Questions tagged [oauth2]
OAuth2 is the industry-standard protocol for access delegation, commonly used to grant applications access to user information on other applications without giving them the passwords. Not backward compatible with OAuth 1.0
436
questions
2
votes
1
answer
1k
views
Using Cognito access token to pass claims
I am working on migrating all our users from our DB to a managed service, and we're considering AWS Cognito.
We want to use Cognito for Authentication and Access Control.
For access control, we're ...
- 171
2
votes
1
answer
114
views
OAuth2 - Obtaining Refresh Tokens
Given a valid access token alone (you don't know username+password), should you be able to get a refresh token?
- 119
2
votes
1
answer
1k
views
How to implement magic link sign in with oAuth2
We have two web applications. One is developed in Django, let's call it portal (oAuth2 provider). Another is developed in PHP, let's call it client.
We want to display a link for authenticated users ...
- 123
2
votes
1
answer
149
views
What is the proper flow for authentication?
I'm tasked with migrating a group of .Net WebForms applications from a current custom username/password login scheme to an oauth2/openid connect based authentication and authorization. This specific ...
- 123
2
votes
1
answer
105
views
Why should authorization servers document the size of client identifiers?
In section 2.1 of the OAuth2.0 RFC, it states the following regarding the client identifier:
The authorization server SHOULD document the size of any identifier it issues.
What is the point of ...
user185826
2
votes
1
answer
364
views
Is the OAuth2 authentication code long enough to be secure?
I have recently started working with the OAuth2 authentication flow. In using it, I see that in the authcode flow, the client allows the AuthServer to authenticate a user, and then returns an ...
- 123
2
votes
1
answer
175
views
What advantages would client-side certificates have over signature based auth such as Oauth2 or HMAC for HTTP Requests?
My application currently supports these two authentications methods OAuth2 and HMAC Auth.
OAuth2 https://www.rfc-editor.org/rfc/rfc6749
HMAC https://datatracker.ietf.org/doc/html/draft-cavage-http-...
- 21
2
votes
1
answer
915
views
Is the OAuth 2 authorization code flow vulnerable to the Confused Deputy Problem?
Confused Deputy Problem (also known as 'The Devil Wears Prada') is an OAuth 2 vulnerability arising when the protocol is used for authentication. Essentially, a malicious client obtains a token for a ...
2
votes
1
answer
197
views
Software updates APIs authentication
We need to improve a system that delivers software updates (firmware/software files) to a Bluetooth device through a "companion" application installed on customers smartphones (ios/android).
The ...
- 121
2
votes
0
answers
37
views
Analyzing impact of leaked client_secret in Authorization Code Flow in Keycloak (CVE-2020-27838)
CVE-2020-27838 describes that Keycloak has an open endpoint where it's possible to obtain client_secret information, as shown in the example below:
/auth/realms/{realm}/clients-registrations/default/{...
- 21
2
votes
0
answers
1k
views
Use of nonce to prevent access token leakage in OIDC implicit flow?
Disclaimer: I know The OIDC implicit flow has been discouraged for a long time and I should use code flow on greenfields. Reasons include but are not limited to leakage of the authorization server ...
- 121
2
votes
2
answers
650
views
OAuth2 public clients cant use client secret and still achieve a secure workflow, why is it used for confidential clients?
In an OAuth2 authorization flow, if I understand correctly the request made to receive a token with PCKE is almost identical between that of a public client and that of a confidential client. The only ...
- 121
2
votes
3
answers
978
views
Detecting session sharing with OAuth2
In the OAuth2 Implict Grant flow, the access token is added to the URL fragment as part of the redirect from the Authorization Server to the Relying Party. Since this access token is made visible to ...
- 125
2
votes
0
answers
100
views
What stops an attacker from simply using your client_id in their own auth code flow with PKCE [duplicate]
Ok so I get the benefit that PKCE provides. Without it, the attacker knows your client_secret and by registering the same URL scheme as your application on mobile, can intercept the redirect with the ...
- 121
2
votes
0
answers
711
views
API keys or Client Credentials flow? Good practice to control application access to a deployed web component
Company A developed a widget (Web Component) deployed on several clients/partners.
Only clients/partners must be authorized to use the widget.
No need to distinguish between each end users (clients' ...
- 431
2
votes
0
answers
720
views
Keycloak and Open ID Connect best practices
I'm a bit lost as to the best practice surrounding a production-ready access management based on keycloak and open id connect.
My understanding is that if you use Keycloak's provided adapters, instead ...
- 21
2
votes
1
answer
573
views
Is OAuth 1 less secure than OAuth 2 in an SPA
We are writing a pure javascript front-end (in angular) for an API that still uses OAuth 1 for legacy reasons. Being pure javascript means the consumer secret is part of the code that gets downloaded ...
- 541
2
votes
0
answers
169
views
What is the right way to let user retrieve client secret in OAuth 2?
In the OAuth website here it says "Most services provide a way for developers to retrieve the secret of an existing application, although some will only display the secret one time and require ...
- 23
2
votes
0
answers
411
views
Does my app need authentication in addition to Spotify authorization?
I have an app that revolves entirely around Spotify. I have followed the authorization guide from Spotify and am using the Authorization Code Flow so the access token can be refreshed. My thinking was ...
2
votes
0
answers
2k
views
Is it correct to use AWS Cognito groups as user roles?
I trying to implement authN/authZ for my application using Spring Security 5.2.2 and OAuth2/openid connect protocols. I use AWS Cognito as an identity provider and I'm trying to implement role-based ...
- 121
2
votes
0
answers
616
views
API protection - JWT vs HMAC signing vs OAuth
Lets say you are designing a new API. The consumer of your API is a mobile app that periodically sends requests in the background, but you expect other consumers as well, such as web apps or servers.
...
- 121
2
votes
0
answers
3k
views
OAuth access token/API key patterns for large web sites
First off, let me preface this post by saying I'm not a security expert.
I'm trying to build regular expressions to find OAuth 2.0 access tokens and API Keys for common web sites such as Google, ...
- 121
2
votes
1
answer
279
views
what is the scope of google drive's OAuth credentials?
I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
- 195
2
votes
0
answers
1k
views
Using Google Authentication with Lambda@Edge and S3 Static Sites
I am looking to set up authentication on an S3 hosted static site. The configuration is:
S3 bucket configured to allow access via cloudfront
AWS Cloudfront distribution with HTTPS configured and a ...
- 166
2
votes
0
answers
131
views
Tunelling an Authenticated User Across Microservices Securely
On a platform which follows the OAuth 2.0 framework for authorization and a microserivce based architecture, what is a secure way to pass a user from one microservice to another on the same platform ...
user185826
2
votes
0
answers
665
views
How to provide granular API security using OAuth scopes and claims
I'm trying to work out how best to secure an API using oAuth scopes and/or claims. I'm unsure on which I should be using.
My setup is as follows:
All users sign in to signin.domain.com
There are ...
- 171
2
votes
0
answers
985
views
Auth0 vs Firebase = oidc vs Firebase Tokens
I am trying to choose between Auth0 and Firebase as my identity provider. I am building a SPA with a Backend API and I would like to use Auth0 or Firebase for all the logic regarding users/passwords/...
- 289
2
votes
0
answers
179
views
OAuth2 Implicit Flow. Additional protection for access_token from interception
We have a one-page JavaScript application that authenticates the user on our server using the OAuth 2.0 protocol (and the AddId-Connect add-in). After authentication, the server issues an access_token ...
- 131
2
votes
0
answers
335
views
Is OAuth2 Implicit secure?
I have built an authorisation server using OWIN based OAuth2. I understand that the Implicit grant is basically only authenticating the redirect_URL and Client_ID when making the request. I thought, ...
- 121
2
votes
0
answers
1k
views
JWT as a nonce in sessionless backends
I'm creating an API server (a gateway) with two restrictions in mind:
It has to be sessionless (no session id in a cookie or anywhere, no Redis or anything like that)
I have to use an implicit grant ...
2
votes
0
answers
610
views
OAuth2 password analog (private, unique, & static) – Encryption
I’m making a webapp which encrypts each user’s data, using AES-256, with a unique key for each account. I’m thinking about adding external signon via the “Sign in with Google” scheme. However, I’ve ...
- 171
2
votes
2
answers
1k
views
How could a server to server rest api communication be more secure, by using OAuth 2?
I created a large backend+frontend project for a client. They recently started a different project, and contracted an other company to develop and host it. Since they need some of the data from my ...
- 193
1
vote
1
answer
1k
views
Custom OAuth2 Authorization Server / Identity Provider
I am currently trying to implement my own Authorization Server following the OAuth2 protocol PKCE flow, coupled with my own Identity Provider. The idea is to be able to reuse the same identity ...
- 11
1
vote
1
answer
435
views
Using OAuth2 with JWT, should a client pass along unused refresh tokens on a logout call?
I have a system with an OAuth2 authorization server. It hands out JWT access tokens and refresh tokens (the latter only to the mobile app client).
We don't persist access tokens (as is normal with ...
1
vote
1
answer
220
views
Is it a major security risk if your client_secret gets displayed for about 30 min - 1 hour before you notice it showing and you can remove it? [duplicate]
Did something stupid, and asked a question on stackoverflow posted a little too much info without realizing it.
Is it a major security risk if your client_secret gets displayed for about 30 min - 1 ...
- 11
1
vote
1
answer
152
views
What is a pre-warmed secret?
As described here: https://tools.ietf.org/id/draft-ietf-oauth-security-topics-13.html#proposed-countermeasures-2
Note on pre-warmed secrets: An attacker can circumvent the
countermeasures described ...
- 123
1
vote
1
answer
1k
views
How to pentest oAuth2/oidc clients
imagine the following problem:
As a developer, I would like to check if my oAuth2 or OpenID Connect client is really secure.
I would like to check if it validates the JWT signature, uses the nonce etc....
- 2,763
1
vote
1
answer
665
views
Can OpenID Connect be used to implement social login?
Using OAuth to implement social login is insecure (https://www.rfc-editor.org/rfc/rfc6819#section-4.4.2.6) because OAuth doesn't provide authentication, only authorisation. The issue arises because ...
- 113
1
vote
2
answers
1k
views
Does an authorization code grant rely on sessions?
It's my (possibly flawed) understanding that the authorisation code grant is attractive because it keeps access tokens away from a potentially insecure user agent. I understand how this would work ...
- 502
1
vote
1
answer
2k
views
OAuth 2.0 when and how to use the client id and secret
The OAuth 2.0 protocol uses the client id and secret. It considers the client id to be public while the secret is private. Anyway it also considers to generate the client id randomly with a certain ...
1
vote
1
answer
523
views
what is a resource in UMA (OAuth2)?
I'm currently having a look at OAuth and UMA and I often read about resource and resource server.
But I'm still unsure what exactly a resource can or can't represent.
Most of the time in the examples, ...
- 113
1
vote
2
answers
6k
views
Why is the redirect_uri defined to be an absolute uri in OAuth2?
I've been reading the OAuth2 spec and section 3.1.2 states that the redirect uri parameter (the callback used after successful authentication to redirect back to the service) must be an absolute uri. ...
- 11
1
vote
2
answers
426
views
How do I secure a nonce value within app whose source code is public?
I am developing a plugin for Nylas N1 (implements Node). The plugin will be using an implicit flow to authenticate the user, as I understand that is the best way to handle client-side applications. I ...
1
vote
2
answers
194
views
Using oauth for authentication
I understand that oauth is an Authorization protocol, but it is possible to use it for authentication when clubbed with something like open ID Connect.
I am trying to understand why do we need an ...
- 303
1
vote
1
answer
328
views
How to manage long-term access to profile data using OIDC?
I am designing an ecosystem of web applications that uses an Open ID Connect (OIDC) authorization server. The users authenticate to the authorization server using the Authorization Code Flow with ...
- 127
1
vote
2
answers
1k
views
Is it safe to use email from OAuth for authentication?
I am implementing OAuth (more specifically "Sign in with Google") for a website that has been using only email and password for years.
Now the guide that I'm reading suggests to read the uid ...
- 153
1
vote
1
answer
401
views
SSL certificate for desktop app?
I built an app, which authenticates users via oauth2. I have a simple server that can accept requests.
After authentication, the user is redirected to https://127.0.0.1:1234/token=<token> and ...
1
vote
2
answers
124
views
Is access token confidentiality also ensured in the Authorization Code grant type in Oauth2.0
One of the really nice articles I came across while trying to understand the various grant types in Oauth2.0 was this. The author really has done a good job at explaining quite clearly what various ...
- 1,522
1
vote
1
answer
868
views
Client — CertificateVerify during handshake
I am trying to understand how the client is authenticated to the server during mutual tls
So during the handshake, the client sends this message
Client — CertificateVerify
This message is used by the ...
- 51
1
vote
2
answers
1k
views
Is it safe to pass an OpenID Connect ID token to my back-end API for verification?
I am currently adding single sign-on functionality between my application and an electronic health record (EHR) system. The SSO is done using the OpenID Connect authorization code flow, but unlike a ...
- 111