OpenID Connect is an optional standardization of identify and profile data on top of OAuth 2.0 when OAuth is used for authentication.
2
votes
1answer
39 views
OIDC Hybrid flow
I'm trying to understand the Hybrid flow of OIDC. Am I correct in thinking that an authentication request is made to the authorization endpoint, which then responds with the authorization code, id ...
0
votes
1answer
18 views
Bypassing OpenID Connect audience claim with implicit grant
As an example, let's look at how authentication works with Kubernetes:
Specifically, let's focus on what the api server does. To authenticate the request, it:
Verifies that the JWT signature is ...
2
votes
1answer
33 views
Authorization on OAuth2 application that is both Client and Resource Server
I am trying to understand how would an application which uses OAuth2 (OIDC) server implement access control to its own resources.
In this case, the application is both 'Client' and 'Resource server' ...
0
votes
0answers
106 views
Auth0 vs Firebase = oidc vs Firebase Tokens
I am trying to choose between Auth0 and Firebase as my identity provider. I am building a SPA with a Backend API and I would like to use Auth0 or Firebase for all the logic regarding users/passwords/...
0
votes
1answer
32 views
OIDC - what is the point of two separate tokens - access and id?
I struggle to understand why don't we just have a single token that serves both purposes - authorisation and authentication?
In some sense, the access token does more than just authorisation. It also ...
0
votes
0answers
108 views
Token Exchange at a REST API Gateway to federate authentication while maintaining detailed authorization (think ABAC) within the API?
I'm on the verge of creating a service within our resource server that would exchange an externally generated access token for an internally generated access token. However, this feels wrong. I have ...
1
vote
1answer
278 views
Why does OpenID Connect (“OIDC”) use a `nonce` claim instead of the `jti` registered claim
According to the spec, OpenID Connect uses nonce as the registered claim name, but RFC 7519 already includes a registered claim named jti for this same purpose.
Was this an oversight, or was there ...
2
votes
0answers
59 views
Web application making a call to a REST API when already authenticated
I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
0
votes
0answers
17 views
Open ID Connect: Second ID-Token only has “sub” attribute
I am implementing a customer-IAM solution using WSO2 Identity Server 4.5.1. One of the (few) applications integrating with me via Open ID connect has discovered an unexpected behaviour, and I need ...
2
votes
0answers
48 views
Is passing claims about the user in an access token “abusing” OpenID Connect?
First, let me assure you that I have read a number of posts on the topic before asking this question, but I am still confused and would appreciate more insights.
So, here's the premise:
There is a ...
0
votes
1answer
26 views
Non-standard OIDC flow: How safe is this?
I have been made aware of an application, at a client, that claims to use OIDC to authenticate users. This is however done via a non-standard flow that I find hard to assess from a security standpoint....
1
vote
1answer
409 views
Implicit flow login from SPA
Looking at the implicit flow to login with https://github.com/IdentityModel/oidc-client-js and https://github.com/IdentityServer/IdentityServer4.Samples/tree/release/Quickstarts/7_JavaScriptClient . ...
8
votes
1answer
898 views
Why isn't PKCE encouraged for Single-Page Apps?
A lot of services today still recommend the implicit flow for an OpenID Connect/Oauth2 token exchange when developing Single-Page Apps. (See Okta, Google, Auth0)
Some newer guidance out there points ...
1
vote
1answer
52 views
OpenID Connect, OAuth2, and deleted accounts
If I use OpenID Connect or OAuth2 for authentication, and a customer deletes his/her OAuth2 provider (Facebook) account, how can I safely associate a new authentication with a different OAuth2 ...
2
votes
0answers
57 views
OAuth2 Implicit Flow. Additional protection for access_token from interception
We have a one-page JavaScript application that authenticates the user on our server using the OAuth 2.0 protocol (and the AddId-Connect add-in). After authentication, the server issues an access_token ...
1
vote
0answers
198 views
OAuth2 Implicit Flow and silent autologin by Windows Identity. Possible new attack vectors?
We have a typical Single-Page js application that authenticates to our own authentication server using the OAuth 2.0 protocol (and the OpenId-Connect add-in). The customer sent a request to implement ...
2
votes
0answers
559 views
Protecting frontend code for SPA + Restful API with OIDC
I've got an Angular 1 SPA with a Restful API that I'd like to restrict access to. As I understand, typically the OIDC Implicit flow is designed just for this. However, I consider the frontend SPA code ...
1
vote
2answers
50 views
Does the OpenID Connect Core specification incorrectly define the OpenID Provider and Relying Party in terms of human participants?
There are a few important definitions in the OpenID Connect Core specification that refer to a human participant, and at first glance it would seem that OpenID Connect only applies in cases where ...
0
votes
0answers
27 views
Security implication of sending my id token to a service instead of an auth token
Due to API issues with Azure OpenId Connect I have the following workflow with a web app and web service. I control both.
Web app living in Azure generates an id_token
Web app sends id token as ...
3
votes
2answers
88 views
How can an end-user verify the authenticity of a third-party authentication provider's login form
Given the ubiquitous use of third party authentication providers in web apps today, how can end-users verify the authenticity of the login forms that collect their credentials? What's to stop a ...
0
votes
1answer
481 views
OpenID Connect: How to maintain a single sign-on experience between multiple web clients of the same umbrella application?
I'm considering how to take a fairly complex tiered application with multiple web apps that delegate back to the same application server, and migrate it to use OIDC authentication with auth code flow. ...
3
votes
0answers
28 views
Is there an use-case for checking the signature of an id_token using a js-app or a native-app
Let's say I am developing an client-based application for android/ios or a javascript application for any browser.
To identify a user, I'll use OpenIdConnect with the implicit flow.
The IDP will ...
2
votes
1answer
313 views
OpenID Connect/OAuth 2.0 and “fake” official apps
My question mostly pertains to OpenID Connect, but can be applied to OAuth 2.0 as well.
When it comes to an OpenID Connect Client doing the "authorize" dance with the OpenID Connect Provider, the ...
0
votes
1answer
529 views
localStorage vs. HTTP-Only Cookies + XSRF: Is either better when it comes to XSS?
If I were to implement a common OpenID Connection pattern on a SPA, I might have the following relationship:
Auth server <-----------> Client (browser) <-----------> App API server
The ...
0
votes
1answer
177 views
Preventing CSRF with implicit flow and JWTs?
I'm reading through openid connect document ATM and it says:
Put into a browser cookie the ID token can be used to implement lightweight stateless sessions.
IIUC we want to avoid using cookies in ...
1
vote
1answer
97 views
Authentication providers for applications with no internet connection
I have an interesting use case where users need to authenticate to applications running in environments that might not have internet access or even access to an authentication server. Administrators ...
3
votes
0answers
324 views
Using the authorization code grant without using cookies?
I've been reading up on this for months and it seems like the whole thing could converge on what I'm summarizing below. I'm trying to arrive at the most ideal:
OAuth2
OpenID Connect
SPA / Mobile ...
4
votes
1answer
244 views
Is it ok to write OidC Bearer token to log?
During development we added to error logs details of http requests, including headers, to have better understanding for error investigation. Our architect pointed that we should not place sensitive ...
3
votes
0answers
41 views
c_hash claim in id_token and IdP MixUp mitigation
My understanding is that the c_hash claim in the id_token is used to prevent IdPMixUp attacks (http://openid.net/2016/07/16/preventing-mix-up-attacks-with-openid-connect/).
I have two doubts:
is the ...
4
votes
1answer
539 views
Security differences between fb connect and openid connect
I've been reading a lot about why plain oauth is bad for authentication, and one needs to at least build on top of it to reach an acceptable level of security.
That got me looking at the major ...
9
votes
1answer
642 views
Why can’t I use query Response Mode with id_token Response Type (“implicit” flow)?
Although I think OpenID 2.0 is a cleaner and better authentication protocol than OpenID Connect, I have to implement an OpenID Connect IdP.
One point I like in OpenID 2.0 is that the IdP can return a ...
2
votes
1answer
233 views
What web authentication protocol?
I need to implement a web-based authentication protocol so users I know can be given access to a third-party web application. I will work with the developers of that web application to implement both ...
3
votes
1answer
128 views
OAuth: Long running access in downstream systems - how to refresh token?
In case of OAuth2 and OpenID Connect user authorized AppA to access AppB service. Now AppB needs to access AppC and it uses the bearer token received from AppA (suppose the scope of that token ...
0
votes
1answer
87 views
Is it possible to analyze real Single Sign-On (SSO) messages via network sniffing?
I am thinking how to gain and analyze the information in the real SSO (request/response) messages, for some commercial SSO solutions.
The challenge is that most commercial SSO solutions are black-box ...
1
vote
1answer
91 views
Is JSON web token further secured in OpenID, and how?
I have read the details of pure JSON web token (JWT), and found that it is signed (e.g. by SHA256) but not encrypted. Hence, attack can read the sensitive information by decoding the header and ...
5
votes
2answers
531 views
How do I correctly use CORS with OpenID Connect?
There seems to be a number of questions on several blogs, Q&A sites, and comments that ask variants of the question:
How do I correctly use CORS with OpenID Connect?
The context of these ...
1
vote
1answer
94 views
Who is the special OpenID Connect URL “self-issued.me” issued to, and is it a risk?
OpenID Connect defines a special use case for self-issued.me and it's registered overseas to what I assume is a fictional name.
What is the risk of someone owning this domain w.r.t. OpenID Connect?
...
1
vote
1answer
198 views
When does OpenID Connect return JSON?
Whereas OAuth2 doesn't explicitly define which token type to use, OpenID Connect defines an API and data format to perform OAuth2 authorization flows.
What are the occasions in which a JWT is ...
1
vote
0answers
117 views
Is there any reason the Well-Known OpenID discovery endpoint is not signed?
Unlike WS-Federation/WS-Trust metadata, the OpenID discovery endpoint is not signed. This results in a number of threats that are possible on this endpoint.
Is there any justification in not signing ...
3
votes
3answers
5k views
Why is OAuth2/OpenID Connect considered less secure than SAML/WS-*?
The prevailing notion seems to be that OAuth2 and OpenID Connect are considered less secure than SAML/WS-Federation. From what I gather, it comes down to encryption - i.e. the fact that OAuth2/Open ID ...
9
votes
0answers
883 views
Openid connect nonce replay attack
The openid connect specification adds a nonce parameter to the authorize endpoint, which must be echoed back as a claim in the id_token. It claims that the purpose of this parameter is to prevent ...
5
votes
1answer
2k views
Is CORS ever needed during any aspect of OAuth / OpenIDConnect Authentication?
I'm looking at OpenIDConnect authentication and trying to determine if either "simple CORS" or "complex CORS" is ever leveraged during authentication or authorization.
Background
A Simple CORS (...
1
vote
0answers
210 views
OpenID Connect Standard: Authorized Party azp Contradiction
In the OpenID Connect spec the azp (authorized party) claim seems to have a contradiction.
In the ID token definition section 2 it says:
azp
OPTIONAL. Authorized party - the party to which ...
3
votes
2answers
109 views
Is it reasonable to allow Google sign-in for people who signed up “normally”?
I've been thinking - let's say a user signs up for your site in the "standard" way. That is, they enter an e-mail address, maybe a user name, and a password, and complete the sign-up process. Is it ...
1
vote
1answer
194 views
What is the security benefit of using PostMessage instead of a callback URL in OAuth/OIDC?
Of all the issuers I've found, (Facebook, Twitter, Azure AD, etc) only Apple's CloudKit has the feature of "post message" as a callback (unless it's buried in the other's SDK)
Here is a screenshot of ...
3
votes
1answer
671 views
Why does OpenID Connect use id token as a querystring parameter on logout?
OpenID Connect, in the implicit flow, returns the id token as a #fragment on the return URI specifically so that the id token doesn't get logged in web server logs.
However, the OpenID Connect logout ...
0
votes
1answer
99 views
What is the difference of the word “Open” in OpenID vs. OpenID Connect
I am having a hard time in understanding the concept of OpenId and OpenId Connect. Both of them have the word "Open" in them but there is a difference in the meaning. Why is this so?
1
vote
0answers
468 views
Is it enough to check the Audience of OAuth2 Access tokens?
I am investigating using Social Login for a web service fronted by Web-based portals and Mobile applications. The idea is to "Authenticate" the user and let the service create an "API-Key" once the ...
0
votes
1answer
238 views
Why are Synchronization Token and Cookie-to-Header patterns un-natural for Web APIs?
I have heard that CSRF prevention techniques are not natural for Web APIs.
For instance, we might have a client application at domainA that implements both the Synchronization Token Pattern and the ...
1
vote
0answers
256 views
What is the difference in implementation between HybridAuth and OpenID Connect?
I am installing a CMS login that is shared between two organizations, one a blog for community designed for ease of login and the other is a staff PHP application for a related nonprofit, to keep ...
