with api scope and I ...
0
votes
0answers
33 views

OpenId with Biometrics - should I write a custom login + OIDC

We are trying to arrive at a solution for an enterprise app Different Users have different Authentication Methods User Type 1 - Password + Captcha User type 2 - Biometric [Not device-based] + ...
0
votes
3answers
724 views

JWK with X.509 Certificate - is self signed okay?

I'm working with a client that, in order to use their OAuth 2.0 web API, requires me to provide them with a JSON Web Key (JWK) that contains an embedded X.509 certificate. Then, when I'm requesting ...
3
votes
1answer
1k views

How exactly do mobile apps achieve authorization code flow with PKCE?

Let's imagine the following: I've developed a mobile app using Xamarin (iOS/Android compatible) I want it to support OAuth2 + OpenID connect's authorization code flow with PKCE, so that the user's ...
1
vote
2answers
230 views

Secure API key mechanism for identification

In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using ...
0
votes
0answers
30 views

I have a non-Oauth service and am using this approach with Server initiated HttpOnly cookies with stripped JWT

My question is : Is this approach correct given I have a non-Oauth service? My goal is to use the simplest amount of security features while still being as strong as possible. My approach is as ...
0
votes
0answers
46 views

Modern security flow/process for trusted Mobile and SPA apps with self-hosted OIDC

Currently, there are two common auth flows i know: Resource Owner Password Flow Authentication Code Flow + PKCE (didn't mention other, since this one is more robust within redirect-based) This theme ...
0
votes
0answers
36 views

Wouldn't the OAuth 2.0 client credentials flow be more secure with the option of using refresh tokens?

The OAuth 2.0 specification states that "A refresh token SHOULD NOT be included" in responses to access token requests in the client credentials flow and that, even if they were used, the ...
0
votes
0answers
30 views

Access to JWT session after OAuth redirects

I have a stateless backend app, session data is stored on the front-end in a JWT token, so the front-end app passes this token in Authorization header to all the requests. I need to add 3rd party API ...
0
votes
0answers
79 views

how to avoid Oauth2 timeouts with orchestrator REST API

I have a REST API, which I'll call "R". R uses Oauth2 Bearer tokens for auth. However, R has a fairly complex API, so we're designing a new system called "O" that provides a ...
1
vote
1answer
208 views

Is OAuth 1 less secure than OAuth 2 in an SPA

We are writing a pure javascript front-end (in angular) for an API that still uses OAuth 1 for legacy reasons. Being pure javascript means the consumer secret is part of the code that gets downloaded ...
2
votes
3answers
229 views

OAuth2 - using Id Token for authentication to a backend service

Many resources on the internet state that you should use Access Token and not Id Token to authenticate to an API, but do not provide explicit reasons why. Are there any real drawbacks to use an Id ...
3
votes
1answer
126 views

Protected APIs for public clients without end-user authentication

A simple question which I cannot find any guidance on the RFC6749 (or related) spec. I have an eCommerce public client (SPA & mobile), where I want to postpone as much as possible the ...
1
vote
1answer
141 views

what is the scope of google drive's OAuth credentials?

I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
1
vote
1answer
57 views

Password Based Encryption with Social Login

I have a question about implementing user password-based encryption in a database injunction with the Social Login feature. User private data in my database should be encrypted in order to provide ...
3
votes
1answer
1k views

Token Exchange at a REST API Gateway to federate authentication while maintaining detailed authorization (think ABAC) within the API?

I'm on the verge of creating a service within our resource server that would exchange an externally generated access token for an internally generated access token. However, this feels wrong. I have ...
1
vote
0answers
62 views

Why is PKCE "RECOMMENDED" for authorization codes with confidential clients?

Section 2.1.1 of IETF's OAuth 2.0 Security Best Current Practice begins as follows: Clients MUST prevent injection (replay) of authorization codes into the authorization response by attackers. ...
4
votes
2answers
2k views

IN OAuth 2.0, how is the client secret supposed to be kept secret?

Using most OAuth 2.0 flows, a client application can identify itself to the authorization server by means of a "client id" and "client secret." The OAuth 2 specification says that the client secret ...
0
votes
1answer
119 views

Sharing oauth2 token with AJAX request to be sent to resource server

I am a little confused on how the token is shared from the client to an AJAX script to the resource server in the oauth2 flow. To explain the scenario I am trying to set up, I have a client (http://...
0
votes
1answer
152 views

OpenID Connect with user bound roles and M2M access

I'm trying to get my head straight about how to properly design a OpenID connect provider and the roles to use with it. I understand the basic of scopes, claims and the different flow one can use. ...
0
votes
0answers
19 views

A Native Desktop App using PKCE - Can an id_token be consider valid authentication when passed to another protected server resource?

My understanding is that client impersonation cannot be prevented for Native Desktop Apps. If all standard controls: State, PKCE, Redirect_URI confirmation etc are in place, to prevent auth_code ...
1
vote
2answers
209 views

OAuth authorization code grant with exposed client secret

Let's assume that a client has the client secret exposed somewhere. What are the risks that the client and its users are exposed to? Are those the same as having implemented the implicit flow from ...
0
votes
1answer
76 views

Is there a risk involved in refreshing a JWT token every time you refocus the webpage?

I am currently testing a website that appears to make a refresh token request every time I focus away from the web browser and back, or away from the tab the website is open in and back to it. I've ...
1
vote
1answer
264 views

What are disadvantages of a reverse OTP flow, where OTP is visible on a website and is retyped on authenticated mobile client?

I want to authenticate a user on a 3rd party website (this is more or less an OAuth flow, so this website will be able to perform actions on behalf of my user afterwards, e.g. receive some of her data)...
1
vote
1answer
96 views

What is a pre-warmed secret?

As described here: https://tools.ietf.org/id/draft-ietf-oauth-security-topics-13.html#proposed-countermeasures-2 Note on pre-warmed secrets: An attacker can circumvent the countermeasures described ...
0
votes
0answers
85 views

Openid nonce replay attack in auth code flow

Looking at this question Openid connect nonce replay attack and the answer by @benbotto. I understand the replay attack in implicit flow but unable to understand it for auth code flow. Let's say an ...
0
votes
1answer
1k views

How to store Oauth2 Access Token in a Cookie correctly?

Im working on a small Custom Oauth2 Authorization Server. I want to send the Access Token in a http only Cookie to the client. According to 5.1 of the RFC6749 the token has to be in the entity-body of ...
1
vote
1answer
110 views

OAuth2, SAML, OpenID connect - Which one to use for my scenario?

I work for a company where we give customer (hundreds/thousands of users) access to 2 sites. One owned by a 3rd party SaaS and one owned by us. Customers spend alot of time registering for both sites ...
0
votes
1answer
151 views

App-to-app or service-to-service authentication using federated login

I have an application Foo that exposes a web-based portal as well as a REST API service via HTTPS. When a human user connects to the app Foo to use its web-based portal, the human user is first ...
2
votes
1answer
1k views

OAuth2 for first party web-app

I am building a web (also potentially mobile app) for a platform that allows plugins. We're using the OAuth2 Authorization Code grant type for third-party client plugins. Which, if any, grant type ...
0
votes
1answer
108 views

OpenID Connect with a chain of Relying Parties

Is there a usage of OpenID Connect (OIDC) that allows for a chain of RP (terminology reference) user -> RP#1 user <-redirect to chosen OP- RP#1 user -> OP: verifies identity user <-...
0
votes
2answers
222 views

Which Authentication mechanism to choose for PCI-DSS system

I want to create Angular 9 + Spring Boot application with strong security complaint to PCI-DSS security standard. Which security protocol is preferred for user sessions in order to have high security ...
0
votes
1answer
122 views

OAuth alternative for two-party scenario?

I'm trying to come up with an authentication/authorization system for what seems like a really simple scenario, but as far as I can tell it's virtually unsupported. There are two parties, total; ...
0
votes
0answers
100 views

Is OAuth2.0 Authorization Code Grant flow with PKCE really secure?

CONTEXT There is a SPA that uses Authorization Code Grant flow with PKCE to get info from an API all the info is highly sensitive RESEARCH Here is what I found of how Authorization Code Grant flow ...
0
votes
1answer
437 views

Difference between Form Post Response and Authorization Code

I am trying to find the best OAuth2 mechanism for our VueJS Single Page Application (SPA) hosted on our own backend. From my research, Authorization Code should be sufficient, as long as the redirect ...
0
votes
1answer
74 views

Risks associated with a compromised external Security token server

Consider the following architecture: An on premise Web API 2 [Written in C# hosted in IIS] which uses OAuth 2 authentication [ Implicit Flow ] to secure itself. This API acts as the data source by ...
1
vote
0answers
52 views

Authorise access to hierarchical data

Consider a scenario in which you offer service access based on a hierarchy of authority. i.e., a HEAD can register his subordinates. The authenticated HEAD has the previledge to read and update data ...
0
votes
0answers
51 views

Strategies for segregating anonymous and secure access to APIs

Traditionally, we used either path-based access control or a separate DNS for public and private content segregation. In the modern era of standard-based auth, what are the best auth strategies for ...
0
votes
1answer
315 views

May I use OAuth2 for non third-party applications?

I need some help to understand my problem. I'm studying a way to provide authentication for my applications. My scenario: I've a set of APIs with restricted access and users that will be ...
0
votes
1answer
1k views

Secure authentication on SPA/Javascript application with “remember me” support

I have 3 website projects as follows; identity.example.com (asp.netcore + IdentityServer4) api.example.com (asp.netcore webapi) www.example.com (asp.netcore + aurelia) I am able to authenticate the ...

1
2 3 4 5
8