Questions tagged [openid-connect]

OpenID Connect is an optional standardization of identify and profile data on top of OAuth 2.0 when OAuth is used for authentication.

Filter by
Sorted by
Tagged with
0 votes
0 answers
65 views

URLs in JWT scope

During a pentest I have found a JWT that seems to be a refresh-token issued by some IAM software. The scope field in the JWT lists all the applications as URLs that this token can be used to obtain ...
John Nemo's user avatar
1 vote
0 answers
148 views

Is it dangerous to expose a front-channel logout endpoint that does not require authentication?

I have several apps connected to a single Identity Provider, which allows a Single SignOn experience for our users, and requires also a Single LogOut one. For the logout, any app will start the logout ...
Tao Gómez Gil's user avatar
0 votes
0 answers
81 views

Is there any sense in use of Authorization Code Binding To DPoP Key when client is confidential and uses PKCE?

This spec defined DPoP mechanism to bind cryptographically bind access tokens. There is also mention about authorization code binding. But hey, do you see any sense in it? Ok, it obviously is a way to ...
Szyszka947's user avatar
3 votes
1 answer
422 views

OIDC ID Token nonce as "poor mans digital signature"

In absence of better solutions, is the nonce is an OpenID Connect ID Token usable to serve as digital signature. The process would be as follows: A hash is created from the to-be-signed document/...
Cochise Ruhulessin's user avatar
1 vote
1 answer
351 views

Best Way to handle Authorization tokens on mobile apps

in our organization we have our own OpenId server (Identity Server) that we use to authenticate people into our applications, let me explain how we currently handle our web clients. so we have an API ...
MoTahir's user avatar
  • 111
0 votes
1 answer
262 views

Bearer JWT client authentication and access token issued by authorization server

An authorization server issues an access token with issuer details which are exposed in a well-known API of that server. This server uses client authentication JWT tokens with clients configured. ...
user190245's user avatar
0 votes
0 answers
86 views

Is it worth replacing session based traditional auth with OpenID-Connect?

Details: traditional web-application with react frontend & nodejs API backend. FE & BE served on the same domain. FE -> example.com, API -> example.com/api We have users and some of the ...
Attila Kling's user avatar
0 votes
1 answer
158 views

Using id_token for all user data instead of userinfo endpoint in OIDC

I need to provide high security for user data. So I would have to encrypt userinfo_endpoint response (despite using TLS, these are the requirements I got). But encrypting userinfo_endpoint response ...
Szyszka947's user avatar
1 vote
0 answers
245 views

Sign vs hash HTTP body request

I use OAuth2 private_key_jwt authentication scheme to authenticate clients. Also, I need to be sure that request body isn't modified. I see two ways: In token which I use to authenticate client I can ...
Szyszka947's user avatar
2 votes
2 answers
743 views

Encrypted instead of signed access tokens in OAuth2

In OAuth2 access token is typically JWT signed by authorization server. Assuming that we will use Ed25519 to sign the JWT, we will have 128 bits of security. But what about access tokens that would be ...
Szyszka947's user avatar
1 vote
1 answer
91 views

Using certificate-constrained access tokens created by private key used to authentication (with private_key_jwt)

I have a OIDC provider that can't use mutual TLS authentication due to mTLS problems like certificates expiration (what if client didn't rotate certificate and it's expired now? Client cant ...
Szyszka947's user avatar
1 vote
1 answer
131 views

How SSO with OpenID and Azure AD works?

I try to understand how the integration we are using with OpenID works. I have read documents and different websites, but I feel that something escapes me related with SSO - I didn´t find so much ...
Kenzo_Gilead's user avatar
1 vote
0 answers
93 views

Access token lifetime when tokens are client certificate constrained

When we use mTLS we can use access tokens constrained to client certificate that was sent to token endpoint to receive the access token. In this case, if only the client that send this request can use ...
Szyszka947's user avatar
1 vote
0 answers
90 views

Encrypting authorization response with state

Imagine a authorization_code flow which MUST use PAR and after succeded authorization at authorization_endpoint instead of returning code and state returns only code, but this response is encrypted ...
Szyszka947's user avatar
1 vote
0 answers
32 views

Does using JARM make sense when we use PKCE and PAR?

Following FAPI we should use JARM within authorization response (redirection to client with state and code parameter). Does it make any sense, when we use PKCE and PAR? Even if attacker take over code ...
Szyszka947's user avatar
0 votes
0 answers
48 views

Attack using the same scope names within differents api resources with OpenID Connect / OAuth2

Assume that we have a client X and client Y. There's also api resources: api-resource-1 and api-resource-2, and api scopes: test.read and test.write. Client X is allowed to test.read within api-...
Szyszka947's user avatar
2 votes
1 answer
181 views

Handle authorization_code flow with Pushed Authorization Requests

When we use PAR, I see some problems: When we redirect user to login page we have to store (while user is on the login page) the same data as contained in request object referenced by request_uri (...
Szyszka947's user avatar
1 vote
2 answers
150 views

Using oauth for authentication

I understand that oauth is an Authorization protocol, but it is possible to use it for authentication when clubbed with something like open ID Connect. I am trying to understand why do we need an ...
gaurav5430's user avatar
0 votes
1 answer
86 views

When to use application layer encryption

When to use application layer encryption? Is it important in backchannel communication (machine-to-machine) without users? And e.g. when we create state in OpenID Connect's client and redirect the ...
Szyszka947's user avatar
1 vote
1 answer
259 views

How to manage long-term access to profile data using OIDC?

I am designing an ecosystem of web applications that uses an Open ID Connect (OIDC) authorization server. The users authenticate to the authorization server using the Authorization Code Flow with ...
DurandA's user avatar
  • 127
0 votes
0 answers
207 views

OpenID Connect for authenticating a web-api

I want to accomplish the following: Having a web application or mobile app authenticating users using openid connect. Having a REST Api authenticated using openid connect using the same user as for ...
Wilko van der Veen's user avatar
1 vote
1 answer
3k views

Why do big sites use cookies and not OpenID connect?

As I understand it, OAuth is the natural evolution of authentication protocols I understand in a general way that evolution is as follows: basic authentication cookies tokens, at this point you want ...
user60108's user avatar
  • 177
0 votes
1 answer
209 views

mTLS with OpenID Connect and validating self-signed certificates

OIDC says mTLS can be used to authenticate the client. But I haven't read anywhere whether the OIDC Provider is supposed to accept self-signed SSL certificates. Are there any dangers to accepting self-...
Szyszka947's user avatar
1 vote
0 answers
87 views

Passthrough authorization from web-application to web-api

I am designing an new web application with a web-api backend. We want to try using OpenID Connect and we are looking into the best way to authorize the user for the API. Setup: User logs in into ...
Wilko van der Veen's user avatar
0 votes
0 answers
145 views

Encrypted request object in OpenID Connect

When I want to use encrypted request object with OpenID Connect then my OIDC provider must know my client_secret (used in JWT request object encryption). For the server to decrypt this object, that is,...
Szyszka947's user avatar
0 votes
0 answers
124 views

OpenID Connect security issues

Recently, I started to wonder if OpenID Connect is really secure enough. I have analyzed tons of different sites and official documentation and so far I don't see any problems except that stealing ...
Szyszka947's user avatar
0 votes
2 answers
739 views

Is it safe to use email from OAuth for authentication?

I am implementing OAuth (more specifically "Sign in with Google") for a website that has been using only email and password for years. Now the guide that I'm reading suggests to read the uid ...
collimarco's user avatar
1 vote
1 answer
177 views

3rd party mobile app access our service via our APIs

We have a microservice backend system & we expose APIs for our customers to use. We are now developing our Authentication system with our identity provider service. We have a customer(a company), ...
user842225's user avatar
0 votes
0 answers
354 views

Using oauth2 to implement SSO between a desktop application and a web application

Is oauth2 designed to handle single-sign-on between a desktop application and a webapp? The scenario looks like this: The desktop app has a username/password login After a user is authenticated in ...
pulse00's user avatar
  • 43
0 votes
1 answer
195 views

Is passing an IDToken OK for seamless handover from app to website?

I am trying to assess the security implications for a session handover between an app and a website in the same company ecosystem. The Setup Mobile Application A and Website B use the same company ...
Vankog's user avatar
  • 103
0 votes
0 answers
180 views

HTTP Bearer authentication with multiple identity providers?

Suppose I have a web application that uses OpenID Connect to enable users to log in with one of several 3rd party identity providers (e.g., "log in with Google", "log in with Facebook&...
Richard Hansen's user avatar
3 votes
1 answer
833 views

What can attacker do with OpenID Connect id_token?

I have an application that stores the id_token in the localStorage of the browser. Since there is no CSP and Web Storage does not have the same protections such as cookies (HttpOnly, SameSite) this &...
John Nemo's user avatar
0 votes
1 answer
260 views

Modern security flow/process for trusted Mobile and SPA apps with self-hosted OIDC

Currently, there are two common auth flows i know: Resource Owner Password Flow Authentication Code Flow + PKCE (didn't mention other, since this one is more robust within redirect-based) This theme ...
uptoyou's user avatar
  • 101
0 votes
2 answers
198 views

OpenId connect: Grant all available scopes in ClientCredentials flow

I have a microservice system with an OpenId connect Identity Provider, implemented with IdentityServer4. I have one special (very generic) service which needs to be able to communicate with all other ...
PhotonTamer's user avatar
2 votes
2 answers
1k views

OpenID Connect with or without reverse proxy?

Many popular reverse proxies (tomcat, nginx, ...) seem to handle OpenID Connect and act as a Relying Party to hide the authentication complexity to all applications behind the reverse proxy, which ...
bobif's user avatar
  • 63
1 vote
1 answer
148 views

A Native Desktop App using PKCE - Can an id_token be consider valid authentication when passed to another protected server resource?

My understanding is that client impersonation cannot be prevented for Native Desktop Apps. If all standard controls: State, PKCE, Redirect_URI confirmation etc are in place, to prevent auth_code ...
Phatmandrake's user avatar
0 votes
1 answer
225 views

How to encrypt REST body with openid connect OIDC

The big picture is: an android application which authenticate user with an external openid provider (such as azure AD) a Java EE server which expose rest endpoints securized with the validation of ...
Francesco Clementi's user avatar
2 votes
0 answers
344 views

Openid nonce replay attack in auth code flow

Looking at this question Openid connect nonce replay attack and the answer by @benbotto. I understand the replay attack in implicit flow but unable to understand it for auth code flow. Let's say an ...
user267581's user avatar
0 votes
1 answer
514 views

Does "validating" a JWT token from prove authentication with OpenId?

I have a static react app which users login via an Okta SPA app. The app receives a JWT, which it is stored in the browser, and passed to the backend API via Authentication header on every request. ...
NSjonas's user avatar
  • 143
1 vote
1 answer
1k views

How to pentest oAuth2/oidc clients

imagine the following problem: As a developer, I would like to check if my oAuth2 or OpenID Connect client is really secure. I would like to check if it validates the JWT signature, uses the nonce etc....
rdmueller's user avatar
  • 2,713
1 vote
0 answers
92 views

What is Threat Profile is Microsoft addressing with the MSAL URI format?

Applications built for MSAL 1.0 and MSAL 2.0 have a default application URI of MSAL://GUIDHere/AppName This is in contrast with what other IDP's are doing. Can anyone explain the benefits or drawbacks ...
makerofthings7's user avatar
2 votes
0 answers
118 views

Does OIDC explicitly handle refresh token exchange for multiple devices?

This question is inspired by this answer and question I also use that method to handle the case where users can sign in and out of multiple devices, by storing a per-device refresh token for a device ...
Frank's user avatar
  • 159
1 vote
1 answer
886 views

Is PKCE really protecting public facing clients? Can't a rogue app steal the ClientID and Secret and make a AuthCode request of its own?

From what I have understood, for public facing clients such as JavaScript apps that run on the browser or mobile apps which have no backend there is no secure place to store client id and secret. ...
SamuraiJack's user avatar
1 vote
0 answers
427 views

Implement an SPA with IFrames, but with Single Sign-on

I want to build an SPA with ASP.NET Core (Blazor server side) which some IFrames redirecting to other applications. In this example I have f.e. the SPA, Grafana to show graphs and Node-Red, but there ...
Max R.'s user avatar
  • 141
1 vote
1 answer
260 views

In Open ID Connect, why is the id token a JWT token whereas the access token is not?

I know that the access token can be of any format(it is up to the authorization server), but I noticed that most of the times the access token is not a JWT whereas the id token is a JWT. Why is that ...
Nagarjuna Borra's user avatar
6 votes
1 answer
4k views

When using PKCE, are the state and nonce parameters still necessary protection from csrf and code injection?

When I'm using the authorization code flow with PKCE do I still need state and nonce? For state (that prevents login-csrf), if an attacker sends me a malicious Authorization Response, the client may ...
BenjaminH's user avatar
  • 552
1 vote
0 answers
75 views

Why do some "OAuth" providers ask for personal info?

I don't mean to start another OAuth vs OpenID discussion, but I want to share the underlying cause of my confusion. When I want a Client to process my google docs for something, I have to go through ...
user1164937's user avatar
1 vote
0 answers
111 views

Change of domain without having to log in again

The question concerns the idea of transferring sessions between domains without having to log in again. I would like to do it like this: (user is logged in and changes the language to a language from ...
A.Sobolev's user avatar
2 votes
3 answers
2k views

Does OpenID Connect provide CSRF and XSS protection?

I've been reading several articles recently about how storing JWTs in local or session storage is inherently insecure. The mitigation is apparently to implement a "session ID pattern", i.e. ...
Nikolai Prokoschenko's user avatar
2 votes
0 answers
653 views

Keycloak and Open ID Connect best practices

I'm a bit lost as to the best practice surrounding a production-ready access management based on keycloak and open id connect. My understanding is that if you use Keycloak's provided adapters, instead ...
luke's user avatar
  • 21

1
2 3 4 5