Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [oauth]

OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

Filter by
Sorted by
Tagged with
0
votes
1answer
109 views

Is this private network authentication system secure?

I am building an authentication system to be used within a company's private network. I do not administer this network, and I know very little about the setup, but my basic understanding is you must ...
0
votes
1answer
94 views

Does PKCE replace state in the Authorization Code OAuth flow?

PKCE explanation: https://www.oauth.com/oauth2-servers/pkce/ OAuth Flow example: https://developer.okta.com/docs/guides/implement-auth-code-pkce/use-flow/ My question is more specifically: Is there ...
0
votes
0answers
37 views

OAauth - Authorize Vs Token Routes

Although I read about the differences between the token route and the authorized route I am not sure exactly when I need to use them. If I understand correctly the /authorize will be used for clients ...
0
votes
0answers
29 views

OAauth - When To User Refresh Token?

I understand the role of refresh token but I'm not sure when it is enough to provide only access token and when need to provide both access token and refresh token? For example, if a user login to my ...
0
votes
1answer
34 views

Securing implicit tokens (Example: Moltin)

I'm fairly new to security but I'm trying to understand how companies have their APIs set. One such case is Moltin's Implicit Token. Basically they provide you with a read-only (for the most part) ...
0
votes
0answers
141 views

OpenId Connect Authorization Code Flow in Microservice Scenario (API-Gateway?)

Im building a SPA with a couple of backend-microservices and i want to authenticate using OIdC. I'm aware of the fact that the implicit flow is not recommended anymore for this. So the recommended ...
0
votes
1answer
72 views

what is the scope of google drive's OAuth credentials?

I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
0
votes
0answers
72 views

How to prevent fake OAuth consent screens?

I can't find an answer to this simple question about delegated authorisation: When using a mobile app, how can a user be sure that a consent screen (let's say Google or Facebook) is a real one? The ...
0
votes
0answers
38 views

Does an OAuth1.0a HTTP GET endpoint in my API present a security vulnerability?

I'm building a hobby application, and I'd prefer it not end up on a cyber-security expert's list of insecure sites. My application can post to Twitter on behalf of a user. This required implementing ...
0
votes
0answers
127 views

Alternative OAuth 2 flow?

I have an implementation of the OAuth 2.0 authorization code flow, but I'm wondering if I can securely introduce a new flow. I'd like a flow that doesn't require the resource owner to ever need to ...
0
votes
0answers
31 views

implementing push api for files using oauth2

i want to implement a push api similar to Garmin Connect API. this api allows the clients to get the data of garmin users, as garmin will push to the clients the user's files whenever created. we ...
0
votes
1answer
73 views

Creating a 3rd party tool that requires a user's auth token for the service

I want to scrape data from Fanball.com to keep track of the fantasy football players that I have drafted, and create a visualization of my exposure to different players. This is a tool that I have ...
0
votes
1answer
186 views

Stolen Google OAuth refresh token

I had authorized Google account on my Mac computer. I think my keychain is stolen and google oauth refresh token was stored in it. I removed the OS X app from my Google account. Is the old OAuth ...
0
votes
1answer
137 views

Authorizing an Android app to carry out operations on backend server

The users of my Android application can pay (using Paypal or in-app billing) to light a LED on a remote location. The LEDs are controlled, at each of the locations, by Internet-connected Arduinos. ...
0
votes
1answer
66 views

How to properly secure a resource server, but allow public clients to have access in a machine-machine style without user interaction

My scenario is this, I have my web API that I want to protect from external people, but I want to allow access for my own applications that could be running in windows forms/android/ios/etc... [...
0
votes
1answer
89 views

Mobile apps social Oauth

I need to develop iOS and Android apps that should have to communicate with a server throught RESTfull API. Also I need to register and authorize user throught popular social networks like Facebook, ...
0
votes
1answer
162 views

Authenticating on the client with OpenID Connect using Authorization Code flow?

Our company has a series of software suites that we are tying into a single OpenID Connect Resource Server. All but one of our applications can use Authorization Code flow as normal, redirecting ...
0
votes
0answers
332 views

OAuth - Facebook custom authorization grant

I've developed my own custom authorization grant. The steps I am undertaking are the following: I get the facebook authorization code from the mobile device (this is an an API for mobile devices) I ...
0
votes
0answers
40 views

Facebook Login security concern with the javascritp JDK [duplicate]

Possible Duplicate: Isn’t OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint? I have some real concerns about how to use facebook login for my wabb-app. I have a ...
0
votes
1answer
77 views

Protecting third-party credentials in a web database in light of weak passwords

I need to store third party credentials in a database for a web application. The third party supports OAUTH and I plan on getting a long-lived token to allow my app to access the third party, but I ...
-1
votes
1answer
2k views

What is this type of authentication with device id and token?

I'm trying to understand this strategy of authentication that I'm using to access resources of an enterprise. Basically, they have given me clientId and clientSecret, which I use to generate deviceId ...