Questions tagged [oidc]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
33 views

Is it safe to store the OIDC token in a private field of a javascript object?

I would like to initialise a React application with an OIDC token. This token will be stored in a private field of the "api client" object. This object will be used to execute API calls and ...
Marco Altieri's user avatar
0 votes
0 answers
70 views

Man in the Middle Attack for OAuth 2's Authorize endpoint

We all know that the /authorize endpoint is a standard endpoint of OAuth 2. Below is how it's commonly called: GET /oauth2/authorize?client_id={client_id}&redirect_uri={redirect_uri}&...
Joms DV's user avatar
0 votes
1 answer
71 views

Should I use separate OIDC clients for RFC-8252 (OIDC w/ PKCE) client and my HTTP API?

I have a non-browser client (Desktop app) that makes HTTP requests to my API. I have the desktop client configured to use RFC-8252 (spawn an ephemeral HTTP server to handle the auth code flow's HTTP ...
Jon Wolski's user avatar
0 votes
1 answer
571 views

OIDC + Authentik: Which token to give to user for authentication?

I am implementing a web service with a front end and back end. Everything but the login endpoint requires authentication. For authentication I use Authentik. However, I have trouble wrapping my head ...
Tim's user avatar
  • 1
1 vote
0 answers
570 views

Use of nonce to prevent access token leakage in OIDC implicit flow?

Disclaimer: I know The OIDC implicit flow has been discouraged for a long time and I should use code flow on greenfields. Reasons include but are not limited to leakage of the authorization server ...
spinkus's user avatar
  • 111
0 votes
0 answers
208 views

Secure ADFS behind HAProxy

We use ADFS within our organisation, and it is available via HTTP externally. All of the applications we protect with ADFS are SP-initiated, so I want to disallow requests to ADFS other than SP-...
user1913559's user avatar
0 votes
0 answers
84 views

Is it worth replacing session based traditional auth with OpenID-Connect?

Details: traditional web-application with react frontend & nodejs API backend. FE & BE served on the same domain. FE -> example.com, API -> example.com/api We have users and some of the ...
Attila Kling's user avatar
3 votes
1 answer
220 views

Multi-tenant SPA with multiple OIDC providers

I'm building a multi-tenant app that has the unusual requirement of allowing tenants to use their own choice of external systems for login/authentication ie: tenant 1 uses Azure AD, tenant 2 uses ...
Neil Thompson's user avatar
0 votes
1 answer
68 views

IdP Personal/Signer Certificates

We are implementing SAML/OIDC-based SSO across our enterprise and wanted to get a feel for best practices when it comes to using Personal/Signer Certificates within our IdP. Historically we've ...
user1913559's user avatar
0 votes
0 answers
1k views

Using `react-oidc-context` and storing the `access_token` and `refresh_token` together

I am looking for a "best practises" approach for creating SPAs protected using OIDC + PKCE. Most of our applications are hosted on two independent web servers with a load balancer routing ...
user1913559's user avatar
0 votes
0 answers
37 views

What risks are there in using an OAuth2 access_token from an IdP that I do not control to secure an API that I do control?

Imagine I host some API. Its exact function is irrelevant to the question, but it needs to have some sort of authorization put in front of it. I want to call Google's APIs, so users can interact with ...
Richard Ward's user avatar
3 votes
0 answers
711 views

What are the risks of using wildcard in context path of OIDC/OAuth redirect_uri?

I'm using Keycloak for my authentication needs. It allows me to use * as wildcard when whitelisting redirect_uris for OIDC clients. What are the risks of using * in context path of redirect_uri? For ...
Fean Arnailes's user avatar
-1 votes
1 answer
36 views

Definition of Authorization according to OAuth2

I am trying to understand OAuth2 and OIDC. The OIDC glossary is a good starting point, and while it defines "Authentication", but does not actually define "Authorization". I ...
Andreas F's user avatar
  • 131
0 votes
1 answer
155 views

Downside of resource owner password flow for native mobile apps?

I have seen some similar questions a few years old and I am not sure if there are any new changing views on this. I see that this flow is not recommended for mobile native apps. What are the practical ...
jhurtas's user avatar
  • 101
1 vote
1 answer
175 views

3rd party mobile app access our service via our APIs

We have a microservice backend system & we expose APIs for our customers to use. We are now developing our Authentication system with our identity provider service. We have a customer(a company), ...
user842225's user avatar
1 vote
1 answer
589 views

What is the purpose of the ID Token if I can get the user info from the userinfo endpoint?

I am trying to understand OIDC and i dont see the purpose of the ID token if with just the access token, i can make a request to the userinfo endpoint and get the user info. What then is the purpose ...
Johnny Donalistic's user avatar
0 votes
2 answers
198 views

OpenId connect: Grant all available scopes in ClientCredentials flow

I have a microservice system with an OpenId connect Identity Provider, implemented with IdentityServer4. I have one special (very generic) service which needs to be able to communicate with all other ...
PhotonTamer's user avatar