Questions tagged [oauth]

OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

Filter by
Sorted by
Tagged with
5
votes
2answers
818 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
5
votes
1answer
3k views

Would this work to protect a cookie with an OAuth token?

I'm currently trying to set up an OAuth 2.0 authentication scheme to protect some stateless REST webservices. These services deal with sensitive information, and the OAuth support is a requirement. ...
4
votes
1answer
850 views

Create a web session from within a 3rd party website using an existing oauth2 token

We're trying to allow a trusted 3rd party web application to automatically authenticate users in our own application. We thought about using oauth2 for that matter. In our scenario we would provide ...
2
votes
1answer
940 views

Why not oAuth for Authentication - AKA what is bad about OpenID Connect [duplicate]

I read many questions and answers on this forum stating that oAuth is for authorization, OpenID is for authentication and more than a few of them goes on to say that OpenID Connect provides ...
1
vote
0answers
365 views

Recommended End-User Authentication for OpenID Connect / OAuth 2 [closed]

I am learning about OAuth 2 and OpenID Connect. Reading the documentations I feel that the specification of OpenID Connect leaves some blank space regarding the End-User Authentication. The spec ...
1
vote
2answers
318 views

What is the purpose of the OAuth2 client secret?

A typical OAuth2 Authorization Code Flow scenario looks like this: What I'm not understanding is the purpose of the client secret in steps 6 and 7. If the auth server is guaranteed to redirect back ...
0
votes
2answers
676 views

3rd Party Mail Clients on iPhone/Android and Credential Storage

Normally when working with a user's credentials, i would store them locally on a device, never on a server because it creates unnecessary liability. For example, on iPhone we have Mail (default) ...

1
2