Questions tagged [oauth]

OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

Filter by
Sorted by
Tagged with
2
votes
1answer
296 views

OAuth 2.0: Are refresh tokens still beneficial when all clients are public?

I'm designing a new REST API for a mobile app service, which is something I've not yet had to do from scratch. I decided to use OAuth 2.0 with the Resource Owner Password Credentials grant. Ideally, ...
4
votes
1answer
912 views

Why does oAuth and oAuth 2 have access tokens at all?

I am trying to implement a system for third-party apps to access data that a user stores on a provider. We have a robust access control system, with separate read/write/etc. levels for each "stream" ...
2
votes
2answers
161 views

Using JTWs in OAuth Implementation

I am currently building an api for an app to communicate with. The api endpoints will be protected, so I'd like to use an OAuth flow with JWTs for security. My flow will go something like this: ...
1
vote
1answer
37 views

How can we guarantee our custom auth implementation to a client?

Context In .Net 4.6 my team used Microsoft's built in authentication/authorization systems primarily through its Owin tools. In .Net Core Microsoft decided NOT to port that segment of tools. So, we ...
1
vote
1answer
76 views

How to secure OAuth on an HTTP website [closed]

I want to use OAuth from a famous source (Facebook/Google/GitHub) as a login mechanism for users (for simplicity and to avoid storing passwords). What are the security risks? Do I really need HTTPS/...
16
votes
2answers
32k views

OAuth access token vs session key

Is there any advantage to OAuth vs cookie-based sessions (established via username/password) under the following assumptions? There is only one legitimate client to the service The OAuth client ...
0
votes
2answers
68 views

How to authorize a public client

I've created an application that is exposed via a web service and an Android client that communicates with that web service. Is there a way to have the client authenticate with the web service so that ...
9
votes
1answer
4k views

Is CORS ever needed during any aspect of OAuth / OpenIDConnect Authentication?

I'm looking at OpenIDConnect authentication and trying to determine if either "simple CORS" or "complex CORS" is ever leveraged during authentication or authorization. Background A Simple CORS (...
2
votes
1answer
736 views

What is the need of “password” grant-type in OAuth 2.0?

The need of OAuth arose because we wanted to give access of some of our resources at the Resource Server (for example my Name/Email at Facebook) to the 3rd party apps. This justifies various grant-...
3
votes
0answers
541 views

OAuth 2.0 - using client secret in a native app if refresh token is stored securely

I am developing a native app that needs to access protected resources using OAuth 2. There is a business requirement so that a user has to enter his credentials manually as rarely as possible and the ...
0
votes
2answers
688 views

Securing non-consumer machine-to-machine APIs with Encryption over SSL

I'm working on an API that is intended to be consumed by another system. The data is not owned by the requesting machine and the user(s) that the data pertains to are not driving the transaction. You ...
1
vote
1answer
235 views

Stealing Facebook oAuth code (not token) of no use?

I'm testing a web app that has an option to connect to your facebook account. The oauth login flow starts like this: https://www.facebook.com/v2.7/dialog/oauth?client_id=xxx&redirect_uri=https://...
1
vote
3answers
862 views

OAuth implicit flow and confused deputy problem

I'm reading about Google OAuth and implicit flow. In Google docs it says that the access token received using the implicit flow must be validated otherwise the application might be vulnerable to "...
2
votes
1answer
2k views

How to handle user token expiration on long running asynchronous jobs?

I want to know the recommended approach for having asynchronous back-end services that are secured through bearer tokens call each other? I have an interactive web application that calls a back-end ...
1
vote
2answers
202 views

Creating my own tokens to secure communication with my API

I have an API communicating with my client, now I want to secure that API so that onlyu my client can use it. I am planning to do the following, since I have no experience in this I have gathered all ...
3
votes
1answer
1k views

ADFS 3.0 OAuth2.0 against client applications

ADFS 3.0 does not support the Implicit Grant client flow of Oauth2, nor does it support client secrets. Initial investigations suggest it is not secure to use the Authorize Code Grant flow from a ...
8
votes
4answers
1k views

Why do we trust session info over the wire but not an OAuth access token?

I've been spending a lot of time looking into building an API that needs to be accessible by a single page JavaScript application and how to make it as secure as possible. A lot of what I'm reading ...
1
vote
3answers
79 views

SecureData even for admins with external login

Given: A WebService which stores user Data and a server with a database. A Administrator which can acces the sever wit hthe webservice and the server with the database. Foreach user is a ...
8
votes
1answer
9k views

OAuth2 with client credentials v/s other auth mechanisms

For a REST API against which clients would be writing non-browser based, non-interactive applications, if OAuth2 is the authentication mechanism to be followed, then we would use the client ...
9
votes
1answer
4k views

How should resource providers validate OAuth2 tokens?

Resource providers often provide read and write access to resources. A resource provider should therefore not only validate the token (is it expired? is it revoked? is it valid? does it contain the ...
1
vote
0answers
403 views

How do I handle refresh tokens that are lost in transit?

I have a scenario where a user has a refresh token. As that token is getting ready to expire, the client sends the refresh token to the auth server to get a new refresh token. This usually happens on ...
11
votes
1answer
3k views

Social Login + OAuth2-secured REST API

I'm implementing social login with Facebook, Twitter and Google+ on our OAuth2-secured REST API (secured using spring-security-oauth). I'd like to make sure that the following flow is secure and that ...
4
votes
2answers
311 views

Do I need OAuth to pass an API key of a service (now it is passed via copy-paste)?

I have a web application, say http://web.app/. It is local for every given user and accessible without authorisation. It uses an API of a service https://service.app/. The user can log in to it and ...
2
votes
1answer
7k views

iframe basic auth or token security

We have two sites, both are trusted. On site1 we store the username and password for the user for site2. We make api calls on site1's backend to site2 via basic auth (all over HTTPS). Despite the ...
0
votes
2answers
543 views

3rd Party Mail Clients on iPhone/Android and Credential Storage

Normally when working with a user's credentials, i would store them locally on a device, never on a server because it creates unnecessary liability. For example, on iPhone we have Mail (default) ...
1
vote
0answers
424 views

Sharing an access token from an external provider among apps

I have a running web app that uses an external OAuth provider (Reddit) to log in with. I want to integrate this app with someone else's mobile app and I want to make it as easy as possible for ...
1
vote
1answer
159 views

Is SSO/OAuth inherently broken?

The way I understand it, the whole concept of OAuth/SSO involves allowing a user the ability to have a central password they can use on a multitude of sites without compromising it because really they'...
2
votes
1answer
266 views

OpenID Connect access token to access protected API

In our setup we need both reliable user authentication and scope-based authorization. Consider the following scenario: a user logs in into our client (portal) using OpenID Connect, and our client ...
2
votes
1answer
2k views

Cookie + CSRF Token vs OAuth Token for Native Mobile Apps

We have an existing single-page web application powered by ASP.NET WebApi endpoints. These endpoints leverage SimpleMembership and Forms Authentication to handle authorization and authentication: ...
2
votes
1answer
2k views

Is refreshing a refresh token a bad idea? [duplicate]

Say I have a refresh token that is set to expire in 14 days. And I have an access token that expires in 20 minutes. What if every time you update the access token (using the refresh token), the ...
6
votes
1answer
3k views

Is it safe to store the state parameter value in cookie?

As per https://tools.ietf.org/html/rfc6749#section-10.12: The client MUST implement CSRF protection for its redirection URI. This is typically accomplished by requiring any request sent to the ...
11
votes
1answer
4k views

Authentication for SPA

I am developing an application for my company with the following parameters & components: 1st Party Frontend Single-Page Application (SPA). This is implemented in TypeScript (a dialect of ...
1
vote
0answers
378 views

OpenID Connect Standard: Authorized Party azp Contradiction

In the OpenID Connect spec the azp (authorized party) claim seems to have a contradiction. In the ID token definition section 2 it says: azp OPTIONAL. Authorized party - the party to which ...
55
votes
5answers
87k views

Best place to store authentication tokens client side

When my users are authenticated they receive an authentication token, I need to use this authentication token to authorize some asp.net WebAPI calls. To do this I need to add the token to the head of ...
11
votes
1answer
960 views

If I misuse OAuth 2.0 to do authentication, am I at risk?

I understand that OAuth is not an authentication protocol, but an authorization one (even if the first paragraph on Google's OAuth 2.0 page disagrees), as well as that: [...] authorization can be ...
2
votes
0answers
1k views

Avoiding Client impersonation with Rest Api

I'm sure that this use case has a known solution, but I can't find anything on google or I don't know which keywords to use. We are building an Angular app that is backed by a Rest Api. For ...
1
vote
3answers
348 views

Refreshing Access Token with Access Token

Does it make send to allow a web client app (JavaScript) to refresh Access Toke using Access Token (not Refresh Token) that is about to expire? What are the drawbacks of using this process?
73
votes
3answers
80k views

What are the dangers of allowing “less secure apps” to access my Google account?

According to https://support.google.com/accounts/answer/6010255: Google may block sign in attempts from some apps or devices that do not use modern security standards. Since these apps and devices ...
2
votes
1answer
274 views

Why does the OAuth2 spec recommend that client credentials not be passed in the request body?

The OAuth 2.0 spec states that when authenticating with a client password, you may pass the client_id and client_secret using either: the Authorization header, using the HTTP Basic authentication ...
3
votes
2answers
341 views

Why are the embedded versions (“overlay”, “embed”) of the auth0 lock considered safe?

If you scroll down at https://auth0.com/lock/ to modes it will display multiple modes: "overlay", "embed", "hosted" and "mobile ready". I am allowed to embed the login from auth0 to show up on my site ...
4
votes
1answer
89 views

How to cycle OAuth2 client secrets without downtime

I have an app that relies on several OAuth2 providers to poll for background data on behalf of users, as a background process. As a matter of best-practice, I'd like to periodically cycle my client ...
1
vote
0answers
80 views

How to safely generate and store a password out of Google OAuth user data (for another REST API)

I have a web app, where users sign in with Google (OAuth 2.0). This web app uses a REST API (figo.io) in the background, so I have to create an API user with credentials. Now I have the following ...
20
votes
2answers
22k views

Is my JWT refresh plan secure?

I plan on using JWT for my login system for mobile devices. There is no real standard workflow for refreshing JWT tokens I could find so I created this one below. The reason I want to use JWT is for ...
9
votes
2answers
364 views

Mobile API Authentication

I'm trying to design an Android Analytic service where every user's application who register in this service needs to download our SDK. The SDK itself need to communicate with our API server. The ...
4
votes
1answer
3k views

Is it safe to store bearer tokens in an iframe and/or pass them back to the parent window?

I am not a security expert, so I am hoping that a few of you might be able to tell me if there are any gaping flaws in the security design for my web app. Hopefully I'll be able to explain this ...
20
votes
4answers
14k views

Compromised JSON Web Token (JWT) Bearer Token

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
4
votes
2answers
1k views

Does expiring the OAuth refresh token at the same time as the access token have any utility? Or is it just security theater?

We are integrating with a vendor who have a unique (to us) OAuth 2.0 implementation: with every refresh request, they send us a new refresh token along with the access token. They say that this was ...
1
vote
1answer
387 views

Why are Synchronization Token and Cookie-to-Header patterns un-natural for Web APIs?

I have heard that CSRF prevention techniques are not natural for Web APIs. For instance, we might have a client application at domainA that implements both the Synchronization Token Pattern and the ...
1
vote
0answers
286 views

What is the difference in implementation between HybridAuth and OpenID Connect?

I am installing a CMS login that is shared between two organizations, one a blog for community designed for ease of login and the other is a staff PHP application for a related nonprofit, to keep ...
10
votes
2answers
5k views

Why should I persist OAuth 2 access tokens along with refresh token

That's something I've came across in a couple articles about OAuth 2: when it comes to persisting refresh tokens to database some authors prefer to store access token as well, or at least mention it ...