Questions tagged [oauth]

OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

Filter by
Sorted by
Tagged with
6
votes
2answers
4k views

How to safely store bearer tokens on server?

Imagine you're running a service that implements an OAuth 2.0 flow to allow your end users to log into 3rd party apps, and authorize those apps to consume your service's data through some API. Upon ...
1
vote
1answer
88 views

Reauthenticating a user for sensitive actions using OpenID

Normally, when you perform sensitive actions on a website, such as changing your password or enabling two factor authentication, you are required to reenter your password, presumably to protect ...
2
votes
1answer
197 views

What are the most common ways to Architect the verification process of the access tokens between resource and authentication server using OAUTH 2.0?

I'm trying to build a web application broken down into a bunch of micro services and each micro service is a resource server. I also have a separate authentication server. I'm wondering which of the ...
3
votes
1answer
57 views

Is it a bad idea to provide a “testing” OAuth ID and secret?

I'm working on a web app, and I may eventually want to bring others onto the project. I have two sets of GitHub credentials: one called Foo that calls back to foo.com/endpoint, and one called Foo -- ...
1
vote
1answer
564 views

What is zero-legged OAuth (or does it exist)?

As I understand it, zero-legged OAuth is where the normally temporary token/secret codes are decided on beforehand and are made to not expire, so there's no authentication step needed before you make ...
1
vote
3answers
472 views

OAuth Authentication - Shared Secrets

I am planning to use the Flickr API in a Windows Universal (UWP) application, written in C#. Early on in my prototype I stumbled upon a security flaw that I have been unable to find a reasonable ...
2
votes
1answer
2k views

Sending access tokens from server to client best practice

I'm trying to write an app that will let a user see multiple Gmail inboxes at one time. I am storing the refresh token for each account in my database. However, I would like for almost all traffic to ...
0
votes
2answers
189 views

With OpenID, should I ever refresh/reauthenticate?

I'm using Google OAuth 2.0 to provide logins to my site(a rinkydink internal tool for other devs at my company to use, so security isn't paramount, but there are a few access restrictions) However, ...
2
votes
1answer
336 views

If my users use Google OAuth for authentication, can I allow 3rd party apps to read data on my site?

Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn. When the book club becomes popular, we discover that 3rd party ...
6
votes
2answers
5k views

Secure OAuth 2 flow for client-side or mobile app

I'm implementing an API and a client-side web app, and they are supposed to communicate via an API and use OAuth 2 for authentication. I can't get over my confusion on what's the right way to ...
0
votes
2answers
4k views

OAuth2, microservices, and “keep me logged in” feature

I'm trying to learn more about authentication in microservices using OAuth2. I've been reading about OAuth2, and while I understand the basics, I have great difficulty understanding how everything ...
1
vote
0answers
927 views

OAuth 2.0 with webhooks

I am implementing an OAuth2-like flow using webhooks between two webservices (no browser/user-agent involved). The authentication server will grant access based on the URL of the webhook to which the ...
1
vote
1answer
469 views

what does `client_id` mean in password credentials grant of OAuth 2.0?

Public clients can't hide their requests. So password credentials grant doesn't need clientSecret. What I'm curious is, is there need client_id? because hacker or client user can know or trace the ...
1
vote
1answer
37 views

Instant signin links for users from trusted third party sites

I'm owning web app "A" and want to work with a third party service "X". User "Alice" has accounts on both platforms. App A knows the user ID of alice on X, but X doesn't care about Alice being on A or ...
2
votes
1answer
605 views

Best practices for securing open APIs from quota theft

I know that appKey is not a means of authenticating applications. But I am wondering what are the best practices for avoiding quota theft for open APIs, that are not associated with any user account. ...
-1
votes
1answer
2k views

What is this type of authentication with device id and token?

I'm trying to understand this strategy of authentication that I'm using to access resources of an enterprise. Basically, they have given me clientId and clientSecret, which I use to generate deviceId ...
0
votes
1answer
137 views

Authorizing an Android app to carry out operations on backend server

The users of my Android application can pay (using Paypal or in-app billing) to light a LED on a remote location. The LEDs are controlled, at each of the locations, by Internet-connected Arduinos. ...
1
vote
0answers
45 views

Why do I need to redirect in order to send the external OAuth2 authentication token to the client?

In an OAuth2 scenario: user confirmed his identity, allows the app to access his details server got the external access token I intend to respond directly with a local access token as opposed to ...
4
votes
1answer
1k views

Does the auth server have to be separate from the resource server when using OAuth 2.0?

I'm trying to implement OAuth 2.0 and I noticed in the spec they mention two servers - an auth server to pass access tokens back to and a resource server to use the access tokens on. My question is, ...
3
votes
2answers
2k views

Stealing OAuth2 Tokens from IoT Devices

As I am delving into different forms of session authentication and persistence, I started to question how tokens are stored and the risk of a token being compromised. The scenario I have in mind is as ...
6
votes
1answer
2k views

Does returning Access-Control-Allow-Origin: * weaken the security of JSON GET responses?

The W3C CORS recommendation states: Certain types of resources should not attempt to specify particular authorized origins, but instead either deny or allow all origins. ... 3. A GET ...
44
votes
5answers
8k views

What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?

Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook. One advantage ...
1
vote
0answers
470 views

Security of GMail API full-access scope

Recently more and more online services are popping up to help manage the mail of Gmail, such as Boomerang, Gmelius and many others. To work correctly they require a full access scope to the gmail api,...
4
votes
0answers
650 views

How do we get a JWT bearer grant with required audience?

According to the OAuth JWT Bearer grant spec, a valid JWT should have some sort of identifier (token endpoint may be used) of the token issuing authorization server within the audience claim. The ...
4
votes
3answers
414 views

Why is it required in OAuth 2.0 that refresh token cannot be guessed?

From RFC 6749 (section 10.4): The authorization server MUST ensure that refresh tokens cannot be generated, modified, or guessed to produce valid refresh tokens by unauthorized parties. I don't ...
5
votes
2answers
771 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
3
votes
1answer
1k views

How is an authorization server supposed to require client auth for confidential clients?

The OAuth2 password grant_type states, If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate ...
2
votes
1answer
5k views

OAuth and public keys

I get the basic OAuth and PKI flow and the different actors involved but I'm still unsure how public/private keys play a role. When a client identifies itself upon registration with a certified ...
6
votes
1answer
8k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
2
votes
1answer
877 views

OAuth + Confused Deputy + access token verification + state parameter

Google's "Using OAuth 2.0 for Client-side Application" article at https://developers.google.com/accounts/docs/OAuth2UserAgent states that the client MUST validate all access tokens to verify that it ...
3
votes
2answers
765 views

Google OAuth 2.0 and Java. Is it safe to locally store access tokens?

I Installed this Java app: https://github.com/andresoviedo/google-drive-ftp-adapter The program asks permission to see my Google-Drive files and then stores an access-token on my local harddisk. ...
42
votes
6answers
16k views

Can someone explain the “Covert Redirect” vulnerability in OAuth and OpenID?

CNet is reporting that all OpenID and OAuth sites are vulnerable to an attack called "Covert Redirect". What is this attack, how does it work, and as an end user, how can I mitigate the risk?
52
votes
10answers
6k views

Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
3
votes
1answer
173 views

Translate token into cookie

I find myself in a situation where I need to hand a user off from a mobile application into a web application. The mobile application is using WebAPI on the backend with OAUTH 2. The web application ...
1
vote
4answers
799 views

OAuth2 vs. JSON authentication

1) To what extent is OAuth2 more secure than JSON authentication (both over SSL)? The context is a client (one server) querying another server (via API) within a local network using RESTFul. Prior to ...
0
votes
1answer
77 views

Protecting third-party credentials in a web database in light of weak passwords

I need to store third party credentials in a database for a web application. The third party supports OAUTH and I plan on getting a long-lived token to allow my app to access the third party, but I ...
1
vote
0answers
1k views

Token-based SSO for multiple domains for backend API requests

I’m in the process of setting up SSO for a service I’m creating. After looking at solutions, I’ve found nothing to fit exactly what we need. I’m looking to make sure from a security standpoint what we ...
1
vote
0answers
622 views

SAML, OAUTH, XACML oh my (Authorization)!

Unfortunately, after using several SSO/IAM products at a 'lite touch' to 'deep integration' level, I'm still left unsatisfied, so going to ask the most basic question I can: Given multiple ...
0
votes
1answer
65 views

How to properly secure a resource server, but allow public clients to have access in a machine-machine style without user interaction

My scenario is this, I have my web API that I want to protect from external people, but I want to allow access for my own applications that could be running in windows forms/android/ios/etc... [...
1
vote
1answer
96 views

Using external OAauth Authentication Service, how to manage the users's relations

I'm trying to create an API and a website client for it. Lately I've been reading a lot about OAuth2 as a security mechanism and companies that offers authentication as a service such as auth0.com or ...
1
vote
2answers
142 views

Why are Facebook, etc. considered as typical authorization servers in OpenId?

The OAuth2 specification says: The interaction between the authorization server and resource server is beyond the scope of this specification. The authorization server may be the same server ...
7
votes
2answers
7k views

What to use as 'state' in OAuth2 Authorization Code Grant workflow

I'm using csrf protection in my web app. Now I'm planning to trigger a OAuth2 Authorization Code Grant workflow, starting with a static template opened in a new browser window using window.open(...
2
votes
0answers
171 views

Combining id_tokens and access_tokens for new auth spec

A common misuse of OAuth2 is as a strict authentication protocol. OpenID Connect addresses this by extending OAuth2 to include an id_token. Implementing clients for OAuth2 and OpenID Connect is a ...
8
votes
1answer
2k views

Including a OAuth client_secret file in a Java application

A client_secret.json file is used in the OAuth 2.0 authorization flow for the Google Drive API (example). If I include client_secret.json in my Java application, access the JAR contents is extremely ...
3
votes
3answers
2k views

3rd party API access: Is OAuth really required?

Having a web application with a REST API (say, our-app.com), we want to open our API to 3rd party web applications (say, their-app.com). After some research, having read about OAuth, OpenID Connect, ...
2
votes
1answer
130 views

OpenID Connect: API access using same identity provider

Does OpenID Connect support the following SSO-like scheme: Both website S and some meta-website M support login using OpenID Connect, e.g. with a Google account. Is it possible for M to access a user'...
2
votes
3answers
1k views

OAuth2 client registration: should redirect_uri be unique across clients?

When operating an OAuth2 Authorization Server: The authorization server MUST require the following clients to register their redirection endpoint: o Public clients. o Confidential ...
1
vote
0answers
359 views

How can I safely store a password during a user session

I am writing an Java application that is using OAuth to authentificate against a server API. The server is offering the OAuth secrets for users to copy from its website. Because each request needs ...
2
votes
0answers
204 views

Confirm signature of JWT or make API call (JWT vs. oauth)

Given a setup where user credentials are stored on a server, but web services will be called from third-party clients, does the following seem reasonable: When clients want to login, they send ...
7
votes
1answer
342 views

Use OpenId Connect for authentication only

OpenId Connect adds authentication to the OAuth2 protocol. OAuth2 is a protocol used for authorization. But what if I'm only interested in authenticating a user? After reading up on OpenId Connect, it ...