Questions tagged [oauth]
OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.
466
questions
152
votes
7answers
93k views
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
121
votes
6answers
86k views
Why use OpenID Connect instead of plain OAuth2?
I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user.
Now I read about ...
97
votes
5answers
116k views
Should we store accesstoken in our database for oauth2?
I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list.
I have gone through the complete OAuth2 documentation of ...
77
votes
6answers
110k views
Best place to store authentication tokens client side
When my users are authenticated they receive an authentication token, I need to use this authentication token to authorize some asp.net WebAPI calls. To do this I need to add the token to the head of ...
76
votes
3answers
84k views
What are the dangers of allowing “less secure apps” to access my Google account?
According to https://support.google.com/accounts/answer/6010255:
Google may block sign in attempts from some apps or devices that do not use modern security standards. Since these apps and devices ...
53
votes
10answers
6k views
Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?
I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
47
votes
3answers
29k views
OAuth2 Cross Site Request Forgery, and state parameter
http://tools.ietf.org/html/draft-ietf-oauth-v2-30#section-10.12 says:
The client MUST implement CSRF protection [...] typically accomplished by requiring any request sent to the redirection URI ...
45
votes
5answers
8k views
What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?
Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook.
One advantage ...
43
votes
6answers
16k views
Can someone explain the “Covert Redirect” vulnerability in OAuth and OpenID?
CNet is reporting that all OpenID and OAuth sites are vulnerable to an attack called "Covert Redirect". What is this attack, how does it work, and as an end user, how can I mitigate the risk?
37
votes
2answers
21k views
OAuth 2 vs OpenID Connect to secure API
I am developing a Web API which will back several applications: a website, a companion mobile application(s) and possibly several third-party applications. Every application is expected to get an ...
35
votes
3answers
17k views
Why isn't PKCE encouraged for Single-Page Apps?
A lot of services today still recommend the implicit flow for an OpenID Connect/Oauth2 token exchange when developing Single-Page Apps. (See Okta - now recommends PKCE w/ implicit fallback, Google, ...
35
votes
3answers
34k views
What is the purpose of OAuth 2.0 redirect_uri checking?
The OAuth 2.0 specification's authorization code mechanism includes redirect URI checking from the site you redirect to. See steps D and E in section 4.1 of the spec. Also, section 4.1.3 describes in ...
35
votes
3answers
31k views
How does JTI prevent a JWT from being replayed?
According to the JWT RFC a JWT can optionally have a JTI which I interpret to be a unique ID for a JWT. It seems like a UUID is a good value for a JTI. The RFC claims that the JTI can be used to ...
31
votes
3answers
22k views
Why is it a bad idea to use plain oauth2 for authentication?
TL;DR: What are the security implications of using oauth2 for authentication?
I'm building an app (site A) that allows users to perform operations on another website (site B) through a simpler ...
30
votes
6answers
5k views
The most secure way to handle someone forgetting to verify their account?
Suppose we send out email verification to new subscribers that where they have to click on a link to verify their account.
Suppose they forget to verify it, and later try to login.
Should the error ...
29
votes
3answers
25k views
When do you use OpenID vs. OpenID Connect
Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context?
The reason I ask is because I'm trying to implement the following:
User "Bob"...
29
votes
4answers
13k views
How secure are expiring tokens and refresh tokens?
In the comments of a question on StackOverflow, OAuth2 Why do access tokens expire?, people are questioning how secure refresh tokens are.
This comment is how I feel:
So it provides some ...
29
votes
1answer
5k views
How does a refresh token help? [duplicate]
I have a basic doubt or apparently am missing out on something fundamental.
When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
24
votes
3answers
2k views
Pitfalls of using OAuth for mobile Applications
OAuth is a popular authorization solution for web applications and mobile applications.
What the pitfalls of using OAuth are in those two scenarios (as a web application providing OAuth access to my ...
24
votes
3answers
2k views
Why are developers using embedded user agents for 3rd party auth? What are the alternatives?
I've noticed a trend in mobile and desktop apps in recent years with the advent of OAuth (and it may also affect other frameworks) to request a user to sign up or log in using 3rd party authentication ...
22
votes
6answers
5k views
Securing web applications with only a reverse proxy
In order to secure its public HTTP API (so called REST), my client is asking me to implement a simple HTTP reverse proxy that will verify (OAuth 2.0) access tokens and forward HTTP requests to ...
20
votes
5answers
15k views
Compromised JSON Web Token (JWT) Bearer Token
We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
20
votes
2answers
22k views
Is my JWT refresh plan secure?
I plan on using JWT for my login system for mobile devices. There is no real standard workflow for refreshing JWT tokens I could find so I created this one below. The reason I want to use JWT is for ...
20
votes
3answers
10k views
OAuth2 - Resource Owner Password Credentials grant
The OAuth2 spec describes the Resource Owner Password Credentials grant type and authorisation flow here. I understand that only 'trusted' client applications would be allowed to use this grant, for ...
20
votes
1answer
26k views
How to do role-based authorization with OAuth2 / OpenID Connect?
I'm trying to use OAuth2 for authentication/authorization, but after much reading around, I am confused... I'm trying to understand how OAuth and OpenIDConnect relate to each other, and how exactly I ...
19
votes
2answers
14k views
Facebook API : App Secret - possible misuse
I've recently find out that by simple quick look into compiled code of one of our applications, you can get both App ID (API Key) and App Secret for Facebook API
I suppose that we should really keep ...
19
votes
1answer
39k views
Where to store access and refresh tokens on ASP.NET client web app - calling a REST API
I've made a Web API in ASP.NET that acts as the entry point into a SQL Server database for report data. This service has a "token" endpoint that authenticates a user via ASP Identity and return a 20-...
19
votes
2answers
2k views
Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML
It's clear there there is no consistent set of features among any of the popular authentication providers.
Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
18
votes
2answers
17k views
What is the benefit of the scope in OAuth2?
In the question, substitute scope with state. Since there is an answer based on the wrong question, I'll let everything below as is. The answer is useful nonetheless.
This question refers to the ...
18
votes
2answers
5k views
OAuth2 and Authentication
I see a lot of confusion about OAuth2 and Authentication so I created this question in the hope to clear some of the confusion. So, let's talk about the following points :
What is the difference ...
18
votes
2answers
16k views
Where should I store OAuth2 access tokens?
I am building a REST API back-end, for a mobile application.
In our design choice, we decided to let OAuth2 providers handle the login security.
However, I am not sure what the best practice is for ...
18
votes
1answer
5k views
Does it make sense to implement OAuth when no 3rd party is involved
I own a REST API at server side and a distinct web application that would call those APIs.
I want to secure my APIs calls.
After some reading, I want to implement the OAuth 1.0a mechanism at server ...
18
votes
3answers
10k views
Securing a multi-tenant, multi-database REST API
I am looking to improve the security of an existing REST API accessed over SSL. The web service is multi-tenant, such that each tenant has an assigned TenantId.
The problem I facing can be summarized ...
18
votes
1answer
5k views
Best way to secure javascript front end/REST back end architecture web site?
I would like to build the following project:
public REST API back end which can be accessed by any authenticated client.
front end with static files in HTML/CSS/Javascript with Backbone.js jQuery ...
17
votes
2answers
35k views
OAuth access token vs session key
Is there any advantage to OAuth vs cookie-based sessions (established via username/password) under the following assumptions?
There is only one legitimate client to the service
The OAuth client ...
17
votes
1answer
497 views
Odd history of OAuth 2 device flow
OAuth 2 device flow has an odd history. It's found in early versions of the RFC, but was then taken out seemingly without an explanation I could find. Recently, a new draft was proposed specifically ...
16
votes
3answers
5k views
What is the worst that can happen if your OAuth client secret is leaked?
Let's say you have an app which uses OAuth so app can log in to the user's services (e.g. OneDrive, Google Drive, etc.)
Inside the app you have included the OAuth client secret (and client ID) as ...
14
votes
3answers
9k views
JWT vs. Client Certificates
We have a transaction server that is connected to by different client applications. The requirement is to have a secure means of authentication for client applications to communicate with the ...
13
votes
1answer
7k views
In Oauth what is the benefit of the access token being opaque
Why was the decision taken that the Client doesn't need to be able to parse the access token?
It seems to me that if the token included, in addition to the current fields, a client_id and a user_id, ...
13
votes
2answers
6k views
Client authentication vs. user authentication
I am currently looking into authentication protocols which work well with REST API, in java.
There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
13
votes
1answer
4k views
Security of IFTTT
IFTTT looks like a powerful service but I'm also highly sceptical of its security. Could somebody give me a brief rundown of how you think it works and what the security implications are please? I've ...
12
votes
4answers
3k views
Is Facebook Connect or Twitter OAuth PCI Compliant?
We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter.
Obviously this wouldn't be secure if we were trusting just any old ...
12
votes
2answers
6k views
Why would you decouple your resource and login servers?
As described on this link, OAuth specifies that a login server and a resource server should be decoupled. The idea is that if one of your resource servers gets hacked, no password data is lost. All ...
12
votes
2answers
406 views
Preventing Voter Fraud on a Social Media Contest
I'm creating a contest that will allow users to login using their Facebook & Twitter accounts and submit votes on videos. My clients concern is that users will game the system by logging into ...
12
votes
2answers
13k views
Secure REST API and Single Page App by using external OAuth 2 Authorization Code
I am trying to understand how to implement an OAuth 2 Authorization Code flow when having both a single page JS app and a REST API. The aim is to secure access to the REST API by offloading ...
12
votes
3answers
5k views
SAML2 vs. OAuth - What are some reasonable relationships?
I have a service that allows SSO via SAML2. When SAML2 is used, we delegate the entire authentication process to the Identity Provider.
We are considering adding OAuth in order to support some ...
11
votes
1answer
4k views
Authentication for SPA
I am developing an application for my company with the following parameters & components:
1st Party Frontend Single-Page Application (SPA). This is implemented in TypeScript (a dialect of ...
11
votes
1answer
686 views
Is logging in using OAuth/OpenID also vulnerable to heartbleed?
If one has logged into a "heartbleed-vulnerable" site using OpenID, for example, using Google to log into StackExchange, does that mean that the Google password is now at risk as well?
11
votes
1answer
1k views
If I misuse OAuth 2.0 to do authentication, am I at risk?
I understand that OAuth is not an authentication protocol, but an authorization one (even if the first paragraph on Google's OAuth 2.0 page disagrees), as well as that:
[...] authorization can be ...
11
votes
1answer
4k views
Storing OAuth and other authentication tokens
We all know that when to store passwords, we should store it with one-way hash such as a variant of SHA, bcrypt or scrypt to prevent plain-text password leaks when the database is hacked.
But what ...
