Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [oauth]

OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

0
votes
0answers
109 views

Alternative OAuth 2 flow?

I have an implementation of the OAuth 2.0 authorization code flow, but I'm wondering if I can securely introduce a new flow. I'd like a flow that doesn't require the resource owner to ever need to ...
0
votes
0answers
25 views

OpenId Connect Authorization Code Flow in Microservice Scenario (API-Gateway?)

Im building a SPA with a couple of backend-microservices and i want to authenticate using OIdC. I'm aware of the fact that the implicit flow is not recommended anymore for this. So the recommended ...
1
vote
1answer
44 views

Why is there a redirect to the native app in PKCE?

Why even have a redirect or even use the browser? Wouldn't just a normal TLS/HTTPS request/response in the app protect the requests and token? The one argument I have heard against solely relying on ...
4
votes
1answer
146 views
+50

Can websites detect if visitors are logged in to mainstream ID providers and collect their IDs?

Logging in to websites using mainstream IDs (Google/Facebook/Github etc.) by means of OAuth (or similar) has nowadays become a feature that people expect. Not that long ago the corresponding user ...
9
votes
3answers
2k views

What is the worst that can happen if your OAuth client secret is leaked?

Let's say you have an app which uses OAuth so app can log in to the user's services (e.g. OneDrive, Google Drive, etc.) Inside the app you have included the OAuth client secret (and client ID) as ...
2
votes
2answers
202 views

OAuth & SAML integration or better approach

Could anyone explain what would be the best approach for this scenario?: There are 2 separate Service Providers: System A is a server that works as a rest API for a mobile application. System B is ...
1
vote
0answers
23 views

How to get access token programatically when we try to authorize by grand_type auth-code in the OAuth 2.0 like a user?

There is a bank service that provides API to do some operations with bank accounts. To perform a request to all endpoints of this service I, first of all, need to get auth token via grand_type=...
0
votes
2answers
593 views

Why Oauth2 specification considers native desktop application clients less secure than web server application clients?

I assume here that the web server is owned the client as is the desktop. If they aren't, then I have my answer and I misunderstood the differences between desktop Vs web server clients. If they are ...
2
votes
1answer
87 views

How to properly deal with different user-facing login mechanisms?

I'm wondering if it's possible to deal with a login mechanism that is dependent on the user identifier. For example, the user can have access using OpenId, OAuth or token. But how can we "help" the ...
0
votes
1answer
35 views

what is the scope of google drive's OAuth credentials?

I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
0
votes
0answers
69 views

How to prevent fake OAuth consent screens?

I can't find an answer to this simple question about delegated authorisation: When using a mobile app, how can a user be sure that a consent screen (let's say Google or Facebook) is a real one? The ...
77
votes
5answers
85k views

Should we store accesstoken in our database for oauth2?

I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list. I have gone through the complete OAuth2 documentation of ...
0
votes
0answers
30 views

Does an OAuth1.0a HTTP GET endpoint in my API present a security vulnerability?

I'm building a hobby application, and I'd prefer it not end up on a cyber-security expert's list of insecure sites. My application can post to Twitter on behalf of a user. This required implementing ...
4
votes
1answer
979 views

Sharing access-tokens in response header?

What's the best way to share my access tokens? Is it okay to share it in the header as plain-text, or do I need to look into e.g. JWT? Current workflow: -> POST /api/login -d {**creds} <- 201 [...
2
votes
1answer
235 views

OAuth 2.0 Resource Owner Password Grant - Handling of Access Token Upon Logging Out

I am new to OAuth 2.0. I used BShaffer's OAuth PHP Server on Authorization Code Grant, and I understand that the client application can have its OAuth token separate from its session authentication, ...
1
vote
2answers
148 views

Invalidate API tokens when LDAP user is invalid

I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below. User sends LDAP username and password (with password grand type) to the server. Server ...
1
vote
1answer
101 views

OAuth 2 state token and protect CSRF

We are trying to build a set of REST APIs which will be authenticated by using attached ID token generated by an OAuth provider. I am trying to understand how to use the state token passed in with ...
5
votes
2answers
3k views

What is the difference between API keys and API tokens usages?

From all the research that I have done, I have found that API keys are less secure than access tokens (under usage of oAuth), and should only be used for monitoring purposes. But from what I ...
2
votes
1answer
103 views

OAuth: how to prevent phishing with malicious redirect URIs

To quote the OAuth spec: If the resource owner denies the access request or if the request fails for reasons other than a missing or invalid redirection URI, the authorization server informs the ...
3
votes
0answers
40 views

Architecting a solution with native login and 3rd party login via OAuth/OpenID Connect using dotnet core

I am building an API driven application that will have a native login with username and password, and will also need to grant 3rd party access via OAuth/OpenID Connect in the near future. A pattern I ...
20
votes
3answers
6k views

Why isn't PKCE encouraged for Single-Page Apps?

A lot of services today still recommend the implicit flow for an OpenID Connect/Oauth2 token exchange when developing Single-Page Apps. (See Okta, Google, Auth0) Some newer guidance out there points ...
1
vote
3answers
5k views

Identity and Access Management (IAM/IdAM) deployment guide

I'm working on a set of applications that require authentication and authorization. Can you point me in the right direction to some architecture design for this when I want to have multiple services ...
1
vote
0answers
357 views

machine to machine authentication secret

For machine to machine communication (embedding other applications in applications etc.) we often face the problem that the site we're embedding requires a username and a password to authenticate. The ...
1
vote
0answers
58 views

Did I get it right? OAuth2, OpenID and OpenID Connect

After a lot of research about authentication and authorization, I reached the following but not sure if what I reached is the correct thing so please help me out: Authentication is who you are. ...
0
votes
1answer
55 views

Is it safe to just forget OAuth tokens, and not invalidate them in a mobile app?

I have a mobile application that a user signs into using OpenId Connect and OAuth 2.0. Currently when the user logs out, I open up a webpage to the end_session_endpoint (http://docs.identityserver.io/...
109
votes
6answers
76k views

Why use OpenID Connect instead of plain OAuth2?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...
4
votes
0answers
48 views

Poor Man's OAuth Grant - Review

A 3rd party company has requested that we implement single sign-on with them using the below approach. I'm familiar with OAuth grants and OIDC flows but this seems rather odd to me. The user has ...
1
vote
2answers
273 views

How do I back up YubiKey-backed TOTP authentication?

I bought a YubiKey 5 NFC this week and have started using 2FA and U2F where I can but am deathly allergic to the idea of losing access. For backing up U2F access I'm going to buy a second U2F token (...
1
vote
0answers
211 views

Using Google Authentication with Lambda@Edge and S3 Static Sites

I am looking to set up authentication on an S3 hosted static site. The configuration is: S3 bucket configured to allow access via cloudfront AWS Cloudfront distribution with HTTPS configured and a ...
1
vote
0answers
25 views

Securing internal API credentials on a public chrome extension

I've developed a Chrome extension that I plan to publish to the Chrome Web Store. On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...
2
votes
3answers
268 views

How Secure is OAuth2 for Web Applications?

Let’s consider a single page client side application, developed using HTML and Javascript. In this case, even if the implicit or authentication code flow is being used to request Access Tokes, still ...
1
vote
0answers
24 views

When is OAuth1 preferred over OAuth2

Scenario: I need to build a new API for a third party company who are building a tool to capture information of new users wishing to create accounts on our enterprise platform. -x- My preferred ...
1
vote
0answers
280 views

OpenID connect authentication with cookie authentication middleware [Asp.Net MVC ]

In my ASP.NET MVC based application I am using 'OpenID connect authentication' middleware with 'cookie authentication middleware' (session/transient cookie). While accessing the application I ...
2
votes
1answer
80 views

Is it secure to handle the OAuth 2 Authorization callback from a CDN?

This question is in the context of the OAuth 2.0 Authorization Framework. Consider a web application that is backed by a first-party API but relies on a third-party authorization server for SSO. Say ...
0
votes
0answers
18 views

implementing push api for files using oauth2

i want to implement a push api similar to Garmin Connect API. this api allows the clients to get the data of garmin users, as garmin will push to the clients the user's files whenever created. we ...
1
vote
1answer
464 views

OAuth 2 Implicit grant type for first party SPA - Most secure and sensible way

My aim is to secure my stateless API and only allow the registered first-party clients (SPA) to consume my resources. There is not going to be any third party clients in my scenario. I know Oauth 2 ...
6
votes
2answers
1k views

Why is using implicit grant more secure than just giving out your secret key?

The company I work for has created an API that is used by mobile devices. I've been reading up on using oAuth for mobile applications and from what I understand it is recommended that you use ...
1
vote
1answer
114 views

JWT access tokens: Too much information?

I've recently encountered the practice of systems using JWTs as Access Tokens. I have a concern and I'm not sure if it's unfounded: I associate JWTs with the OpenID Connect protocol, where there are ...
2
votes
4answers
359 views

How can a OAuth2 resource server relate an access token to the user that authorized it to prevent unauthorized access to other user resources?

I'd appreciate if someone could clear up if, according to the OAuth2 RFC, the resource server could infer the user associated to an access token or not, or even if that is expected. Let’s assume the ...
4
votes
1answer
88 views

How do I implement a Microsoft Login into my own website? [closed]

I am trying to make a website, which hosts a form for employees to enter their shift details into. The website itself is pretty basic, meaning it is mostly just HTML and PHP code. Obviously I need to ...
15
votes
1answer
15k views

How to do role-based authorization with OAuth2 / OpenID Connect?

I'm trying to use OAuth2 for authentication/authorization, but after much reading around, I am confused... I'm trying to understand how OAuth and OpenIDConnect relate to each other, and how exactly I ...
1
vote
2answers
641 views

Is it safe to use OAuth (Resource Owner Password Credentials Grant) for authentication?

Specifically, do I have to worry about the confused deputy problem if I'm just trying to authorize a user against a single API? For example: a basic messaging service will want to authenticate and ...
1
vote
1answer
134 views

What are the risks of using OAuth for authentication when in control of both ends?

I recently discovered that the applications in our system used plain Oauth2 instead of OpenID Connect to authenticate users. The original use-case was to use OAuth to allow our users to authenticate ...
2
votes
0answers
229 views

How to provide granular API security using OAuth scopes and claims

I'm trying to work out how best to secure an API using oAuth scopes and/or claims. I'm unsure on which I should be using. My setup is as follows: All users sign in to signin.domain.com There are ...
21
votes
3answers
1k views

Why are developers using embedded user agents for 3rd party auth? What are the alternatives?

I've noticed a trend in mobile and desktop apps in recent years with the advent of OAuth (and it may also affect other frameworks) to request a user to sign up or log in using 3rd party authentication ...
3
votes
1answer
103 views

Google login button - what prevents an rogue app from stealing a token?

Here are steps to setup a Google login button on a web client: https://developers.google.com/identity/sign-in/web/sign-in When click on the Google login button this pops up: All the interactions are ...
6
votes
1answer
360 views

Can oauth2 “state” parameter be used to avoid using session cookies to identify user

https://tools.ietf.org/html/rfc6749#section-4.1.1 states: 4.1.1. Authorization Request" "state" RECOMMENDED. An opaque value used by the client to maintain state between the ...
2
votes
1answer
128 views

Is OAuth appropriate for a private API to be used by registered customers?

I am developing a private API that will be used by pre-registered clients to access information on our website. We will be storing their login credentials on our server. When looking into how to ...
0
votes
2answers
69 views

App hosted Oauth login pages: what stops forgery?

I've been thinking about Oauth login which works wonderfully for websites in general. However these login types are becoming more prevalent in apps, both desktop and mobile. In these situations often ...
0
votes
1answer
60 views

Where to save the token information?

I'm currently working on an end user Windows 10 application using the Microsoft UWP platform. Within this application the end user will be able to authenticate themselves using an oauth2 SSO service. ...