Questions tagged [oidc]
The oidc tag has no usage guidance.
17
questions
1
vote
1
answer
33
views
Is it safe to store the OIDC token in a private field of a javascript object?
I would like to initialise a React application with an OIDC token.
This token will be stored in a private field of the "api client" object. This object will be used to execute API calls and ...
- 653
0
votes
0
answers
70
views
Man in the Middle Attack for OAuth 2's Authorize endpoint
We all know that the /authorize endpoint is a standard endpoint of OAuth 2. Below is how it's commonly called:
GET /oauth2/authorize?client_id={client_id}&redirect_uri={redirect_uri}&...
- 1
0
votes
1
answer
71
views
Should I use separate OIDC clients for RFC-8252 (OIDC w/ PKCE) client and my HTTP API?
I have a non-browser client (Desktop app) that makes HTTP requests to my API.
I have the desktop client configured to use RFC-8252 (spawn an ephemeral HTTP server to handle the auth code flow's HTTP ...
- 135
0
votes
1
answer
571
views
OIDC + Authentik: Which token to give to user for authentication?
I am implementing a web service with a front end and back end. Everything but the login endpoint requires authentication. For authentication I use Authentik. However, I have trouble wrapping my head ...
- 1
1
vote
0
answers
570
views
Use of nonce to prevent access token leakage in OIDC implicit flow?
Disclaimer: I know The OIDC implicit flow has been discouraged for a long time and I should use code flow on greenfields. Reasons include but are not limited to leakage of the authorization server ...
- 111
0
votes
0
answers
208
views
Secure ADFS behind HAProxy
We use ADFS within our organisation, and it is available via HTTP externally.
All of the applications we protect with ADFS are SP-initiated, so I want to disallow requests to ADFS other than SP-...
- 105
0
votes
0
answers
84
views
Is it worth replacing session based traditional auth with OpenID-Connect?
Details: traditional web-application with react frontend & nodejs API backend. FE & BE served on the same domain. FE -> example.com, API -> example.com/api
We have users and some of the ...
- 141
3
votes
1
answer
220
views
Multi-tenant SPA with multiple OIDC providers
I'm building a multi-tenant app that has the unusual requirement of allowing tenants to use their own choice of external systems for login/authentication
ie: tenant 1 uses Azure AD, tenant 2 uses ...
- 131
0
votes
1
answer
68
views
IdP Personal/Signer Certificates
We are implementing SAML/OIDC-based SSO across our enterprise and wanted to get a feel for best practices when it comes to using Personal/Signer Certificates within our IdP.
Historically we've ...
- 105
0
votes
0
answers
1k
views
Using `react-oidc-context` and storing the `access_token` and `refresh_token` together
I am looking for a "best practises" approach for creating SPAs protected using OIDC + PKCE.
Most of our applications are hosted on two independent web servers with a load balancer routing ...
- 105
0
votes
0
answers
37
views
What risks are there in using an OAuth2 access_token from an IdP that I do not control to secure an API that I do control?
Imagine I host some API. Its exact function is irrelevant to the question, but it needs to have some sort of authorization put in front of it. I want to call Google's APIs, so users can interact with ...
- 194
3
votes
0
answers
711
views
What are the risks of using wildcard in context path of OIDC/OAuth redirect_uri?
I'm using Keycloak for my authentication needs. It allows me to use * as wildcard when whitelisting redirect_uris for OIDC clients. What are the risks of using * in context path of redirect_uri? For ...
-1
votes
1
answer
36
views
Definition of Authorization according to OAuth2
I am trying to understand OAuth2 and OIDC. The OIDC glossary is a good starting point, and while it defines "Authentication", but does not actually define "Authorization". I ...
- 131
0
votes
1
answer
155
views
Downside of resource owner password flow for native mobile apps?
I have seen some similar questions a few years old and I am not sure if there are any new changing views on this.
I see that this flow is not recommended for mobile native apps. What are the practical ...
- 101
1
vote
1
answer
175
views
3rd party mobile app access our service via our APIs
We have a microservice backend system & we expose APIs for our customers to use. We are now developing our Authentication system with our identity provider service.
We have a customer(a company), ...
- 61
1
vote
1
answer
589
views
What is the purpose of the ID Token if I can get the user info from the userinfo endpoint?
I am trying to understand OIDC and i dont see the purpose of the ID token if with just the access token, i can make a request to the userinfo endpoint and get the user info. What then is the purpose ...
0
votes
2
answers
198
views
OpenId connect: Grant all available scopes in ClientCredentials flow
I have a microservice system with an OpenId connect Identity Provider, implemented with IdentityServer4.
I have one special (very generic) service which needs to be able to communicate with all other ...
