Questions tagged [oauth]
OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.
502
questions
168
votes
7
answers
97k
views
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
- 2,449
127
votes
7
answers
88k
views
Why use OpenID Connect instead of plain OAuth2?
I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user.
Now I read about ...
- 2,383
107
votes
5
answers
138k
views
Should we store accesstoken in our database for oauth2?
I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list.
I have gone through the complete OAuth2 documentation of ...
- 1,178
91
votes
6
answers
129k
views
Best place to store authentication tokens client side
When my users are authenticated they receive an authentication token, I need to use this authentication token to authorize some asp.net WebAPI calls. To do this I need to add the token to the head of ...
- 1,013
80
votes
3
answers
87k
views
What are the dangers of allowing "less secure apps" to access my Google account?
According to https://support.google.com/accounts/answer/6010255:
Google may block sign in attempts from some apps or devices that do not use modern security standards. Since these apps and devices ...
- 906
53
votes
10
answers
6k
views
Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?
I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
- 631
50
votes
4
answers
34k
views
OAuth2 Cross Site Request Forgery, and state parameter
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-30#section-10.12 says:
The client MUST implement CSRF protection [...] typically accomplished by requiring any request sent to the ...
45
votes
5
answers
8k
views
What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?
Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook.
One advantage ...
44
votes
6
answers
17k
views
Can someone explain the "Covert Redirect" vulnerability in OAuth and OpenID?
CNet is reporting that all OpenID and OAuth sites are vulnerable to an attack called "Covert Redirect". What is this attack, how does it work, and as an end user, how can I mitigate the risk?
- 885
40
votes
3
answers
37k
views
How does JTI prevent a JWT from being replayed?
According to the JWT RFC a JWT can optionally have a JTI which I interpret to be a unique ID for a JWT. It seems like a UUID is a good value for a JTI. The RFC claims that the JTI can be used to ...
- 613
38
votes
3
answers
21k
views
Why isn't PKCE encouraged for Single-Page Apps?
A lot of services today still recommend the implicit flow for an OpenID Connect/Oauth2 token exchange when developing Single-Page Apps. (See Okta - now recommends PKCE w/ implicit fallback, Google, ...
- 676
37
votes
2
answers
21k
views
OAuth 2 vs OpenID Connect to secure API
I am developing a Web API which will back several applications: a website, a companion mobile application(s) and possibly several third-party applications. Every application is expected to get an ...
- 423
35
votes
3
answers
38k
views
What is the purpose of OAuth 2.0 redirect_uri checking?
The OAuth 2.0 specification's authorization code mechanism includes redirect URI checking from the site you redirect to. See steps D and E in section 4.1 of the spec. Also, section 4.1.3 describes in ...
- 451
33
votes
4
answers
16k
views
How secure are expiring tokens and refresh tokens?
In the comments of a question on StackOverflow, OAuth2 Why do access tokens expire?, people are questioning how secure refresh tokens are.
This comment is how I feel:
So it provides some ...
- 513
32
votes
3
answers
30k
views
When do you use OpenID vs. OpenID Connect
Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context?
The reason I ask is because I'm trying to implement the following:
User "Bob"...
- 423
32
votes
1
answer
6k
views
How does a refresh token help? [duplicate]
I have a basic doubt or apparently am missing out on something fundamental.
When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
- 1,472
31
votes
3
answers
23k
views
Why is it a bad idea to use plain oauth2 for authentication?
TL;DR: What are the security implications of using oauth2 for authentication?
I'm building an app (site A) that allows users to perform operations on another website (site B) through a simpler ...
- 2,299
30
votes
6
answers
5k
views
The most secure way to handle someone forgetting to verify their account?
Suppose we send out email verification to new subscribers that where they have to click on a link to verify their account.
Suppose they forget to verify it, and later try to login.
Should the error ...
- 529
30
votes
1
answer
33k
views
How to do role-based authorization with OAuth2 / OpenID Connect?
I'm trying to use OAuth2 for authentication/authorization, but after much reading around, I am confused... I'm trying to understand how OAuth and OpenIDConnect relate to each other, and how exactly I ...
- 465
26
votes
3
answers
3k
views
Why are developers using embedded user agents for 3rd party auth? What are the alternatives?
I've noticed a trend in mobile and desktop apps in recent years with the advent of OAuth (and it may also affect other frameworks) to request a user to sign up or log in using 3rd party authentication ...
- 311
24
votes
3
answers
2k
views
Pitfalls of using OAuth for mobile Applications
OAuth is a popular authorization solution for web applications and mobile applications.
What the pitfalls of using OAuth are in those two scenarios (as a web application providing OAuth access to my ...
- 60.6k
22
votes
6
answers
6k
views
Securing web applications with only a reverse proxy
In order to secure its public HTTP API (so called REST), my client is asking me to implement a simple HTTP reverse proxy that will verify (OAuth 2.0) access tokens and forward HTTP requests to ...
- 293
21
votes
5
answers
15k
views
Compromised JSON Web Token (JWT) Bearer Token
We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
- 311
21
votes
3
answers
7k
views
What is the worst that can happen if your OAuth client secret is leaked?
Let's say you have an app which uses OAuth so app can log in to the user's services (e.g. OneDrive, Google Drive, etc.)
Inside the app you have included the OAuth client secret (and client ID) as ...
20
votes
3
answers
10k
views
OAuth2 - Resource Owner Password Credentials grant
The OAuth2 spec describes the Resource Owner Password Credentials grant type and authorisation flow here. I understand that only 'trusted' client applications would be allowed to use this grant, for ...
- 301
19
votes
2
answers
14k
views
Facebook API : App Secret - possible misuse
I've recently find out that by simple quick look into compiled code of one of our applications, you can get both App ID (API Key) and App Secret for Facebook API
I suppose that we should really keep ...
- 2,223
19
votes
2
answers
22k
views
Is my JWT refresh plan secure?
I plan on using JWT for my login system for mobile devices. There is no real standard workflow for refreshing JWT tokens I could find so I created this one below. The reason I want to use JWT is for ...
- 877
19
votes
2
answers
37k
views
OAuth access token vs session key
Is there any advantage to OAuth vs cookie-based sessions (established via username/password) under the following assumptions?
There is only one legitimate client to the service
The OAuth client ...
- 401
19
votes
1
answer
42k
views
Where to store access and refresh tokens on ASP.NET client web app - calling a REST API
I've made a Web API in ASP.NET that acts as the entry point into a SQL Server database for report data. This service has a "token" endpoint that authenticates a user via ASP Identity and return a 20-...
- 291
19
votes
2
answers
19k
views
Where should I store OAuth2 access tokens?
I am building a REST API back-end, for a mobile application.
In our design choice, we decided to let OAuth2 providers handle the login security.
However, I am not sure what the best practice is for ...
- 191
19
votes
2
answers
2k
views
Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML
It's clear there there is no consistent set of features among any of the popular authentication providers.
Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
- 50k
18
votes
2
answers
17k
views
What is the benefit of the scope in OAuth2?
In the question, substitute scope with state. Since there is an answer based on the wrong question, I'll let everything below as is. The answer is useful nonetheless.
This question refers to the ...
- 405
18
votes
2
answers
5k
views
OAuth2 and Authentication
I see a lot of confusion about OAuth2 and Authentication so I created this question in the hope to clear some of the confusion. So, let's talk about the following points :
What is the difference ...
- 6,881
18
votes
4
answers
15k
views
JWT vs. Client Certificates
We have a transaction server that is connected to by different client applications. The requirement is to have a secure means of authentication for client applications to communicate with the ...
- 313
18
votes
1
answer
5k
views
Does it make sense to implement OAuth when no 3rd party is involved
I own a REST API at server side and a distinct web application that would call those APIs.
I want to secure my APIs calls.
After some reading, I want to implement the OAuth 1.0a mechanism at server ...
- 421
18
votes
3
answers
10k
views
Securing a multi-tenant, multi-database REST API
I am looking to improve the security of an existing REST API accessed over SSL. The web service is multi-tenant, such that each tenant has an assigned TenantId.
The problem I facing can be summarized ...
- 283
18
votes
1
answer
5k
views
Best way to secure javascript front end/REST back end architecture web site?
I would like to build the following project:
public REST API back end which can be accessed by any authenticated client.
front end with static files in HTML/CSS/Javascript with Backbone.js jQuery ...
- 361
17
votes
1
answer
539
views
Odd history of OAuth 2 device flow
OAuth 2 device flow has an odd history. It's found in early versions of the RFC, but was then taken out seemingly without an explanation I could find. Recently, a new draft was proposed specifically ...
- 1,722
15
votes
2
answers
19k
views
What is the difference between API keys and API tokens usages?
From all the research that I have done, I have found that API keys are less secure than access tokens (under usage of oAuth), and should only be used for monitoring purposes.
But from what I ...
- 347
14
votes
1
answer
8k
views
In Oauth what is the benefit of the access token being opaque
Why was the decision taken that the Client doesn't need to be able to parse the access token?
It seems to me that if the token included, in addition to the current fields, a client_id and a user_id, ...
- 491
14
votes
2
answers
7k
views
Client authentication vs. user authentication
I am currently looking into authentication protocols which work well with REST API, in java.
There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
- 143
13
votes
1
answer
4k
views
Security of IFTTT
IFTTT looks like a powerful service but I'm also highly sceptical of its security. Could somebody give me a brief rundown of how you think it works and what the security implications are please? I've ...
- 131
12
votes
4
answers
3k
views
Is Facebook Connect or Twitter OAuth PCI Compliant?
We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter.
Obviously this wouldn't be secure if we were trusting just any old ...
- 1,123
12
votes
2
answers
7k
views
Why would you decouple your resource and login servers?
As described on this link, OAuth specifies that a login server and a resource server should be decoupled. The idea is that if one of your resource servers gets hacked, no password data is lost. All ...
- 282
12
votes
2
answers
445
views
Preventing Voter Fraud on a Social Media Contest
I'm creating a contest that will allow users to login using their Facebook & Twitter accounts and submit votes on videos. My clients concern is that users will game the system by logging into ...
- 123
12
votes
2
answers
13k
views
Secure REST API and Single Page App by using external OAuth 2 Authorization Code
I am trying to understand how to implement an OAuth 2 Authorization Code flow when having both a single page JS app and a REST API. The aim is to secure access to the REST API by offloading ...
- 223
12
votes
3
answers
6k
views
SAML2 vs. OAuth - What are some reasonable relationships?
I have a service that allows SSO via SAML2. When SAML2 is used, we delegate the entire authentication process to the Identity Provider.
We are considering adding OAuth in order to support some ...
- 255
12
votes
2
answers
7k
views
OAuth - What if the refresh token is stolen?
It seems I don't quite understand the idea behind the refresh token yet.
Assuming that a short living access token is used. This token might get stolen, allowing the attacker to access the ressource ...
- 393
11
votes
1
answer
4k
views
Authentication for SPA
I am developing an application for my company with the following parameters & components:
1st Party Frontend Single-Page Application (SPA). This is implemented in TypeScript (a dialect of ...
- 213
11
votes
1
answer
727
views
Is logging in using OAuth/OpenID also vulnerable to heartbleed?
If one has logged into a "heartbleed-vulnerable" site using OpenID, for example, using Google to log into StackExchange, does that mean that the Google password is now at risk as well?
- 213