Questions tagged [oauth2]

OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0

Filter by
Sorted by
Tagged with
2
votes
1answer
68 views

Where to store refresh token if not in local storage?

In general it's recommended not to store refresh tokens in local storage. The Auth0 documentation advises against it. Even though I am aware of the underlying threats, what I am not aware is if there ...
0
votes
1answer
36 views

Is it safe to use third party OIDC ID Token as our APIs bearer token?

Practically, we are outsourcing the authentication of our users to a third party application, that's, needless to say, external to our system. I am not sure if this is actually advisable, but from our ...
0
votes
0answers
29 views

PKCE vs Dynamic Client Registration for public clients

The RFC recommends to use PKCE for web (public client)/native apps. It's not stated that Dynamic Client Registration (DCR) is bad but it's not stated as an alternative either. I am wondering if there ...
1
vote
2answers
109 views

Secure API key mechanism for identification

In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using ...
0
votes
0answers
52 views

Authorization Code Grant Flow for web-app with backend on separate domain (same origin)

We have had a security consultant make a recommendantion of an approach that does not follow the IEFF best-practice document (https://tools.ietf.org/html/draft-ietf-oauth-browser-based-apps-04#section-...
0
votes
2answers
67 views

Handling of 3rd party OAuth2 tokens

after some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd ...
2
votes
1answer
57 views

Isn't Facebook Apptoken Oauth2 client credential unsecure since it sends login credentials request in GET URL?

Facebook Apptoken uses OAuth2 client credential code. But the client_id and client_secret are sent to the servier via HTTP GET method. Isn't this unsecure ? For instance, any node that has logging ...
1
vote
1answer
59 views

Netflix logout does not revoke secure netflix ids

I am learning about microservice security and I wanted to see if Netflix really logs me out. While logged into Netflix, I opened https://www.netflix.com/YourAccount and in inspector viewed headers I ...
0
votes
0answers
40 views

When should refresh tokens be stored in a database?

I have a native Windows application programmed in .NET Core that needs to call a Web API. I intend to have the user enter credentials periodically, receiving a refresh token from my auth server for ...
1
vote
2answers
52 views

Revoke OAuth2 Token For Mobile App

When a user logs into my mobile app it uses OAuth to authenticate them and generates a token. The token is then checked against each subsequent request. Each user account in my application has an ...
117
votes
6answers
84k views

Why use OpenID Connect instead of plain OAuth2?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...
1
vote
3answers
121 views

Is it wise to completely rely OAuth2 for new users and not have our own login(with username and password) system

My question is: Is it fine to build applications where the user login is completely handled by OAuth2 and services like that. That way we do not have to have our own password database for the users. ...
0
votes
1answer
45 views

Combining User Context in Machine-2-Machine OAuth2 Client Credential Flow

I have a REST API that is used by 2 separate application and is authenticating them by M2M OAuth2 Client Credential Flow. One of the two application is an automation service without user context. The ...
0
votes
1answer
43 views

JWT with a single audience claim accessing a resource server with multiple configured audience values

When a JWT id_token with a single audience is presented to a resource server which has multiple configured audience values, should the resource server reject the validity of the token on the basis of ...
1
vote
1answer
131 views

Auth code grant /w PKCE for SPAs

I'm a security newb trying to find out how to secure my SPAs, and am totally lost in the forest of RFCs, BCPs, drafts and blog posts. If possible, I'd like to serve my SPAs statically from a cdn. At ...
0
votes
3answers
99 views

Logging access tokens

In our REST API we write a log entry for every call made, including things like the query string, response code, duration etc... along with a SHA256 hash of the access token used. The thought process ...
0
votes
1answer
35 views

What Is The Mechanism To Refresh Access Token

In RFC 6749 Section 4.4 regarding Client Credentials Grant: 4.4. Client Credentials Grant The client can request an access token using only its client credentials (or other supported means of ...
0
votes
1answer
428 views

Should I use TOTP when using OAuth2

I'm implementing TOTP in my application to allow users to use two factor authentication with Google authenticator and the like. However I've also implemented "social login" using OAuth, should the ...
0
votes
0answers
38 views

Are browsers vulnerable to Authorization Code Interception Attacks?

RFC7636 states "The operating systems must allow a custom URI scheme to be registered by multiple applications." Are web apps vulnerable to this attack? Could a web app link open a malicious app via a ...
1
vote
1answer
91 views

what is the scope of google drive's OAuth credentials?

I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
9
votes
1answer
548 views

FB Oauth CSRF security, PHP website

I am experimenting with third party login, using Twitter and Facebook. After getting access token from these parties, and confirming its validity, I then issue my own JWT token that's used within my ...
0
votes
0answers
75 views

In memory local variables (javascript), OAuth token storage, and XSS

Quoting from a long-dead Auth0 forum post: https://community.auth0.com/t/why-is-storing-tokens-in-memory-recommended/17742 "Any values stored in memory are still vulnerable to XSS attacks since ...
0
votes
1answer
86 views

OpenID Connect with Authorization code flow and PKCE - How shoud we get a new access token in a SPA application?

As answered in this question, Single Page Applications shouldn't be given a refresh token with the OIDC Authorization Code Flow. Can you indicate some way of getting a new access token when it ...
2
votes
1answer
212 views

Why is there a redirect to the native app in PKCE?

Why even have a redirect or even use the browser? Wouldn't just a normal TLS/HTTPS request/response in the app protect the requests and token? The one argument I have heard against solely relying on ...
0
votes
1answer
55 views

OAuth provider that authenticates only by phone? [closed]

I'm trying to find an OAuth provider that doesn't require a password but instead, it authenticates the user by sending a message to a phone number. I'm thinking that it would be using the phone the ...
0
votes
0answers
37 views

May I use OAuth2 for non third-party applications?

I need some help to understand my problem. I'm studying a way to provide authentication for my applications. My scenario: I've a set of APIs with restricted access and users that will be ...
2
votes
1answer
160 views

Can we prevent DDoS or spam form submission with client authentication?

There is a public query form in my web app, and architecture team asking to authenticate the web app with OAuth2 like this, but I don't believe it will be of any help. I believe best way to protect ...
1
vote
2answers
74 views

What is the purpose of the OAuth2 client secret?

A typical OAuth2 Authorization Code Flow scenario looks like this: What I'm not understanding is the purpose of the client secret in steps 6 and 7. If the auth server is guaranteed to redirect back ...
2
votes
1answer
177 views

OAuth2: Where should I store my refresh token in a stateless application?

In my current architecture I have an authentication server which provides a JWT token via OpenID Connect to any web application that uses the code flow I implemented. I went to the hassle of ...
0
votes
1answer
68 views

How to store Oauth2 Access Token in a Cookie correctly?

Im working on a small Custom Oauth2 Authorization Server. I want to send the Access Token in a http only Cookie to the client. According to 5.1 of the RFC6749 the token has to be in the entity-body of ...
8
votes
2answers
406 views

Using third party authentication like google/facebook to login to a site, is there any security risk when the site is hacked?

Sites like stackoverflow, quora, and many more offers sign in from Google/Facebook. In the event that there is a data breach or the site is hacked, is there any security risk to your Google/Facebook ...
0
votes
1answer
51 views

Differentiating Between First and Third Party Clients

I would like to know how auth services, such as OpenID Connect and OAuth, are able to distinguish between a first party application over a third party one - in particular for clients such as mobile ...
2
votes
1answer
143 views

OAuth2 for first party web-app

I am building a web (also potentially mobile app) for a platform that allows plugins. We're using the OAuth2 Authorization Code grant type for third-party client plugins. Which, if any, grant type ...
3
votes
1answer
228 views

Is there any way for server side to verify the application integrity during OAuth2 workflow

During OAuth2 PKCE workflow, the native application (installed on Android/iOS device) issues the authorize request to server and exchange the OAuthtokens. For server side, is there any way that we ...
0
votes
3answers
226 views

What's the concrete case for code flow being more secure than implicit flow?

It's seeming like the extra loop via the client backend in code flow only adds obscurity - not security. If, in the end, the client backend dishes out the same access token to the front end as the ...
0
votes
0answers
25 views

OAuth native app without localhost redirect

Section 4.1 of RFC 8252 describes the OAuth authorization flow for native apps using the browser (i.e., external user-agent). In this flow, the native app receives the authorization code in step 4 by ...
0
votes
0answers
33 views

OAuth2 sent access token to server side after login

I am building an Ionic application that needs to have login buttons with major social sites and merge those accounts if that's the case (email or phone match). My concern is that by using the access ...
1
vote
1answer
160 views

Does OAuth 2 increase the risk for clients to expose their “client_secret”

Upon doing a bit of research about the OAuth protocol, I find it hard to avoid the glaring criticism of the OAuth 2 standard, and its supposedly inferior security. An answer on stackoverflow suggests,...
3
votes
1answer
87 views

How exactly do mobile apps achieve authorization code flow with PKCE?

Let's imagine the following: I've developed a mobile app using Xamarin (iOS/Android compatible) I want it to support OAuth2 + OpenID connect's authorization code flow with PKCE, so that the user's ...
33
votes
3answers
14k views

Why isn't PKCE encouraged for Single-Page Apps?

A lot of services today still recommend the implicit flow for an OpenID Connect/Oauth2 token exchange when developing Single-Page Apps. (See Okta - now recommends PKCE w/ implicit fallback, Google, ...
2
votes
1answer
86 views

What is the purpose of the authorization code in OAuth 2? [duplicate]

Why do we need to ask the authorization server for theAuthorization code and then exchange the Authorization code for anAccess token on the same server? Why not to return anAccess token directly, ...
0
votes
0answers
42 views

How come RFC7636 (PKCE) stops malicous app doing the same code challenge and get legitimate access to API

As per the RFC7636 it stops malicious apps which pretend to be legitimate apps, gaining access to OAuth2.0 protected API's. The flow suggests a method of having a runtime level secret which generated ...
1
vote
1answer
63 views

Where to store pydrive secret?

Backstory: been toying with the idea of setting up some raspberry pi cctv cameras. originally I was going to store all footage for 31 days (complying with DPA) on a network drive but decided against ...
1
vote
2answers
81 views

How to report error if redirect_uri doesn't match?

How should the auth server (IDP) report the error if the authorisation request redirect_uri doesn't match the configured redirect_uri for the given client? Let's consider concrete example: auth.com ...
1
vote
1answer
1k views

OpenID Connect: Is storing access token in browser secure?

I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
0
votes
0answers
25 views

Is the vulnerability described in rfc6749 10.16 for implicit Flow is comparable to “man in the middle”?

I'm trying to understand if the vulnerability described in the specification for implicit flow : link is the same principle of a man in the middle attack. From what I understood, the malicious client ...
3
votes
0answers
64 views

Can Chrome Extensions steal OAuth tokens from redirect-uri? [duplicate]

This is a duplicate of a stack overflow question, since it might apply more to security and authentication best practices. I'm working on auth between a Chrome Extension, Google Cloud Platform, and ...
0
votes
1answer
895 views

Secure authentication on SPA/Javascript application with “remember me” support

I have 3 website projects as follows; identity.example.com (asp.netcore + IdentityServer4) api.example.com (asp.netcore webapi) www.example.com (asp.netcore + aurelia) I am able to authenticate the ...
6
votes
1answer
201 views

Authorize transitive communication between applications on behalf of the user

I'm trying to wrap my head around to following web security question for a while now. Say we have a system set up as depicted in the picture below. There is one main application with which the user ...
1
vote
3answers
90 views

In OAuth2, is it acceptable not to use https for internal communication between resource server and authorization server?

I have a resource server (REST API) and an authorization server which are installed on the same server and behind a reverse proxy. All incoming external requests use https. Would it be acceptable not ...

1
2 3 4 5 6