Questions tagged [oauth2]

OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0

Filter by
Sorted by
Tagged with
117
votes
6answers
84k views

Why use OpenID Connect instead of plain OAuth2?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...
33
votes
3answers
14k views

Why isn't PKCE encouraged for Single-Page Apps?

A lot of services today still recommend the implicit flow for an OpenID Connect/Oauth2 token exchange when developing Single-Page Apps. (See Okta - now recommends PKCE w/ implicit fallback, Google, ...
30
votes
2answers
6k views

What is PKCE actually protecting?

I'm trying to get my head around how PKCE works in a mobile app and there's something I don't quite understand. So from what I can gather the client app creates a random cryptographically secure ...
24
votes
1answer
17k views

What are the differences between JSON Web Tokens, SAML and OAuth 2?

What are the differences between JSON Web Tokens, SAML and OAuth 2. Please provide some pointers and high level overview of their functions. Specifically, why would one use SAML over JSON Web Tokens ...
17
votes
1answer
1k views

How to verify Google sign-in screen is legit? (Linux Desktop) [duplicate]

I've installed an Electron app "Google Play Music Desktop Player" which presents a Google login screen: This is in a standalone window with no URL displayed. Although I have no reason not to trust ...
14
votes
3answers
8k views

Oauth2 vs APIKey in a server to server communication

A third party service provider is exposing a payment API that we need to integrate on our backend. As transport communication we will consume this API using TLS with Client Certificate and over a MPLS ...
13
votes
10answers
8k views

Spoofing POST/GET requests in a RESTful service

I started working on an app that connects to a RESTful service for authentication and data. User POSTs the user name and password to /token endpoint. Once they log in successfully, they get a bearer ...
9
votes
1answer
5k views

Is CORS ever needed during any aspect of OAuth / OpenIDConnect Authentication?

I'm looking at OpenIDConnect authentication and trying to determine if either "simple CORS" or "complex CORS" is ever leveraged during authentication or authorization. Background A Simple CORS (...
9
votes
1answer
549 views

FB Oauth CSRF security, PHP website

I am experimenting with third party login, using Twitter and Facebook. After getting access token from these parties, and confirming its validity, I then issue my own JWT token that's used within my ...
8
votes
2answers
9k views

What is the difference between API keys and API tokens usages?

From all the research that I have done, I have found that API keys are less secure than access tokens (under usage of oAuth), and should only be used for monitoring purposes. But from what I ...
8
votes
2answers
408 views

Using third party authentication like google/facebook to login to a site, is there any security risk when the site is hacked?

Sites like stackoverflow, quora, and many more offers sign in from Google/Facebook. In the event that there is a data breach or the site is hacked, is there any security risk to your Google/Facebook ...
7
votes
1answer
3k views

Do I need CSRF protection in this setup with a REST API backed with oauth2 and a basic auth SSO auth server?

I've seen the answer Is CSRF possible if I don't even use cookies? but there are 2 conflicting answers and the question itself doesn't provide that much information either. I am creating a REST ...
7
votes
3answers
308 views

Non Confidential OAuth2 flow

I've been going through some documents regarding OAuth2 confidential and non-confidential authorisation flows, namely this and the RFC. From my understanding, the non-confidential flow does not ...
7
votes
2answers
799 views

Is it safe for users of my API to 'Sign In With GitHub' using passport-github?

I understand that OAuth2 was designed to delegate authorization grants to specific resources, it alone is not an authentication protocol. However, the passport-github README states, This module ...
6
votes
1answer
764 views

Can oauth2 “state” parameter be used to avoid using session cookies to identify user

https://tools.ietf.org/html/rfc6749#section-4.1.1 states: 4.1.1. Authorization Request" "state" RECOMMENDED. An opaque value used by the client to maintain state between the ...
6
votes
1answer
201 views

Authorize transitive communication between applications on behalf of the user

I'm trying to wrap my head around to following web security question for a while now. Say we have a system set up as depicted in the picture below. There is one main application with which the user ...
6
votes
1answer
3k views

Is it safe to store the state parameter value in cookie?

As per https://tools.ietf.org/html/rfc6749#section-10.12: The client MUST implement CSRF protection for its redirection URI. This is typically accomplished by requiring any request sent to the ...
6
votes
0answers
1k views

Using the authorization code grant without using cookies?

I've been reading up on this for months and it seems like the whole thing could converge on what I'm summarizing below. I'm trying to arrive at the most ideal: OAuth2 OpenID Connect SPA / Mobile ...
5
votes
3answers
9k views

Why is OAuth2/OpenID Connect considered less secure than SAML/WS-*?

The prevailing notion seems to be that OAuth2 and OpenID Connect are considered less secure than SAML/WS-Federation. From what I gather, it comes down to encryption - i.e. the fact that OAuth2/Open ID ...
5
votes
1answer
820 views

How to get better IAM understanding

I'm getting interested in Identity and Access Management (IAM), but I find it hard to find complete and understandable explanations that suit me, surely because I started wrong. I began with ...
5
votes
1answer
940 views

Why does oAuth and oAuth 2 have access tokens at all?

I am trying to implement a system for third-party apps to access data that a user stores on a provider. We have a robust access control system, with separate read/write/etc. levels for each "stream" ...
5
votes
2answers
5k views

Why is a wildcard-subdomain callback URL in OAuth considered unsafe?

In this post: http://technotes.iangreenleaf.com/posts/closing-another-nasty-security-hole-in-oauth.html Enter your full callback URL(s) in this field. This means you should be providing the ...
5
votes
2answers
2k views

Is there any security difference between login via iFrame, Pop-up, or redirect?

There seems to be a number of techniques to authenticate a person on the web. Most commonly there are Javascript Pop-ups (Google, Firefox Persona, Disqus, etc) HTTP Redirects (OAuth, Facebook) ...
5
votes
1answer
2k views

OAuth Token Translation (Opaque to JWT)

I've seen couple of talks which suggested usage of OAuth token translation at the API gateway from opaque token to JWT token. What are the advantages and disadvantages of this approach, who should use ...
5
votes
2answers
2k views

How do I correctly use CORS with OpenID Connect?

There seems to be a number of questions on several blogs, Q&A sites, and comments that ask variants of the question: How do I correctly use CORS with OpenID Connect? The context of these ...
5
votes
1answer
459 views

Need of scope in OAuth Client Credentials Flow

For me, Client Credential flow is like client is asking access token for itself - not on behalf of some user. Then, why would client like to limit its own scope? What is the benefit of scopes in ...
5
votes
1answer
229 views

Can websites detect if visitors are logged in to mainstream ID providers and collect their IDs?

Logging in to websites using mainstream IDs (Google/Facebook/Github etc.) by means of OAuth (or similar) has nowadays become a feature that people expect. Not that long ago the corresponding user ...
5
votes
1answer
812 views

Securely Storing Access Tokens for Azure Key Vault

I am using Azure's KEY vault to store encryption keys and handle encryption and decryption as we have a specification that requires encryption keys to be kept offsite, however this has left me with ...
5
votes
0answers
67 views

Poor Man's OAuth Grant - Review

A 3rd party company has requested that we implement single sign-on with them using the below approach. I'm familiar with OAuth grants and OIDC flows but this seems rather odd to me. The user has ...
5
votes
0answers
46 views

Is there a good way to store OAuth2 tokens for a native application?

Currently I have a native PC application that builds and uploads a configuration to an embedded Linux device (i.e. the client). This device connects to Google Calendar via their OAuth2 API. The ...
5
votes
2answers
887 views

Is it ok to write OidC Bearer token to log?

During development we added to error logs details of http requests, including headers, to have better understanding for error investigation. Our architect pointed that we should not place sensitive ...
4
votes
3answers
285 views

Distribute Program with Sheets API Credentials

I am trying to write a program that uses the Google Sheets API to read spreadsheets and operate on the data. My program contains a credentials.json file which I obtained from the Java Quickstart page ...
4
votes
2answers
3k views

Fine grained authorization with OAuth2

In my understanding of OAuth2 the scope may be used to specify access to what is asked and granted by code owner. In most cases I encounters the scope list is closed and specify "kinds" of thing ...
4
votes
1answer
565 views

Is using OAuth2 services like Google or Facebook Single Sign-On a privacy concern?

With all the coverage of Cambridge Analytica scandal, it seems like this wasn't a data breach or hack, it was just that Cambridge Analytica did not properly disclose how they would use the data. Is ...
4
votes
1answer
4k views

How to use Oauth2 and JWT to secure microservice architecture?

We have been investigating proper mechanism to secure microservises that we are going to provide as API endpoints via API manager application. Fundamentally we need stateless security mechanism like ...
4
votes
1answer
1k views

Securing a multi-tenant API with SSO and different roles per tenant

I am working on developing a REST API that will be used by first party clients that we develop, and third party clients in the future. The first party clients include a SPA client side application, ...
4
votes
1answer
82 views

Does the browser get the access_token in OAuth2?

I've spent more than 10 days trying to understand the Authorization Code Flow for a web application where I'm supposed to implement OpenID Connect for a single sign on. It feels that there is a lot of ...
4
votes
1answer
50 views

Do websites grant their own JWT token after successful OpenID/OAuth2 login?

I am looking at implementing an Authorization Code with PKCE grant on a mobile app to communicate to an API. What I am curious about is what applications currently do with the OpenID token that is ...
4
votes
1answer
478 views

Using a gmail oath2 token to access web email

I forgot my password to an old gmail account. I have tried the regular route of going through gmail password recovery: answering questions, it keeps looping back to the questions, so I think I'm ...
4
votes
0answers
57 views

Architecting a solution with native login and 3rd party login via OAuth/OpenID Connect using dotnet core

I am building an API driven application that will have a native login with username and password, and will also need to grant 3rd party access via OAuth/OpenID Connect in the near future. A pattern I ...
3
votes
2answers
502 views

Why are passwords sent unhashed by most modern websites? [duplicate]

I've been investigating various protocols used to send usernames and passwords to web servers in order to authenticate, and while obviously all of them these days use SSL/TLS, I was a bit surprised to ...
3
votes
4answers
1k views

How can a OAuth2 resource server relate an access token to the user that authorized it to prevent unauthorized access to other user resources?

I'd appreciate if someone could clear up if, according to the OAuth2 RFC, the resource server could infer the user associated to an access token or not, or even if that is expected. Let’s assume the ...
3
votes
1answer
75 views

How does security work in a cloud-to-cloud backup scenario?

I'm thinking of using Spinbackup which is a cloud-to-cloud backup of gmail, but I was resistant to the idea of telling Spinbackup my gmail password for obvious reasons. However, on the Spinbackup ...
3
votes
1answer
2k views

Dangers of passing Oauth 2.0 client id and client secret in the request uri

I was reading here that when passing a client_id and client_secret to an authorization server, The parameters can only be transmitted in the request-body and MUST NOT be included in the ...
3
votes
1answer
89 views

How exactly do mobile apps achieve authorization code flow with PKCE?

Let's imagine the following: I've developed a mobile app using Xamarin (iOS/Android compatible) I want it to support OAuth2 + OpenID connect's authorization code flow with PKCE, so that the user's ...
3
votes
1answer
2k views

How to prevent refreshing a stolen access token

The scenario is: you have refresh token that is valid for a longer period of time and an access token that is valid for a shorter period of time. The setup: There is a client, application server and ...
3
votes
1answer
2k views

How to handle OAuth2 registration where email address already exists as user account?

I'm building an OAuth2 workflow that spans website and mobile apps. I need to know if the following workflow is secure, where an OAuth2 registration is completed, but it is then found that the email ...
3
votes
1answer
2k views

OAuth2 Implicit Flow: Possible Attack Vectors of Refreshing Token via CORS?

We are currently implementing a Single Page Application (Angular2) and thus have run into the standard "how do we secure our backend API" problem. The standard solution to this apparently to use the ...
3
votes
2answers
196 views

Why does OAuth 2.0 RFC6749 disallow fragments in redirect URI?

I wasn't able to find a similar question explaining the considerations of the RFC6749 specification when it comes to redirecting the user from the authorization server to the client. In the RFC ...
3
votes
2answers
537 views

Why do we use Oauth2 instead of Basic Auth in server to server communication using SSL?

Why do some API providers ask you to implement Oauth2 in server to server communication that's available only over HTTPS? In the frontend (app or webapp), Oauth2 is useful to protect the user ...

1
2 3 4 5 6