Questions tagged [oauth]

OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

Filter by
Sorted by
Tagged with
6
votes
2answers
767 views

Is it safe for users of my API to 'Sign In With GitHub' using passport-github?

I understand that OAuth2 was designed to delegate authorization grants to specific resources, it alone is not an authentication protocol. However, the passport-github README states, This module ...
18
votes
2answers
5k views

OAuth2 and Authentication

I see a lot of confusion about OAuth2 and Authentication so I created this question in the hope to clear some of the confusion. So, let's talk about the following points : What is the difference ...
7
votes
1answer
2k views

Is using OAuth for login less or more secure than maintaining your own passwords?

Pros: The complexity in managing passwords is maintained by a company with stronger security policy. Let's assume they secure passwords properly. The user doesn't have to maintain yet another ...
1
vote
1answer
249 views

Why using oAuth2 refresh token is more secure then regenerate an access_token?

I'm implementing an oAuth2 authentification to secure my REST Api. As I am implementing oAuth2, I need to generate an access_token which will give me a temporary access to my REST datas. To do it, I ...
3
votes
1answer
1k views

OAuth2 vs API Key

Our product allows 3rd party components to talk to it via web services using an API key (a 'bearer token'). The developer of the component generates the API key in our app and then stores it with ...
4
votes
3answers
524 views

Can OAuth2 help to authenticate the app?

We have a mobile app that communicates with our server via a RESTful HTTPS API. We also have an attacker pretending to be our app while attempting to communicate with our web services API. We assume ...
10
votes
2answers
2k views

Microservice to Microservice Auth

We're planning a new architecture which will utlize a backend of many different microservices that will need to talk with each other as well as field requests from systems not part of the service. In ...
0
votes
1answer
70 views

Creating a 3rd party tool that requires a user's auth token for the service

I want to scrape data from Fanball.com to keep track of the fantasy football players that I have drafted, and create a visualization of my exposure to different players. This is a tool that I have ...
0
votes
1answer
50 views

oAuth2 scopes and filter conditions in url

I have an api like /v1/api/data and two clients, client_unrestricted and client_restricted. The api itself is protected by Oauth. I want to ideally register the clients with the OauthServer so when ...
3
votes
0answers
329 views

Concepts to support local and external authentication: JWT, Cookies, HttpOnly, …?

I am trying to figure out the correct authentication strategy and concepts for a single page web application (SPA) featuring local login as well as 3rd party login (e.g. Google, Auth0). Unfortunately, ...
1
vote
0answers
68 views

OAuth2 auth server reusing the access token

I found some implementations of OAuth2 provider (auth server) which issues the same access token (for same user & scope) for different authentication request. Does the OAuth2 spec allows it? Any ...
3
votes
1answer
926 views

Security differences between fb connect and openid connect

I've been reading a lot about why plain oauth is bad for authentication, and one needs to at least build on top of it to reach an acceptable level of security. That got me looking at the major ...
9
votes
1answer
3k views

Storing Auth token on Android device

My server is sending me access and a refresh token while logging in. Should I store them in the shared preferences of android by encrypting it? I want to know the best practice for storing these ...
0
votes
1answer
178 views

Stolen Google OAuth refresh token

I had authorized Google account on my Mac computer. I think my keychain is stolen and google oauth refresh token was stored in it. I removed the OS X app from my Google account. Is the old OAuth ...
1
vote
1answer
58 views

How does the user agent know who is logged in? (Using auth codes)

When using Authorization codes (in the Explicit oAuth2 flow), the user agent never seems to see anything other than the auth code, which does not even identify the user. The code is then sent client, ...
6
votes
1answer
481 views

Any scenario for using both, OpenID Connect and OAuth 2.0?

Since OpenID Connect builds on OAuth 2.0, I am assuming that everything that is possible with OAuth 2.0 is also possible with OpenID Connect. In particular, say that my website stores some ...
3
votes
2answers
96 views

Store basic oAuth for a session on a website

I am not sure if there is a good way to do this. Currently I have a website that users log into. In that website there is pages that have API calls to another service, this service uses: ...
9
votes
2answers
5k views

JWT vs. Client Certificates

We have a transaction server that is connected to by different client applications. The requirement is to have a secure means of authentication for client applications to communicate with the ...
0
votes
1answer
398 views

Can I say that my web app is HIPAA compliant?

My team and I created a web app that transfers data from a VOIP system (recorded calls, voicemails, faxes, texts) to cloud storage (Google Drive, Amazon S3, Box.com). In and of itself, our app follows ...
17
votes
1answer
480 views

Odd history of OAuth 2 device flow

OAuth 2 device flow has an odd history. It's found in early versions of the RFC, but was then taken out seemingly without an explanation I could find. Recently, a new draft was proposed specifically ...
3
votes
2answers
205 views

How can an end-user verify the authenticity of a third-party authentication provider's login form

Given the ubiquitous use of third party authentication providers in web apps today, how can end-users verify the authenticity of the login forms that collect their credentials? What's to stop a ...
3
votes
1answer
902 views

What is the benefit of OAuth “one-time code flow (hybrid authentication)”?

With reference to the omniauth-google-oauth2 gem which describes what it calls "One-time Code Flow (Hybrid Authentication)" as such: This hybrid authentication flow has significant functional and ...
2
votes
1answer
2k views

OAuth2 JWT Encryption for Tokens with Scopes to Multiple Resource Servers

Within the context of an OAuth2 deployment, I would like to grant a Client an encrypted JWT that has scopes that to several Resource Servers and can be decrypted by each Resource Server independently ...
2
votes
1answer
601 views

How to handle OAuth2 refresh_token for sessionless login?

I'm working on a single-page sessionless app with OAuth2 login and a "Remember me" checkbox. When the user checks "Remember me" on login I store the refresh token in LocalStorage for 30 days. It feels ...
1
vote
1answer
682 views

What to do for my Web API authentication scheme?

I've been reading a lot lately about Web API authentication mechanisms and I'm a little bit confused regarding how to implement my Web API authentication mechanism, I'm thinking on using Token based ...
7
votes
1answer
3k views

Is OAuth always the right choice (and when isn't it)

I am creating a mobile application which needs to interact on a per-user basis with an API. Having worked on several projects as a client of third-party APIs, my initial thought was to go with OAuth. ...
12
votes
2answers
12k views

Secure REST API and Single Page App by using external OAuth 2 Authorization Code

I am trying to understand how to implement an OAuth 2 Authorization Code flow when having both a single page JS app and a REST API. The aim is to secure access to the REST API by offloading ...
0
votes
1answer
391 views

Preventing CSRF with implicit flow and JWTs?

I'm reading through openid connect document ATM and it says: Put into a browser cookie the ID token can be used to implement lightweight stateless sessions. IIUC we want to avoid using cookies in ...
1
vote
0answers
338 views

Securing a B2B (server to server) multi-tenant REST API [closed]

I am developing a B2B multi-tenant REST API which will be invoked by tenant’s (wallet provider) server application (secure or confidential client) on to perform some operations on its user’s accounts. ...
3
votes
1answer
147 views

OAuth: Long running access in downstream systems - how to refresh token?

In case of OAuth2 and OpenID Connect user authorized AppA to access AppB service. Now AppB needs to access AppC and it uses the bearer token received from AppA (suppose the scope of that token ...
4
votes
0answers
839 views

Using the authorization code grant without using cookies?

I've been reading up on this for months and it seems like the whole thing could converge on what I'm summarizing below. I'm trying to arrive at the most ideal: OAuth2 OpenID Connect SPA / Mobile ...
3
votes
1answer
963 views

Securing a multi-tenant API with SSO and different roles per tenant

I am working on developing a REST API that will be used by first party clients that we develop, and third party clients in the future. The first party clients include a SPA client side application, ...
3
votes
1answer
2k views

Prove ownership of a GMail account

Is there a way for a person to remotely and irrefutably demonstrate ownership of a Gmail email address? I've considered using DKIM signatures, but this has problems: PGP Key Signing Robot DKIM ...
6
votes
4answers
1k views

Authentication Middleware

We run a large distributed system consisting of a number (>10) of Django-based web services and web applications with a consumer base of about 10000 university students. Currently, we use a single ...
18
votes
3answers
9k views

Securing a multi-tenant, multi-database REST API

I am looking to improve the security of an existing REST API accessed over SSL. The web service is multi-tenant, such that each tenant has an assigned TenantId. The problem I facing can be summarized ...
6
votes
2answers
2k views

How would replacing Bearer tokens with HMAC work in OAuth 2.0, and how would the client/server validate?

This Pluralsight class discusses Bearer tokens, and that one of the things missing from OAuth 2.0 is HMAC based validation. Elsewhere on the thinktecture blogs, they are called PoP tokens (Proof of ...
7
votes
2answers
3k views

Using multiple oAuth identity services simultaneously

This question is somewhat acedemic in nature. While educating myself about the topic of Security via a Bearer Tokens for a back-end service that I am working on, and specifically about oAuth2, a few ...
3
votes
1answer
811 views

JWT authentication and authorization schema

I was going through Oauth2 docs and thought it was kind of permissive security wise, so i tried to implement JWT tokens with a special scheme like in the picture for a mobile app communicating with a ...
4
votes
1answer
2k views

OAuth Token Translation (Opaque to JWT)

I've seen couple of talks which suggested usage of OAuth token translation at the API gateway from opaque token to JWT token. What are the advantages and disadvantages of this approach, who should use ...
37
votes
3answers
25k views

OAuth2 Cross Site Request Forgery, and state parameter

http://tools.ietf.org/html/draft-ietf-oauth-v2-30#section-10.12 says: The client MUST implement CSRF protection [...] typically accomplished by requiring any request sent to the redirection URI ...
3
votes
1answer
96 views

Is there a way to tell if an Android app really uses SSO(Single Sign On)?

In the last few years, SSO protocols like OAuth and SAML are becoming increasingly used to enable 3rd parties access some user's resources from some service without the need for user to provide ...
3
votes
2answers
4k views

Renew access token for OAuth2 implicit grant

We want to use the OAuth2 Implicit Grant as it is proposed for single page applications. For JavaScript applications which don't have a classic web session. The applications only have access tokens ...
0
votes
2answers
98 views

Password and Login verse very long string (token)

I'm building a PHP login system that uses a username and password at first to grant the user a token and uses that token to grant the user access to their account. My original thought was to force ...
1
vote
3answers
192 views

Securing a rest API with one client

I am about to develop a REST API that will only have one "user" and I am curious about how I should implement security to make it as secure as possible(hopefully implementing some protocol that I am ...
0
votes
1answer
386 views

How to store encrypted user's data on a server, decrypt only on the client, and store the key elsewhere?

Here's what I would like to do: have a client side that generates and processes the user's data, then encrypts it and stores in a database - in order to later retrieve, decrypt and process the data ...
2
votes
1answer
448 views

How to securely access web api from Html5 Website

So the thing is I have created a Asp.Net web api and am using oauth to secure the access. The problem is that the clients want to make a pure html(angular) website from which they will access the api. ...
2
votes
0answers
339 views

OAuth2 password analog (private, unique, & static) – Encryption

I’m making a webapp which encrypts each user’s data, using AES-256, with a unique key for each account. I’m thinking about adding external signon via the “Sign in with Google” scheme. However, I’ve ...
5
votes
2answers
3k views

OAuth - What if the refresh token is stolen?

It seems I don't quite understand the idea behind the refresh token yet. Assuming that a short living access token is used. This token might get stolen, allowing the attacker to access the ressource ...
2
votes
1answer
290 views

OAuth 2.0: Are refresh tokens still beneficial when all clients are public?

I'm designing a new REST API for a mobile app service, which is something I've not yet had to do from scratch. I decided to use OAuth 2.0 with the Resource Owner Password Credentials grant. Ideally, ...
4
votes
1answer
906 views

Why does oAuth and oAuth 2 have access tokens at all?

I am trying to implement a system for third-party apps to access data that a user stores on a provider. We have a robust access control system, with separate read/write/etc. levels for each "stream" ...