Questions tagged [oauth]

OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

Filter by
Sorted by
Tagged with
2
votes
1answer
3k views

Cookie + CSRF Token vs OAuth Token for Native Mobile Apps

We have an existing single-page web application powered by ASP.NET WebApi endpoints. These endpoints leverage SimpleMembership and Forms Authentication to handle authorization and authentication: ...
20
votes
3answers
7k views

What is the worst that can happen if your OAuth client secret is leaked?

Let's say you have an app which uses OAuth so app can log in to the user's services (e.g. OneDrive, Google Drive, etc.) Inside the app you have included the OAuth client secret (and client ID) as ...
6
votes
3answers
6k views

Use (or not use) OAuth for internal service to service communication in SOA

So we are a group of students making an online platform for our University. We are modelling our platform as a set of services. For example, a service "A" might store only personal information of ...
3
votes
1answer
557 views

Why are Synchronization Token and Cookie-to-Header patterns un-natural for Web APIs?

I have heard that CSRF prevention techniques are not natural for Web APIs. For instance, we might have a client application at domainA that implements both the Synchronization Token Pattern and the ...
3
votes
1answer
514 views

Why does the OAuth2 spec recommend that client credentials not be passed in the request body?

The OAuth 2.0 spec states that when authenticating with a client password, you may pass the client_id and client_secret using either: the Authorization header, using the HTTP Basic authentication ...
1
vote
0answers
372 views

What is the difference in implementation between HybridAuth and OpenID Connect?

I am installing a CMS login that is shared between two organizations, one a blog for community designed for ease of login and the other is a staff PHP application for a related nonprofit, to keep ...
1
vote
0answers
34 views

Is there an example where pseudo-authentication via oAuth fails? [duplicate]

OAuth should not be used for authentication, even though it sometimes is (Twitter explicitly suggests to). Are there good (realistic) examples where this pseudo-authentication paradigm fails?
1
vote
1answer
178 views

Reauthenticating a user for sensitive actions using OpenID

Normally, when you perform sensitive actions on a website, such as changing your password or enabling two factor authentication, you are required to reenter your password, presumably to protect ...
1
vote
3answers
421 views

Refreshing Access Token with Access Token

Does it make send to allow a web client app (JavaScript) to refresh Access Toke using Access Token (not Refresh Token) that is about to expire? What are the drawbacks of using this process?
1
vote
2answers
996 views

Is it safe to use OAuth (Resource Owner Password Credentials Grant) for authentication?

Specifically, do I have to worry about the confused deputy problem if I'm just trying to authorize a user against a single API? For example: a basic messaging service will want to authenticate and ...
1
vote
1answer
842 views

What is zero-legged OAuth (or does it exist)?

As I understand it, zero-legged OAuth is where the normally temporary token/secret codes are decided on beforehand and are made to not expire, so there's no authentication step needed before you make ...
1
vote
3answers
628 views

OAuth Authentication - Shared Secrets

I am planning to use the Flickr API in a Windows Universal (UWP) application, written in C#. Early on in my prototype I stumbled upon a security flaw that I have been unable to find a reasonable ...
2
votes
1answer
3k views

Sending access tokens from server to client best practice

I'm trying to write an app that will let a user see multiple Gmail inboxes at one time. I am storing the refresh token for each account in my database. However, I would like for almost all traffic to ...
0
votes
2answers
236 views

With OpenID, should I ever refresh/reauthenticate?

I'm using Google OAuth 2.0 to provide logins to my site(a rinkydink internal tool for other devs at my company to use, so security isn't paramount, but there are a few access restrictions) However, ...
0
votes
2answers
724 views

3rd Party Mail Clients on iPhone/Android and Credential Storage

Normally when working with a user's credentials, i would store them locally on a device, never on a server because it creates unnecessary liability. For example, on iPhone we have Mail (default) ...
7
votes
2answers
3k views

How would replacing Bearer tokens with HMAC work in OAuth 2.0, and how would the client/server validate?

This Pluralsight class discusses Bearer tokens, and that one of the things missing from OAuth 2.0 is HMAC based validation. Elsewhere on the thinktecture blogs, they are called PoP tokens (Proof of ...
4
votes
2answers
2k views

Does expiring the OAuth refresh token at the same time as the access token have any utility? Or is it just security theater?

We are integrating with a vendor who have a unique (to us) OAuth 2.0 implementation: with every refresh request, they send us a new refresh token along with the access token. They say that this was ...
3
votes
3answers
5k views

Renew access token for OAuth2 implicit grant

We want to use the OAuth2 Implicit Grant as it is proposed for single page applications. For JavaScript applications which don't have a classic web session. The applications only have access tokens ...
31
votes
3answers
23k views

Why is it a bad idea to use plain oauth2 for authentication?

TL;DR: What are the security implications of using oauth2 for authentication? I'm building an app (site A) that allows users to perform operations on another website (site B) through a simpler ...
6
votes
2answers
5k views

Secure OAuth 2 flow for client-side or mobile app

I'm implementing an API and a client-side web app, and they are supposed to communicate via an API and use OAuth 2 for authentication. I can't get over my confusion on what's the right way to ...
0
votes
2answers
6k views

OAuth2, microservices, and "keep me logged in" feature

I'm trying to learn more about authentication in microservices using OAuth2. I've been reading about OAuth2, and while I understand the basics, I have great difficulty understanding how everything ...
1
vote
0answers
1k views

OAuth 2.0 with webhooks

I am implementing an OAuth2-like flow using webhooks between two webservices (no browser/user-agent involved). The authentication server will grant access based on the URL of the webhook to which the ...
3
votes
1answer
1k views

What is the benefit of OAuth "one-time code flow (hybrid authentication)"?

With reference to the omniauth-google-oauth2 gem which describes what it calls "One-time Code Flow (Hybrid Authentication)" as such: This hybrid authentication flow has significant functional and ...
2
votes
1answer
10k views

iframe basic auth or token security

We have two sites, both are trusted. On site1 we store the username and password for the user for site2. We make api calls on site1's backend to site2 via basic auth (all over HTTPS). Despite the ...
2
votes
1answer
503 views

How to securely access web api from Html5 Website

So the thing is I have created a Asp.Net web api and am using oauth to secure the access. The problem is that the clients want to make a pure html(angular) website from which they will access the api. ...
1
vote
3answers
121 views

SecureData even for admins with external login

Given: A WebService which stores user Data and a server with a database. A Administrator which can acces the sever wit hthe webservice and the server with the database. Foreach user is a ...
2
votes
2answers
8k views

Identity and Access Management (IAM/IdAM) deployment guide

I'm working on a set of applications that require authentication and authorization. Can you point me in the right direction to some architecture design for this when I want to have multiple services ...
1
vote
1answer
64 views

Instant signin links for users from trusted third party sites

I'm owning web app "A" and want to work with a third party service "X". User "Alice" has accounts on both platforms. App A knows the user ID of alice on X, but X doesn't care about Alice being on A or ...
4
votes
1answer
794 views

Best practices for securing open APIs from quota theft

I know that appKey is not a means of authenticating applications. But I am wondering what are the best practices for avoiding quota theft for open APIs, that are not associated with any user account. ...
9
votes
1answer
14k views

Where should I store a refresh token

I'm building an oauth 2.0 protocol. I'm wondering how the refresh token works exactly. My understanding is that the use of a refresh token enable short lived access token and therefore limits the ...
-1
votes
1answer
2k views

What is this type of authentication with device id and token?

I'm trying to understand this strategy of authentication that I'm using to access resources of an enterprise. Basically, they have given me clientId and clientSecret, which I use to generate deviceId ...
0
votes
1answer
171 views

Authorizing an Android app to carry out operations on backend server

The users of my Android application can pay (using Paypal or in-app billing) to light a LED on a remote location. The LEDs are controlled, at each of the locations, by Internet-connected Arduinos. ...
1
vote
0answers
72 views

Why do I need to redirect in order to send the external OAuth2 authentication token to the client?

In an OAuth2 scenario: user confirmed his identity, allows the app to access his details server got the external access token I intend to respond directly with a local access token as opposed to ...
5
votes
1answer
2k views

Does the auth server have to be separate from the resource server when using OAuth 2.0?

I'm trying to implement OAuth 2.0 and I noticed in the spec they mention two servers - an auth server to pass access tokens back to and a resource server to use the access tokens on. My question is, ...
16
votes
4answers
13k views

JWT vs. Client Certificates

We have a transaction server that is connected to by different client applications. The requirement is to have a secure means of authentication for client applications to communicate with the ...
5
votes
0answers
710 views

How do we get a JWT bearer grant with required audience?

According to the OAuth JWT Bearer grant spec, a valid JWT should have some sort of identifier (token endpoint may be used) of the token issuing authorization server within the audience claim. The JWT ...
4
votes
3answers
495 views

Why is it required in OAuth 2.0 that refresh token cannot be guessed?

From RFC 6749 (section 10.4): The authorization server MUST ensure that refresh tokens cannot be generated, modified, or guessed to produce valid refresh tokens by unauthorized parties. I don't ...
1
vote
0answers
525 views

Security of GMail API full-access scope

Recently more and more online services are popping up to help manage the mail of Gmail, such as Boomerang, Gmelius and many others. To work correctly they require a full access scope to the gmail api,...
4
votes
1answer
141 views

How to cycle OAuth2 client secrets without downtime

I have an app that relies on several OAuth2 providers to poll for background data on behalf of users, as a background process. As a matter of best-practice, I'd like to periodically cycle my client ...
17
votes
1answer
533 views

Odd history of OAuth 2 device flow

OAuth 2 device flow has an odd history. It's found in early versions of the RFC, but was then taken out seemingly without an explanation I could find. Recently, a new draft was proposed specifically ...
3
votes
1answer
2k views

How is an authorization server supposed to require client auth for confidential clients?

The OAuth2 password grant_type states, If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate ...
11
votes
1answer
1k views

If I misuse OAuth 2.0 to do authentication, am I at risk?

I understand that OAuth is not an authentication protocol, but an authorization one (even if the first paragraph on Google's OAuth 2.0 page disagrees), as well as that: [...] authorization can be ...
6
votes
1answer
549 views

Any scenario for using both, OpenID Connect and OAuth 2.0?

Since OpenID Connect builds on OAuth 2.0, I am assuming that everything that is possible with OAuth 2.0 is also possible with OpenID Connect. In particular, say that my website stores some ...
6
votes
4answers
1k views

Authentication Middleware

We run a large distributed system consisting of a number (>10) of Django-based web services and web applications with a consumer base of about 10000 university students. Currently, we use a single ...
38
votes
3answers
36k views

How does JTI prevent a JWT from being replayed?

According to the JWT RFC a JWT can optionally have a JTI which I interpret to be a unique ID for a JWT. It seems like a UUID is a good value for a JTI. The RFC claims that the JTI can be used to ...
3
votes
1answer
344 views

Translate token into cookie

I find myself in a situation where I need to hand a user off from a mobile application into a web application. The mobile application is using WebAPI on the backend with OAUTH 2. The web application ...
0
votes
1answer
113 views

Protecting third-party credentials in a web database in light of weak passwords

I need to store third party credentials in a database for a web application. The third party supports OAUTH and I plan on getting a long-lived token to allow my app to access the third party, but I ...
3
votes
2answers
893 views

Google OAuth 2.0 and Java. Is it safe to locally store access tokens?

I Installed this Java app: https://github.com/andresoviedo/google-drive-ftp-adapter The program asks permission to see my Google-Drive files and then stores an access-token on my local harddisk. ...
3
votes
0answers
2k views

Token-based SSO for multiple domains for backend API requests

I’m in the process of setting up SSO for a service I’m creating. After looking at solutions, I’ve found nothing to fit exactly what we need. I’m looking to make sure from a security standpoint what we ...
3
votes
1answer
1k views

JWT authentication and authorization schema

I was going through Oauth2 docs and thought it was kind of permissive security wise, so i tried to implement JWT tokens with a special scheme like in the picture for a mobile app communicating with a ...

1
3 4
5
6 7
10