Questions tagged [oauth]

OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

Filter by
Sorted by
Tagged with
3
votes
1answer
1k views

Why is OAuth 2.0 being used for mobile devices, and not OpenID?

Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices. Question What ...
3
votes
3answers
310 views

OAuth in open-source plugin

I'm designing an API server and client pair. Typically, I want the client to be in a WordPress plugin. I'd like to use OAuth or something similar to secure the requests. However, as you know, OAuth ...
3
votes
3answers
935 views

Access Control and Authentication using Facebook access tokens in a webapp

I'm working on a mobile app with a web backend. We'd like to have users authenticate (log in) themselves through Facebook only, so we don't have to store passwords etc. and don't force users to create ...
3
votes
2answers
758 views

Is it possible to find out the oauth 2.0 client id and secret when an app is communicating with a web service?

I'm building an mobile app that needs to communicate with a web service. To make sure that only my app is communicating with the web service, I authenticate using OAuth 2. The fact that I need to ...
3
votes
2answers
2k views

AWS Signature V4 vs OAuth + JWT bearer tokens

For securing REST APIs, a logical choice for access control is JWT either by itself or in combination with OAuth. If I only care about authenticating the caller, verifying a JWT signature is ...
3
votes
1answer
1k views

Dangers of passing Oauth 2.0 client id and client secret in the request uri

I was reading here that when passing a client_id and client_secret to an authorization server, The parameters can only be transmitted in the request-body and MUST NOT be included in the ...
3
votes
2answers
4k views

Renew access token for OAuth2 implicit grant

We want to use the OAuth2 Implicit Grant as it is proposed for single page applications. For JavaScript applications which don't have a classic web session. The applications only have access tokens ...
3
votes
1answer
841 views

What is the benefit of OAuth “one-time code flow (hybrid authentication)”?

With reference to the omniauth-google-oauth2 gem which describes what it calls "One-time Code Flow (Hybrid Authentication)" as such: This hybrid authentication flow has significant functional and ...
3
votes
2answers
729 views

Google OAuth 2.0 and Java. Is it safe to locally store access tokens?

I Installed this Java app: https://github.com/andresoviedo/google-drive-ftp-adapter The program asks permission to see my Google-Drive files and then stores an access-token on my local harddisk. ...
3
votes
1answer
781 views

JWT authentication and authorization schema

I was going through Oauth2 docs and thought it was kind of permissive security wise, so i tried to implement JWT tokens with a special scheme like in the picture for a mobile app communicating with a ...
3
votes
1answer
2k views

Prove ownership of a GMail account

Is there a way for a person to remotely and irrefutably demonstrate ownership of a Gmail email address? I've considered using DKIM signatures, but this has problems: PGP Key Signing Robot DKIM ...
3
votes
2answers
2k views

Stealing OAuth2 Tokens from IoT Devices

As I am delving into different forms of session authentication and persistence, I started to question how tokens are stored and the risk of a token being compromised. The scenario I have in mind is as ...
3
votes
1answer
2k views

storage of client credential on OAuth2 server

I'm developing an API and used a recommended implementation of OAuth2 protocol: PHP OAuth2 Server. This library stores client ID and client secret as plain text in a database table. Note that I ...
3
votes
2answers
1k views

Am I understanding correctly how to stop a certain OAuth2 session fixation attack?

Please find here described an OAuth2 session fixation attack. Is the attack possible? And am I understanding correctly how it can be stopped? The attack Mallory starts logging in at client.example....
3
votes
1answer
94 views

Is there a way to tell if an Android app really uses SSO(Single Sign On)?

In the last few years, SSO protocols like OAuth and SAML are becoming increasingly used to enable 3rd parties access some user's resources from some service without the need for user to provide ...
3
votes
2answers
318 views

Why are the embedded versions (“overlay”, “embed”) of the auth0 lock considered safe?

If you scroll down at https://auth0.com/lock/ to modes it will display multiple modes: "overlay", "embed", "hosted" and "mobile ready". I am allowed to embed the login from auth0 to show up on my site ...
3
votes
1answer
1k views

How is an authorization server supposed to require client auth for confidential clients?

The OAuth2 password grant_type states, If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate ...
3
votes
1answer
1k views

ADFS 3.0 OAuth2.0 against client applications

ADFS 3.0 does not support the Implicit Grant client flow of Oauth2, nor does it support client secrets. Initial investigations suggest it is not secure to use the Authorize Code Grant flow from a ...
3
votes
1answer
1k views

Refresh tokens in OAuth2 with JWTs

I'm trying to implement the OAuth2 resource owner flow. My authorization server successfully generates JSON web tokens, so my next step is to implement refresh tokens for my web application. ...
3
votes
1answer
756 views

Using Google Cloud Platform to store credit card data

I have made an iPhone app for users to book hotel rooms. A third party provides the service for booking the hotel rooms and charging the credit cards. At the moment, my app makes no attempt to save ...
3
votes
3answers
1k views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
3
votes
1answer
760 views

Google Open ID connect and ID token

I am wondering if it is safe to send "id token", which is one of the items that are result of authenticating a user using Google Open Id Connect, to the client and use it for further authentication. ...
3
votes
1answer
68 views

Client id and secret as part of query parameter

In CA SSO client_id and Client_secret are passed as part of query parameter. is it secured to pass as part of query parameters? even though it's https my research on internet says it's not best ...
3
votes
1answer
112 views

Google login button - what prevents an rogue app from stealing a token?

Here are steps to setup a Google login button on a web client: https://developers.google.com/identity/sign-in/web/sign-in When click on the Google login button this pops up: All the interactions are ...
3
votes
2answers
91 views

Store basic oAuth for a session on a website

I am not sure if there is a good way to do this. Currently I have a website that users log into. In that website there is pages that have API calls to another service, this service uses: ...
3
votes
1answer
1k views

OAuth2 vs API Key

Our product allows 3rd party components to talk to it via web services using an API key (a 'bearer token'). The developer of the component generates the API key in our app and then stores it with ...
3
votes
2answers
189 views

How can an end-user verify the authenticity of a third-party authentication provider's login form

Given the ubiquitous use of third party authentication providers in web apps today, how can end-users verify the authenticity of the login forms that collect their credentials? What's to stop a ...
3
votes
1answer
901 views

Securing a multi-tenant API with SSO and different roles per tenant

I am working on developing a REST API that will be used by first party clients that we develop, and third party clients in the future. The first party clients include a SPA client side application, ...
3
votes
1answer
897 views

Security differences between fb connect and openid connect

I've been reading a lot about why plain oauth is bad for authentication, and one needs to at least build on top of it to reach an acceptable level of security. That got me looking at the major ...
3
votes
1answer
147 views

OAuth: Long running access in downstream systems - how to refresh token?

In case of OAuth2 and OpenID Connect user authorized AppA to access AppB service. Now AppB needs to access AppC and it uses the bearer token received from AppA (suppose the scope of that token ...
3
votes
1answer
458 views

OAuth token vs. application-specific password: any meaningful benefit?

I feel like this should be a duplicate, but I don't see it anywhere. The question is pretty simple. When giving a mail client (say, Thunderbird) access to your e.g. Gmail account, you have the option ...
3
votes
1answer
165 views

Translate token into cookie

I find myself in a situation where I need to hand a user off from a mobile application into a web application. The mobile application is using WebAPI on the backend with OAUTH 2. The web application ...
3
votes
1answer
128 views

Is it dangerous to publicly share a scopeless token?

If a service allows you to create OAuth tokens without any scopes (allowing 5k API requests / hour for public resources), is it dangerous to share these tokens publicly? The obvious problem I see is ...
3
votes
1answer
932 views

OAuth2 JWT Signing with OAuth2 Application Secret Key

Abstract (sorry, this is a mouthful): I would like to facilitate back end system-to-system Authorization via OAuth2 and JWT by making use of the JWT 'aud' param to specify a resource specific to an ...
3
votes
1answer
56 views

Is it a bad idea to provide a “testing” OAuth ID and secret?

I'm working on a web app, and I may eventually want to bring others onto the project. I have two sets of GitHub credentials: one called Foo that calls back to foo.com/endpoint, and one called Foo -- ...
3
votes
1answer
4k views

OAuth 2.0 client side redirect instead of HTTP redirect

I'm implementing an OAuth 2.0 authorisation server using the Authorization Code flow (i.e. users will authorise client apps to connect to our server). The auth server is the same as the resource ...
3
votes
1answer
537 views

OAuth2 Client Credentials & Native Apps

The OAuth2 spec seems to consider native (Android & iOS) apps as "public clients", ultimately meaning that they can't use the "client credentials" flow. That being said, how does one go about ...
3
votes
1answer
2k views

Risk of keeping OAuth2 client_secret in application

As an exercise, I'm developing a desktop application with which users need to log in to a web service. A logical use-case for OAuth2 one would say, but I'm beginning to doubt its usefulness. I am ...
3
votes
1answer
121 views

If a site says its API for login can't be made available for “Security Reasons” should I be worried

Stack Exchange API 2.2 is finally out, (Yay!) Reading through the linked blog post, i notice the line: Login methods that don’t use OAuth can’t be made public for security reasons. Is this ...
3
votes
2answers
1k views

OAuth for Multiparty Authentication/Authorization

I work for a web company that's undergoing a massive rewrite in order to separate our Data out into its own RESTful service application - the goal is to be able to sell access to third parties and ...
3
votes
1answer
585 views

What mechanism to use for simple and secure HTTP API access?

I am currently working on a service which offers a HTTP API for mobile clients. I want clients to authenticate in order to access my API. The server itself is doing the authentication there will be ...
3
votes
1answer
220 views

Does OAuth 2.0 provide a way to reliably regenerate a key only when a session is active?

I want to encrypt sensitive data on my app server (facebook app) in such a way that my app may only decrypt this data when the user is in an active session. I need to be able to reliably derive/...
3
votes
0answers
45 views

Architecting a solution with native login and 3rd party login via OAuth/OpenID Connect using dotnet core

I am building an API driven application that will have a native login with username and password, and will also need to grant 3rd party access via OAuth/OpenID Connect in the near future. A pattern I ...
3
votes
0answers
2k views

Are JWT refresh tokens in browser really that bad?

Note: I fully acknowledge there may be something I'm missing in the picture, which is part of my reason for posting. I'd like to get the opinion of people more experienced than I am on authN/Z related ...
3
votes
0answers
314 views

Concepts to support local and external authentication: JWT, Cookies, HttpOnly, …?

I am trying to figure out the correct authentication strategy and concepts for a single page web application (SPA) featuring local login as well as 3rd party login (e.g. Google, Auth0). Unfortunately, ...
3
votes
0answers
503 views

OAuth 2.0 - using client secret in a native app if refresh token is stored securely

I am developing a native app that needs to access protected resources using OAuth 2. There is a business requirement so that a user has to enter his credentials manually as rarely as possible and the ...
2
votes
4answers
600 views

How can a OAuth2 resource server relate an access token to the user that authorized it to prevent unauthorized access to other user resources?

I'd appreciate if someone could clear up if, according to the OAuth2 RFC, the resource server could infer the user associated to an access token or not, or even if that is expected. Let’s assume the ...
2
votes
1answer
629 views

Why CORS preflight is not available for POST requests when Content-Type is application/x-www-form-urlencoded

In oauth2 for single page application(SPA), we can revoke the access tokens of the implicit grant type by using an ajax request(this is not recommended now). I tried to do a request like below from ...
2
votes
1answer
843 views

OAuth + Confused Deputy + access token verification + state parameter

Google's "Using OAuth 2.0 for Client-side Application" article at https://developers.google.com/accounts/docs/OAuth2UserAgent states that the client MUST validate all access tokens to verify that it ...
2
votes
1answer
184 views

Usefulness of bcrypt(UUIDv4())

One of my colleagues is working on securing OAuth 2 client IDs and secrets for our OAuth server and he has come up with this scheme where he would not only use UUID v4 to generate random values, but ...