Questions tagged [oauth2]

OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0

Filter by
Sorted by
Tagged with
0
votes
2answers
222 views

Which Authentication mechanism to choose for PCI-DSS system

I want to create Angular 9 + Spring Boot application with strong security complaint to PCI-DSS security standard. Which security protocol is preferred for user sessions in order to have high security ...
0
votes
2answers
142 views

OAuth2 - Authorization Code Flow - Do I really Need this for simple login/authentication?

I have been reading a lot about OAuth 2 flow recently, and I wanted to ask if this is applicable to the app that I am building, and what type of security I should be using. Context We have a native ...
1
vote
1answer
197 views

Can OpenID Connect be used to implement social login?

Using OAuth to implement social login is insecure (https://www.rfc-editor.org/rfc/rfc6819#section-4.4.2.6) because OAuth doesn't provide authentication, only authorisation. The issue arises because ...
1
vote
1answer
109 views

how does spotify do oauth(+open id connect) from the desktop app?

I understand what the workflow would be from the webpage, but how does oauth+open id work for desktop apps as they cannot open a browser page within the app. I see that when I click on log in with ...
1
vote
2answers
209 views

OAuth authorization code grant with exposed client secret

Let's assume that a client has the client secret exposed somewhere. What are the risks that the client and its users are exposed to? Are those the same as having implemented the implicit flow from ...
1
vote
1answer
264 views

What are disadvantages of a reverse OTP flow, where OTP is visible on a website and is retyped on authenticated mobile client?

I want to authenticate a user on a 3rd party website (this is more or less an OAuth flow, so this website will be able to perform actions on behalf of my user afterwards, e.g. receive some of her data)...
2
votes
2answers
188 views

Where should 'reset password' functionality be?

We've recently overhauled the backend to our mobile app from having a very basic authentication mechanism that went through the API to having both an authentication server and an API server, with the ...
1
vote
0answers
31 views

Is an "inversed" Device Authorization Grant flow secure for authenticating a daemon/service native app to a web server?

I am working on a hobby project which will involve a web server (hosted and owned by me) and a native app (which will communicate with the web server periodically) an end-user can install via a deb/...
0
votes
2answers
201 views

What are the security risks with rolling out your own Authorisation server implementation

Even though I'm working within .Net Core, this question is generally applicable to other platforms as well. My question is to do with: Using a framework (such as IdentityServer) to manage ...
0
votes
1answer
110 views

Why does Authorization Code flow need the authorization code?

I've implemented Auth Code flow with PKCE on my server, but I'm still not entirely clear on why I'm doing it. I've read through the IETF documentation and I get flashes of what seems like ...
0
votes
1answer
55 views

Authorisation Request & Authorisation Grant In OAuth 2.0

I do not grasp the concept of the first steps in the OAuth process: Authorisation Request and Authorisation Grant. As far as I know: User wants to access client by authorizing Service API User clicks ...
1
vote
1answer
292 views

Custom OAuth2 Authorization Server / Identity Provider

I am currently trying to implement my own Authorization Server following the OAuth2 protocol PKCE flow, coupled with my own Identity Provider. The idea is to be able to reuse the same identity ...
4
votes
1answer
132 views

Exploitation of client_id in OAuth

We have a web app where the back end is composed of APIs. We use OAuth to authorize the web app's call to the APIs. We all know that in OAuth, there is always the Authorization endpoint used to get ...
0
votes
1answer
61 views

'confirm old password' OAuth equivalent

I want to allow users to link/unlink several OAuth providers to their account. How can I mitigate 'office prank' attacks, when someone can access my computer while I am away? My account: OAuth with ...
0
votes
1answer
83 views

Does OAuth2 state parameter need to be cryptographically secure?

In OAuth2, as part of the authorization request, we generate a random string and pass it with the state parameter, so that when we get the response, we can ascertain that the response is a result of ...
2
votes
0answers
234 views

Does my app need authentication in addition to Spotify authorization?

I have an app that revolves entirely around Spotify. I have followed the authorization guide from Spotify and am using the Authorization Code Flow so the access token can be refreshed. My thinking was ...
0
votes
0answers
58 views

openID connect without resource owner authorization

the use case I have is, there are multiple systems that access each other over the internet, all sharing the same user base. openId connect seems to be the way of identity management. this means every ...
2
votes
0answers
1k views

Is it correct to use AWS Cognito groups as user roles?

I trying to implement authN/authZ for my application using Spring Security 5.2.2 and OAuth2/openid connect protocols. I use AWS Cognito as an identity provider and I'm trying to implement role-based ...
2
votes
1answer
357 views

Using the user's password hash as their refresh token (with the password hash in their JWT)?

I'm building an authentication system that I want to be secure. I plan on using JWT tokens as the main authentication mechanism. When the token expires, the server will return a "401 unauthorized" ...
0
votes
1answer
437 views

Difference between Form Post Response and Authorization Code

I am trying to find the best OAuth2 mechanism for our VueJS Single Page Application (SPA) hosted on our own backend. From my research, Authorization Code should be sufficient, as long as the redirect ...
0
votes
1answer
74 views

Risks associated with a compromised external Security token server

Consider the following architecture: An on premise Web API 2 [Written in C# hosted in IIS] which uses OAuth 2 authentication [ Implicit Flow ] to secure itself. This API acts as the data source by ...
2
votes
1answer
142 views

OIDC/OAuth2 id_token and it's usage in the client application

I've recently migrated my application to use external provider for login so that my application doesn't have to deal with auth and storing user credentials. For this I'm using OpenID Connect (OIDC) ...
0
votes
1answer
166 views

Assuming I own the client. Is it acceptable to embed my authorization servers login page in an iframe?

We have an authorization server which exposes a login page, we would like to authenticate users in our single page app using this authorization server. My employer does not want to redirect users to ...
1
vote
1answer
230 views

Is it safe to use third party OIDC ID Token as our APIs bearer token?

Practically, we are outsourcing the authentication of our users to a third party application, that's, needless to say, external to our system. I am not sure if this is actually advisable, but from our ...
5
votes
1answer
3k views

Where to store refresh token if not in local storage?

In general it's recommended not to store refresh tokens in local storage. The Auth0 documentation advises against it. Even though I am aware of the underlying threats, what I am not aware is if there ...
2
votes
1answer
90 views

Isn't Facebook Apptoken Oauth2 client credential unsecure since it sends login credentials request in GET URL?

Facebook Apptoken uses OAuth2 client credential code. But the client_id and client_secret are sent to the servier via HTTP GET method. Isn't this unsecure ? For instance, any node that has logging ...
1
vote
1answer
94 views

Netflix logout does not revoke secure netflix ids

I am learning about microservice security and I wanted to see if Netflix really logs me out. While logged into Netflix, I opened https://www.netflix.com/YourAccount and in inspector viewed headers I ...
0
votes
1answer
189 views

Combining User Context in Machine-2-Machine OAuth2 Client Credential Flow

I have a REST API that is used by 2 separate application and is authenticating them by M2M OAuth2 Client Credential Flow. One of the two application is an automation service without user context. The ...
0
votes
1answer
51 views

What Is The Mechanism To Refresh Access Token

In RFC 6749 Section 4.4 regarding Client Credentials Grant: 4.4. Client Credentials Grant The client can request an access token using only its client credentials (or other supported means of ...
3
votes
4answers
1k views

Logging access tokens

In our REST API we write a log entry for every call made, including things like the query string, response code, duration etc... along with a SHA256 hash of the access token used. The thought process ...
0
votes
0answers
61 views

Are browsers vulnerable to Authorization Code Interception Attacks?

RFC7636 states "The operating systems must allow a custom URI scheme to be registered by multiple applications." Are web apps vulnerable to this attack? Could a web app link open a malicious ...
0
votes
1answer
136 views

JWT with a single audience claim accessing a resource server with multiple configured audience values

When a JWT id_token with a single audience is presented to a resource server which has multiple configured audience values, should the resource server reject the validity of the token on the basis of ...
3
votes
0answers
725 views

In memory local variables (javascript), OAuth token storage, and XSS

Quoting from a long-dead Auth0 forum post: https://community.auth0.com/t/why-is-storing-tokens-in-memory-recommended/17742 "Any values stored in memory are still vulnerable to XSS attacks since ...
1
vote
2answers
186 views

Handling of 3rd party OAuth2 tokens

after some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd ...
0
votes
1answer
73 views

OAuth provider that authenticates only by phone? [closed]

I'm trying to find an OAuth provider that doesn't require a password but instead, it authenticates the user by sending a message to a phone number. I'm thinking that it would be using the phone the ...
0
votes
1answer
315 views

May I use OAuth2 for non third-party applications?

I need some help to understand my problem. I'm studying a way to provide authentication for my applications. My scenario: I've a set of APIs with restricted access and users that will be ...
1
vote
2answers
619 views

What is the purpose of the OAuth2 client secret?

A typical OAuth2 Authorization Code Flow scenario looks like this: What I'm not understanding is the purpose of the client secret in steps 6 and 7. If the auth server is guaranteed to redirect back ...
2
votes
1answer
704 views

Can we prevent DDoS or spam form submission with client authentication?

There is a public query form in my web app, and architecture team asking to authenticate the web app with OAuth2 like this, but I don't believe it will be of any help. I believe best way to protect ...
4
votes
2answers
761 views

Auth code grant /w PKCE for SPAs

I'm a security newb trying to find out how to secure my SPAs, and am totally lost in the forest of RFCs, BCPs, drafts and blog posts. If possible, I'd like to serve my SPAs statically from a cdn. At ...
0
votes
1answer
98 views

Differentiating Between First and Third Party Clients

I would like to know how auth services, such as OpenID Connect and OAuth, are able to distinguish between a first party application over a third party one - in particular for clients such as mobile ...
3
votes
1answer
2k views

OAuth2: Where should I store my refresh token in a stateless application?

In my current architecture I have an authentication server which provides a JWT token via OpenID Connect to any web application that uses the code flow I implemented. I went to the hassle of ...
1
vote
1answer
473 views

Does OAuth 2 increase the risk for clients to expose their "client_secret"

Upon doing a bit of research about the OAuth protocol, I find it hard to avoid the glaring criticism of the OAuth 2 standard, and its supposedly inferior security. An answer on stackoverflow suggests,...
2
votes
1answer
188 views

What is the purpose of the authorization code in OAuth 2? [duplicate]

Why do we need to ask the authorization server for theAuthorization code and then exchange the Authorization code for anAccess token on the same server? Why not to return anAccess token directly, ...
1
vote
1answer
271 views

Where to store pydrive secret?

Backstory: been toying with the idea of setting up some raspberry pi cctv cameras. originally I was going to store all footage for 31 days (complying with DPA) on a network drive but decided against ...
3
votes
0answers
82 views

Can Chrome Extensions steal OAuth tokens from redirect-uri? [duplicate]

This is a duplicate of a stack overflow question, since it might apply more to security and authentication best practices. I'm working on auth between a Chrome Extension, Google Cloud Platform, and ...
2
votes
1answer
1k views

OAuth2 for first party web-app

I am building a web (also potentially mobile app) for a platform that allows plugins. We're using the OAuth2 Authorization Code grant type for third-party client plugins. Which, if any, grant type ...
0
votes
1answer
234 views

OpenID Connect with Authorization code flow and PKCE - How shoud we get a new access token in a SPA application?

As answered in this question, Single Page Applications shouldn't be given a refresh token with the OIDC Authorization Code Flow. Can you indicate some way of getting a new access token when it ...
0
votes
1answer
167 views

oidc authentication webapp REST api

So I have looked at the following client library, implementing the OpenID Connect spec: https://github.com/IdentityModel/oidc-client-js It works as expected, and I can now allow users to login with ...
3
votes
1answer
192 views

Is it necessary to protect the Oauth2 return URL

I am thinking to implement a REST service that needs to call another REST service that is protected by OAuth2. My service is "always" called server to server by web applications. The user interacts ...
3
votes
1answer
1k views

How exactly do mobile apps achieve authorization code flow with PKCE?

Let's imagine the following: I've developed a mobile app using Xamarin (iOS/Android compatible) I want it to support OAuth2 + OpenID connect's authorization code flow with PKCE, so that the user's ...

1 2
3
4 5
8