Questions tagged [oauth]

OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

Filter by
Sorted by
Tagged with
10
votes
2answers
850 views

How does an attacker abuse Facebook Connect with a leaked secret key?

I am reading about Facebook Connect and it looks a lot like OpenID Connect. Are these two similar enough that the Facebook Connect secret key is an OAuth Client Secret and therefore the same attacks ...
9
votes
2answers
5k views

Why would you decouple your resource and login servers?

As described on this link, OAuth specifies that a login server and a resource server should be decoupled. The idea is that if one of your resource servers gets hacked, no password data is lost. All ...
9
votes
1answer
2k views

Is it possible to implement a nonce without storage?

I am looking at implementing an authentication module using OAuth 2.0 Client and I am trying to avoid having any server state. I was going thorough a few other questions when to use nonce? Is it ...
9
votes
1answer
2k views

Storing Auth token on Android device

My server is sending me access and a refresh token while logging in. Should I store them in the shared preferences of android by encrypting it? I want to know the best practice for storing these ...
9
votes
3answers
2k views

What is the worst that can happen if your OAuth client secret is leaked?

Let's say you have an app which uses OAuth so app can log in to the user's services (e.g. OneDrive, Google Drive, etc.) Inside the app you have included the OAuth client secret (and client ID) as ...
9
votes
1answer
4k views

How should resource providers validate OAuth2 tokens?

Resource providers often provide read and write access to resources. A resource provider should therefore not only validate the token (is it expired? is it revoked? is it valid? does it contain the ...
9
votes
2answers
7k views

password grant without client secret?

I'm struggling to decide what to do to get an access token from a mobile app. I'm sure this has been covered before, but I can't find it. I've enabled resource owner credentials grant on my oauth2 ...
9
votes
2answers
364 views

Mobile API Authentication

I'm trying to design an Android Analytic service where every user's application who register in this service needs to download our SDK. The SDK itself need to communicate with our API server. The ...
8
votes
4answers
2k views

Is 'Bring your own Identity' as the only authentication option a valid practice?

This question is mainly aimed at OpenID Connect, when it is fully realized. I understand the aversion to signing in with a social networking site, but from what I understand about OIDC, its supposed ...
8
votes
1answer
9k views

OAuth2 with client credentials v/s other auth mechanisms

For a REST API against which clients would be writing non-browser based, non-interactive applications, if OAuth2 is the authentication mechanism to be followed, then we would use the client ...
8
votes
4answers
1k views

Why do we trust session info over the wire but not an OAuth access token?

I've been spending a lot of time looking into building an API that needs to be accessible by a single page JavaScript application and how to make it as secure as possible. A lot of what I'm reading ...
8
votes
2answers
2k views

What's the point of the client secret in OAuth2 if it doesn't need to be used?

Simple as that! Clients that can't maintain the secrecy of the client_secret in OAuth2 don't have to use it. So what's the point of having it at all, if it's not necessary? What am I missing here?
8
votes
2answers
4k views

JWT vs. Client Certificates

We have a transaction server that is connected to by different client applications. The requirement is to have a secure means of authentication for client applications to communicate with the ...
8
votes
1answer
2k views

Including a OAuth client_secret file in a Java application

A client_secret.json file is used in the OAuth 2.0 authorization flow for the Google Drive API (example). If I include client_secret.json in my Java application, access the JAR contents is extremely ...
8
votes
2answers
932 views

How do high-performance web applications control permission to their content?

So, I believe I understand the logic behind authorization standards like OAuth. The OAuth token contains information about the user (name, role, etc.), which I can use to secure my application. It'...
8
votes
1answer
5k views

Where should I store a refresh token

I'm building an oauth 2.0 protocol. I'm wondering how the refresh token works exactly. My understanding is that the use of a refresh token enable short lived access token and therefore limits the ...
8
votes
1answer
262 views

Are most app OAuth implementations vulnerable because of an obscured URL/origin?

I cringe every time I am prompted with OAuth in an app because of the lack of ability to verify that the page is actually originating from the represented source. Are most app OAuth implementations ...
8
votes
1answer
129 views

What are the implications of publicizing a consumer secret for sharing between developers doing local website development?

In relation to this GitHub issue on the Gittip project (which turned out to be a false alarm), what are the security implications, if any, of hardcoding into the git repo a test app's OAuth consumer ...
7
votes
3answers
343 views

Detecting OAuth malicious Implementation

I am wondering how can an end-user detect a maliciously implemented OAuth whether 2-legged or 3-legged. Particularly I am interested in those cases where the consumer requester is maliciously ...
7
votes
2answers
1k views

Should I avoid this token-based authentication scheme (that's not OAuth)?

I've dealt with OAuth before but I'm not too sure about the API I'm working with now. My question is basically, is this woefully insecure? As I understand it, oAuth does the following (roughly): ...
7
votes
3answers
3k views

Is there any drawback of using OAuth “pseudoauthentication” as opposed to OpenID?

I have seen posts that insist that OAuth is an orthogonally different thing from OpenID, because OpenID is about authenticating users, while OAuth is about giving access to certain services to a third ...
7
votes
1answer
4k views

Is CORS ever needed during any aspect of OAuth / OpenIDConnect Authentication?

I'm looking at OpenIDConnect authentication and trying to determine if either "simple CORS" or "complex CORS" is ever leveraged during authentication or authorization. Background A Simple CORS (...
7
votes
1answer
330 views

Use OpenId Connect for authentication only

OpenId Connect adds authentication to the OAuth2 protocol. OAuth2 is a protocol used for authorization. But what if I'm only interested in authenticating a user? After reading up on OpenId Connect, it ...
7
votes
3answers
12k views

OAuth2 authorization - save token in the cookies or in the session?

I'm a security newbie. I'm implementing oauth on my site and I want to ask where I should save my access token: cookies session (will be fetch from the server via ajax request) I have backend (...
7
votes
1answer
2k views

Is it safe to store twitter access tokens client side?

After the Twitter oauth process, once I finally get my access_token_key and access_token_secret is it safe to store these in a javascript variable client side? As far as I can work out nothing can be ...
7
votes
2answers
7k views

What to use as 'state' in OAuth2 Authorization Code Grant workflow

I'm using csrf protection in my web app. Now I'm planning to trigger a OAuth2 Authorization Code Grant workflow, starting with a static template opened in a new browser window using window.open(...
7
votes
2answers
3k views

Using multiple oAuth identity services simultaneously

This question is somewhat acedemic in nature. While educating myself about the topic of Security via a Bearer Tokens for a back-end service that I am working on, and specifically about oAuth2, a few ...
7
votes
2answers
1k views

Using OAuth 2.0 without token storage

I am building a system for a product which requires authentication and authorization. Naturally I have chosen using OAuth 2.0 as it is a commonly used protocol and has proven to be useful. I am ...
7
votes
1answer
3k views

Is OAuth always the right choice (and when isn't it)

I am creating a mobile application which needs to interact on a per-user basis with an API. Having worked on several projects as a client of third-party APIs, my initial thought was to go with OAuth. ...
6
votes
2answers
1k views

Decide to REST API Security

I've developed an API. I got confused and I've been reading articles for days. Actually my question is close to these but not exact (maybe a combination of them); Securing REST API that will ...
6
votes
3answers
1k views

How were resources shared before OAuth?

With OAuth 2.0, it is pretty straight forward for a developer to authenticate a user via another service in order to obtain its data, e.g. get tweets from a Twitter user or fitness data via RunKeeper, ...
6
votes
1answer
8k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
6
votes
2answers
3k views

Security drawbacks for using short-lived access token in javascript client side

I intend to build a front end site entirely in javascript (NodeJS) and i would like to do ajax calls to a REST WS which is on another domain on client side. I intend to use oauth2 and SSL to secure ...
6
votes
2answers
22k views

How to use OAuth with Active Directory

I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
6
votes
1answer
464 views

Any scenario for using both, OpenID Connect and OAuth 2.0?

Since OpenID Connect builds on OAuth 2.0, I am assuming that everything that is possible with OAuth 2.0 is also possible with OpenID Connect. In particular, say that my website stores some ...
6
votes
2answers
2k views

How would replacing Bearer tokens with HMAC work in OAuth 2.0, and how would the client/server validate?

This Pluralsight class discusses Bearer tokens, and that one of the things missing from OAuth 2.0 is HMAC based validation. Elsewhere on the thinktecture blogs, they are called PoP tokens (Proof of ...
6
votes
1answer
4k views

Why use a proxy to hide OAuth client credentials in password grant calls?

In a November 2014 article by Alex Bilbie, OAuth users were advised against making the client send its credentials (client_id and client_secret) when performing Resource Owner Password grant calls. ...
6
votes
2answers
1k views

Why is using implicit grant more secure than just giving out your secret key?

The company I work for has created an API that is used by mobile devices. I've been reading up on using oAuth for mobile applications and from what I understand it is recommended that you use ...
6
votes
2answers
5k views

Secure OAuth 2 flow for client-side or mobile app

I'm implementing an API and a client-side web app, and they are supposed to communicate via an API and use OAuth 2 for authentication. I can't get over my confusion on what's the right way to ...
6
votes
4answers
995 views

Authentication Middleware

We run a large distributed system consisting of a number (>10) of Django-based web services and web applications with a consumer base of about 10000 university students. Currently, we use a single ...
6
votes
1answer
2k views

Is using OAuth for login less or more secure than maintaining your own passwords?

Pros: The complexity in managing passwords is maintained by a company with stronger security policy. Let's assume they secure passwords properly. The user doesn't have to maintain yet another ...
6
votes
1answer
109 views

Does OAuth effectively mean allowing an app to do everything as me?

Some OAuth providers (like Google or Facebook) only grant limited privileges to the third party apps, and they state so clearly on the authorization page. For example, they say that an app can see who ...
6
votes
2answers
573 views

Why does OAuth2 demand client credentials in an authorization header?

In section 2.3.1 of the the OAuth 2.0 Authorization Framework it states: The authorization server MUST support the HTTP Basic authentication scheme for authenticating clients that were issued a ...
6
votes
1answer
2k views

Does returning Access-Control-Allow-Origin: * weaken the security of JSON GET responses?

The W3C CORS recommendation states: Certain types of resources should not attempt to specify particular authorized origins, but instead either deny or allow all origins. ... 3. A GET ...
6
votes
1answer
445 views

Can oauth2 “state” parameter be used to avoid using session cookies to identify user

https://tools.ietf.org/html/rfc6749#section-4.1.1 states: 4.1.1. Authorization Request" "state" RECOMMENDED. An opaque value used by the client to maintain state between the ...
6
votes
1answer
3k views

Is it safe to store the state parameter value in cookie?

As per https://tools.ietf.org/html/rfc6749#section-10.12: The client MUST implement CSRF protection for its redirection URI. This is typically accomplished by requiring any request sent to the ...
6
votes
2answers
753 views

Is it safe for users of my API to 'Sign In With GitHub' using passport-github?

I understand that OAuth2 was designed to delegate authorization grants to specific resources, it alone is not an authentication protocol. However, the passport-github README states, This module ...
6
votes
1answer
135 views

Design a webapp that uses OAuth, but with tokens that can't be used by the operator?

I'd like to make a webapp that would allow users to OAuth with Stack Exchange, so that they can perform actions like voting through the app. I'm stuck at one point, though: I know how to perform ...
6
votes
1answer
593 views

API Design Model - Client Side Encryption

I'm currently designing a API Model to use. A user will have a 'secret_api_key' and a 'public_api_key'. They will send a request to my server with the public key, the form data, and then a hash. The ...
5
votes
2answers
5k views

What is the difference between API keys and API tokens usages?

From all the research that I have done, I have found that API keys are less secure than access tokens (under usage of oAuth), and should only be used for monitoring purposes. But from what I ...