Questions tagged [oauth]

OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

Filter by
Sorted by
Tagged with
0
votes
1answer
41 views

IN OAuth 2.0, how is the client secret supposed to be kept secret?

Using most OAuth 2.0 flows, a client application can identify itself to the authorization server by means of a "client id" and "client secret." The OAuth 2 specification says that the client secret ...
2
votes
1answer
246 views

OAuth 2.0 Resource Owner Password Grant - Handling of Access Token Upon Logging Out

I am new to OAuth 2.0. I used BShaffer's OAuth PHP Server on Authorization Code Grant, and I understand that the client application can have its OAuth token separate from its session authentication, ...
0
votes
1answer
51 views

Does PKCE replace state in the Authorization Code OAuth flow?

PKCE explanation: https://www.oauth.com/oauth2-servers/pkce/ OAuth Flow example: https://developer.okta.com/docs/guides/implement-auth-code-pkce/use-flow/ My question is more specifically: Is there ...
1
vote
1answer
45 views

Secure REST API that only works for users authenticated by App with SSO (OAuth?)

I somehow need to accomplish the following: User accesses a application written in JavaScript. Application uses SSO to identify the user who is logged into Windows. Application obtains the access ...
127
votes
7answers
75k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
0
votes
1answer
56 views

What are the security implications using a Refresh Token in a SPA using Authorisation Code Flow + PKCE

I am considering moving my SPA from Implicit flow to Authorization Code + PKCE extension. This new flow will provide the SPA with a Refresh Token that doesn't expire. Let's say a malicious user on ...
11
votes
1answer
5k views

In Oauth what is the benefit of the access token being opaque

Why was the decision taken that the Client doesn't need to be able to parse the access token? It seems to me that if the token included, in addition to the current fields, a client_id and a user_id, ...
1
vote
1answer
188 views

Did I get it right? OAuth2, OpenID and OpenID Connect

After a lot of research about authentication and authorization, I reached the following but not sure if what I reached is the correct thing so please help me out: Authentication is who you are. ...
3
votes
3answers
253 views

Should a logout request be authenticated?

I have implemented access tokens and refresh tokens, without an auth server (my API server also does authentication). Access tokens: stored in the client (localstorage). Expire in 20 minutes. Refresh ...
0
votes
0answers
35 views

OAauth - Authorize Vs Token Routes

Although I read about the differences between the token route and the authorized route I am not sure exactly when I need to use them. If I understand correctly the /authorize will be used for clients ...
0
votes
0answers
26 views

OAauth - When To User Refresh Token?

I understand the role of refresh token but I'm not sure when it is enough to provide only access token and when need to provide both access token and refresh token? For example, if a user login to my ...
1
vote
1answer
237 views

OAuth 2 state token and protect CSRF

We are trying to build a set of REST APIs which will be authenticated by using attached ID token generated by an OAuth provider. I am trying to understand how to use the state token passed in with ...
25
votes
3answers
20k views

Why is it a bad idea to use plain oauth2 for authentication?

TL;DR: What are the security implications of using oauth2 for authentication? I'm building an app (site A) that allows users to perform operations on another website (site B) through a simpler ...
0
votes
1answer
33 views

Securing implicit tokens (Example: Moltin)

I'm fairly new to security but I'm trying to understand how companies have their APIs set. One such case is Moltin's Implicit Token. Basically they provide you with a read-only (for the most part) ...
29
votes
6answers
5k views

The most secure way to handle someone forgetting to verify their account?

Suppose we send out email verification to new subscribers that where they have to click on a link to verify their account. Suppose they forget to verify it, and later try to login. Should the error ...
9
votes
3answers
2k views

What is the worst that can happen if your OAuth client secret is leaked?

Let's say you have an app which uses OAuth so app can log in to the user's services (e.g. OneDrive, Google Drive, etc.) Inside the app you have included the OAuth client secret (and client ID) as ...
0
votes
1answer
45 views

Why do we need token authentication?

If I'm creating an authorization service for my application, why can't I just hash the password and save the the username and hashed password in my User table? Why should I use a token authentication ...
1
vote
3answers
108 views

Is it wise to completely rely OAuth2 for new users and not have our own login(with username and password) system

My question is: Is it fine to build applications where the user login is completely handled by OAuth2 and services like that. That way we do not have to have our own password database for the users. ...
0
votes
2answers
3k views

OpenID Connect as SSO

I recently research the SSO solution, and I went into the OpenID connect framework; but after several days of research, this makes me confused that the 'OpenID Connect' protocol does not define the ...
1
vote
1answer
41 views

Which grant type : Implicit or Auth code (with No secret key) is suitable for Single Page Application(SPA)?

I went thru multiple posts saying how implicit grant is a security risk and why auth code grant with AJAX request to Authorization server should be used after redirecting to application (without ...
4
votes
1answer
433 views

Using a gmail oath2 token to access web email

I forgot my password to an old gmail account. I have tried the regular route of going through gmail password recovery: answering questions, it keeps looping back to the questions, so I think I'm ...
27
votes
2answers
22k views

How does JTI prevent a JWT from being replayed?

According the JWT RFC a JWT token can optionally have a jti which I interpret to be an a unique ID for a JWT Token. Seems like a UUID is a good value for a jti. The RFC claims that the jti can be used ...
1
vote
1answer
103 views

Why is there a redirect to the native app in PKCE?

Why even have a redirect or even use the browser? Wouldn't just a normal TLS/HTTPS request/response in the app protect the requests and token? The one argument I have heard against solely relying on ...
4
votes
1answer
4k views

Use (or not use) OAuth for internal service to service communication in SOA

So we are a group of students making an online platform for our University. We are modelling our platform as a set of services. For example, a service "A" might store only personal information of ...
1
vote
1answer
66 views

How to get access token programatically when we try to authorize by grand_type auth-code in the OAuth 2.0 like a user?

There is a bank service that provides API to do some operations with bank accounts. To perform a request to all endpoints of this service I, first of all, need to get auth token via grand_type=...
23
votes
4answers
9k views

Why isn't PKCE encouraged for Single-Page Apps?

A lot of services today still recommend the implicit flow for an OpenID Connect/Oauth2 token exchange when developing Single-Page Apps. (See Okta, Google, Auth0) Some newer guidance out there points ...
24
votes
4answers
8k views

How secure are expiring tokens and refresh tokens?

In the comments of a question on StackOverflow, OAuth2 Why do access tokens expire?, people are questioning how secure refresh tokens are. This comment is how I feel: So it provides some ...
0
votes
2answers
105 views

How client-side OAuth is secure?

I want to make a static webpage, but secure it with a login. In order to do this, I looked at this link. Basically, I want users to log in their Google account to be able to view the webpage. But I ...
0
votes
1answer
45 views

what is the scope of google drive's OAuth credentials?

I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
3
votes
1answer
103 views

Client id and secret as part of query parameter

In CA SSO client_id and Client_secret are passed as part of query parameter. is it secured to pass as part of query parameters? even though it's https my research on internet says it's not best ...
5
votes
1answer
228 views

Can websites detect if visitors are logged in to mainstream ID providers and collect their IDs?

Logging in to websites using mainstream IDs (Google/Facebook/Github etc.) by means of OAuth (or similar) has nowadays become a feature that people expect. Not that long ago the corresponding user ...
0
votes
0answers
123 views

Alternative OAuth 2 flow?

I have an implementation of the OAuth 2.0 authorization code flow, but I'm wondering if I can securely introduce a new flow. I'd like a flow that doesn't require the resource owner to ever need to ...
0
votes
0answers
82 views

OpenId Connect Authorization Code Flow in Microservice Scenario (API-Gateway?)

Im building a SPA with a couple of backend-microservices and i want to authenticate using OIdC. I'm aware of the fact that the implicit flow is not recommended anymore for this. So the recommended ...
2
votes
2answers
222 views

OAuth & SAML integration or better approach

Could anyone explain what would be the best approach for this scenario?: There are 2 separate Service Providers: System A is a server that works as a rest API for a mobile application. System B is ...
0
votes
2answers
603 views

Why Oauth2 specification considers native desktop application clients less secure than web server application clients?

I assume here that the web server is owned the client as is the desktop. If they aren't, then I have my answer and I misunderstood the differences between desktop Vs web server clients. If they are ...
2
votes
1answer
88 views

How to properly deal with different user-facing login mechanisms?

I'm wondering if it's possible to deal with a login mechanism that is dependent on the user identifier. For example, the user can have access using OpenId, OAuth or token. But how can we "help" the ...
0
votes
0answers
71 views

How to prevent fake OAuth consent screens?

I can't find an answer to this simple question about delegated authorisation: When using a mobile app, how can a user be sure that a consent screen (let's say Google or Facebook) is a real one? The ...
80
votes
5answers
91k views

Should we store accesstoken in our database for oauth2?

I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list. I have gone through the complete OAuth2 documentation of ...
0
votes
0answers
36 views

Does an OAuth1.0a HTTP GET endpoint in my API present a security vulnerability?

I'm building a hobby application, and I'd prefer it not end up on a cyber-security expert's list of insecure sites. My application can post to Twitter on behalf of a user. This required implementing ...
4
votes
1answer
1k views

Sharing access-tokens in response header?

What's the best way to share my access tokens? Is it okay to share it in the header as plain-text, or do I need to look into e.g. JWT? Current workflow: -> POST /api/login -d {**creds} <- 201 [...
1
vote
2answers
205 views

Invalidate API tokens when LDAP user is invalid

I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below. User sends LDAP username and password (with password grand type) to the server. Server ...
5
votes
2answers
5k views

What is the difference between API keys and API tokens usages?

From all the research that I have done, I have found that API keys are less secure than access tokens (under usage of oAuth), and should only be used for monitoring purposes. But from what I ...
2
votes
1answer
149 views

OAuth: how to prevent phishing with malicious redirect URIs

To quote the OAuth spec: If the resource owner denies the access request or if the request fails for reasons other than a missing or invalid redirection URI, the authorization server informs the ...
3
votes
0answers
46 views

Architecting a solution with native login and 3rd party login via OAuth/OpenID Connect using dotnet core

I am building an API driven application that will have a native login with username and password, and will also need to grant 3rd party access via OAuth/OpenID Connect in the near future. A pattern I ...
1
vote
3answers
6k views

Identity and Access Management (IAM/IdAM) deployment guide

I'm working on a set of applications that require authentication and authorization. Can you point me in the right direction to some architecture design for this when I want to have multiple services ...
1
vote
0answers
431 views

machine to machine authentication secret

For machine to machine communication (embedding other applications in applications etc.) we often face the problem that the site we're embedding requires a username and a password to authenticate. The ...
0
votes
1answer
58 views

Is it safe to just forget OAuth tokens, and not invalidate them in a mobile app?

I have a mobile application that a user signs into using OpenId Connect and OAuth 2.0. Currently when the user logs out, I open up a webpage to the end_session_endpoint (http://docs.identityserver.io/...
111
votes
6answers
80k views

Why use OpenID Connect instead of plain OAuth2?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...
4
votes
0answers
51 views

Poor Man's OAuth Grant - Review

A 3rd party company has requested that we implement single sign-on with them using the below approach. I'm familiar with OAuth grants and OIDC flows but this seems rather odd to me. The user has ...
1
vote
2answers
636 views

How do I back up YubiKey-backed TOTP authentication?

I bought a YubiKey 5 NFC this week and have started using 2FA and U2F where I can but am deathly allergic to the idea of losing access. For backing up U2F access I'm going to buy a second U2F token (...