Questions tagged [oauth]

OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

Filter by
Sorted by
Tagged with
0
votes
0answers
35 views

How to authenticate OAuth2 confidential client is making a REST call?

We are looking to implement some REST services to be called from partner servers (not end users via a browser). The out-of-the-box implementation seems to flow thusly: Partner server passes a client ...
0
votes
1answer
62 views

Implications of using a self-signed certificate to sign JWT tokens in OAuth

I'm looking to setup an integration between GitHub and Service Now and I can use OAuth2 using JWT Tokens, the steps to take can be found here. There is a specific step that states: Create a CA signed ...
1
vote
0answers
32 views

Where should I store an OAuth refresh token for a third party?

I am connecting to a third party which authenticates with OAuth2. Once the user has logged in, I want to store the access & refresh tokens for the user. Which is more secure & proper - to save ...
0
votes
1answer
54 views

How is pop token more secure than bearer token?

I tried reading few articles, however I'm not able to understand the merit of POP over Bearer token. Bearer token if lost (during transit over the wire) can give the holder of the token same ...
1
vote
1answer
60 views

Whose fault/bug is it in the below case?

Say there are 2 servers a.example and b.example. b.example uses 3rd party authentication from a.example via OAuth or other protocols. Now a user user1 with account xyz@a.example logs in and sets up a ...
0
votes
0answers
43 views

Redirection from backend with frontend using OAuth token with Cookie

Currently, Can you provide your suggestion, whether my below approach is good with security perspective. User clicks on login button which calls backend/api/login Step1 triggers the oauth flow and ...
0
votes
0answers
44 views

Guessable oauth client id and phishing

OAuth manual advises that the client ID should not be easily guessable to decrease phishing attacks. https://www.oauth.com/oauth2-servers/client-registration/client-id-secret/ Is it still the case ...
0
votes
0answers
33 views

Storing an OAuth 2.0 access token

I'm in a debate of where to securely store an OAuth 2.0 access token. There are two opinions: On the browser (inside of a HttpOnly cookie) On the server/inside the a database The argument against ...
3
votes
0answers
128 views

Should I build my own login functionality? [closed]

I've looked at various ways of logging in users and I'm wondering if I should write my own. There are a lot of third party solutions that make it easy and cheap to get started, like Amazon Cognito and ...
3
votes
1answer
125 views

Security risks of OAuth vs a password manager

Of the following two approaches, which is "more secure", under which circumstances, and why? In other words, please compare the security risks of these two approaches: Log in to an OAuth ...
2
votes
0answers
33 views

Entering password on third party websites to enable integrations

I've got a third party service that I want to integrate with various other websites/applications, the third party service says they support this however rather than using an API key or OAuth to ...
0
votes
3answers
87 views

Is OAuth more secure compared to API Keys

I have worked on many API integrations scenarios, and I used 2 approaches to authenticate the API calls, as follow:- Using API Keys For example inside hubspot integration i use this web call to get ...
1
vote
0answers
52 views

OAuth for command line application

I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
1
vote
0answers
38 views

Isolating permissions available to browser JS via oauth and referer

This proposal concerns a strategy for isolating the permissions given to plugins in a plugin architecture. I'm looking for insight into whether this design can succeed in isolating those permissions. ...
1
vote
2answers
220 views

What are the advantages of using JWT over Basic Auth with Https?

As per my understanding both JWT and Basic Auth used to store login credentials on client side and avoid sessions for better scalability. I understand with Basic Auth login credentials will be sent ...
0
votes
1answer
72 views

Is PKCE really protecting public facing clients? Can't a rogue app steal the ClientID and Secret and make a AuthCode request of its own?

From what I have understood, for public facing clients such as JavaScript apps that run on the browser or mobile apps which have no backend there is no secure place to store client id and secret. ...
1
vote
1answer
78 views

What are the best practices to create a safe and performant user registration and validation with Nodejs and Postgres? [closed]

I've been asked to write an app with registration and login systems. In essence, I've already wrote the first version of their app using PHP, some javascript/jquery and storing data in MySQL. It ...
2
votes
2answers
86 views

Does signing in via OAuth 2.0 compromise account security if the OAuth 2.0 service decides to become malicious?

Say we signup and login to an OAuth 2.0 enabled security application called "AI Car Command Center" via Google OAuth 2.0 We then logout. Does Google then have the capability to then grant ...
4
votes
2answers
191 views

Why not use PKCE for backend apps, too?

So for SPA/frontend apps, you should be using PKCE these days for OAuth flow. But the backend apps have this additional complexity of having to have a secret key and use that key to talk to the token ...
0
votes
0answers
46 views

Delegating to multiple auth providers from a single page application

Consider a use-case in which a single page application using an OAuth identity flow has to use one of many possible identity providers, as determined by what user is logged in. More specifically, I ...
1
vote
0answers
24 views

Should I consider migrating away from OAuth 2.0 Implicit Flow for an internal application relying on Azure AD?

I have recently migrated an internal application (API + SPA) security from Windows Authentication (done by IIS) to Azure A/D authentication using the implicit flow. Now, every user must enter an e-...
1
vote
0answers
35 views

Why do some “OAuth” providers ask for personal info?

I don't mean to start another OAuth vs OpenID discussion, but I want to share the underlying cause of my confusion. When I want a Client to process my google docs for something, I have to go through ...
2
votes
2answers
161 views

How could a server to server rest api communication be more secure, by using OAuth 2?

I created a large backend+frontend project for a client. They recently started a different project, and contracted an other company to develop and host it. Since they need some of the data from my ...
0
votes
2answers
101 views

I found that I could delete the state parameter in an OAuth request and the response was validated and e-mail was still verified

I was fiddling around with an OAuth2.0 request on burpsuite and I found that it validated the account even after I deleted the state parameter completely and forwarded the request through burpsuite. I ...
2
votes
1answer
416 views

Propagating user context between microservices secured with M2M JWT tokens

We have a current microservice architecture where we secure communication between microservices via Machine-To-Machine access tokens (these tokens are obtained using the Client Credentials grant flow)....
2
votes
0answers
339 views

Keycloak and Open ID Connect best practices

I'm a bit lost as to the best practice surrounding a production-ready access management based on keycloak and open id connect. My understanding is that if you use Keycloak's provided adapters, instead ...
0
votes
0answers
25 views

Benefits of Token Exchange protocol

Beginner question here, I don't seem to be able to wrap my head around the security benefits of the token exchange protocol as specified by RFC8693. To me it seems like a delegation pattern where a ...
0
votes
1answer
82 views

Logout on OIDC Provider Refresh Token validity in comparison to OAuth

I have an Relying Party that has obtained an Access Token and Refresh Token (as well as an ID Token) from an OpenID Provider (not an offline token). In all cases I have seen, the Refresh Token is ...
3
votes
1answer
596 views

Why is SAML still used for enterprise SSO instead of OIDC?

Im trying to wrap my head around the difference between SAML/OIDC/and OAuth Is the only reason SAML is the most popular choice for enterprise SSO that its been around much longer? Is it expected to ...
0
votes
0answers
52 views

Twitter OAuth signing process explanation

I was going through this process https://developer.twitter.com/en/docs/authentication/oauth-1-0a/obtaining-user-access-tokens and there are two points that do not make clear sense to me: Step 1: POST ...
0
votes
1answer
80 views

Best practices for generating and storing authorization codes and access tokens in OAuth server

I've recently implemented an OAuth server functionality to our service. I've consulted OAuth 2.0 Threat Model and Security Considerations and addressed most of the concerns. I am curious about any ...
0
votes
0answers
49 views

Oauth2: should I increase the refresh token expiring date?

I want my clients to be able to schedule a purchase for a given date. When they perform this scheduling action, they are authenticated with an oauth2 token. However the date could be so far from now ...
0
votes
0answers
23 views

Why it is _the client_ (and not _the authorization server_) who is to validate the anti-CSRF state in OAuth workflow?

The client MUST implement CSRF protection for its redirection URI. This is typically accomplished by requiring any request sent to the redirection URI endpoint to include a value that binds the ...
0
votes
1answer
71 views

OAuth 2.0: what's stopping a client from lying to the Resource owner about scopes

I'm seeing token scopes as more of a contract between what a third-party application can do on behalf of some user's consent. Therefore, let's say a client asks a Resource owner to authenticate and ...
1
vote
0answers
140 views

Why doesn't Keycloak allow user sign-up and sign-in through a client?

I'm in need of an authentication & authorization service that can manage our app's pool of users. I stumbled upon Keycloak and have been checking it for the past few days, but I'm wondering why ...
1
vote
1answer
797 views

Authentication in Next.js application (SSR SPA with long sessions)

We’re currently developing a Next.js application (server side rendering) and are looking for secure ways to keep the users logged in for longer periods of time. AFAIK this can either be done using ...
0
votes
1answer
131 views

Is OAuth 1 less secure than OAuth 2 in an SPA

We are writing a pure javascript front-end (in angular) for an API that still uses OAuth 1 for legacy reasons. Being pure javascript means the consumer secret is part of the code that gets downloaded ...
0
votes
1answer
113 views

Is it safe to use a JWT as an Authorization Code?

I'm implementing an OAuth 2.0 Authorization Code grant type flow and considering to use a very short-lived JWT as the authorization code so this step doesn't require a database. I understand that this ...
2
votes
0answers
35 views

What is the right way to let user retrieve client secret in OAuth 2?

In the OAuth website here it says "Most services provide a way for developers to retrieve the secret of an existing application, although some will only display the secret one time and require ...
1
vote
2answers
73 views

How to establish a secure channel with authenticated and authorized access to a remote entity

I have the following problem: There are 3 parties A, B and X. X is holding 2 entities on behalf of A and B. A communicates with X to operate it's own entity. B also communicates with X to operate ...
0
votes
1answer
144 views

Which Authentication mechanism to choose for PCI-DSS system

I want to create Angular 9 + Spring Boot application with strong security complaint to PCI-DSS security standard. Which security protocol is preferred for user sessions in order to have high security ...
2
votes
1answer
184 views

Why *is* PKCE recommended for single page JavaScript apps?

This question is essentially the opposite of Why isn't PKCE encouraged for Single-Page Apps?. In recent years, most OAuth API vendors seem to be have become unanimous in recommending that ...
1
vote
1answer
70 views

how does spotify do oauth(+open id connect) from the desktop app?

I understand what the workflow would be from the webpage, but how does oauth+open id work for desktop apps as they cannot open a browser page within the app. I see that when I click on log in with ...
3
votes
2answers
185 views

Using OAuth SPA app to provide third party with access token

Say I had a centralized OAuth 2 authentication server, a Single Page Application (SPA) in an electron app, and a third-party server. The user launches this SPA, goes through the PKCE flow to obtain an ...
2
votes
2answers
147 views

Where should 'reset password' functionality be?

We've recently overhauled the backend to our mobile app from having a very basic authentication mechanism that went through the API to having both an authentication server and an API server, with the ...
2
votes
0answers
174 views

Does PKCE replace client-secrets?

This is a more direct "yes" or "no" question to the following PKCE vs Client Secret What is the purpose of the OAuth2 client secret? Does PKCE replace state in the Authorization Code OAuth flow? I ...
0
votes
0answers
15 views

How to securly save client_id and client_secret in OAUTH Client Credential Flow

In the application I make use of the client credential flow to make requests. I am unsure about how to save the client_id and client_secret. Right now I have them in a seperate file but I am not sure ...
0
votes
1answer
95 views

Why does Authorization Code flow need the authorization code?

I've implemented Auth Code flow with PKCE on my server, but I'm still not entirely clear on why I'm doing it. I've read through the IETF documentation and I get flashes of what seems like ...
1
vote
1answer
198 views

Custom OAuth2 Authorization Server / Identity Provider

I am currently trying to implement my own Authorization Server following the OAuth2 protocol PKCE flow, coupled with my own Identity Provider. The idea is to be able to reuse the same identity ...
4
votes
1answer
90 views

Exploitation of client_id in OAuth

We have a web app where the back end is composed of APIs. We use OAuth to authorize the web app's call to the APIs. We all know that in OAuth, there is always the Authorization endpoint used to get ...

1
2 3 4 5
10