Questions tagged [openid-connect]
OpenID Connect is an optional standardization of identify and profile data on top of OAuth 2.0 when OAuth is used for authentication.
201
questions
0
votes
0
answers
65
views
URLs in JWT scope
During a pentest I have found a JWT that seems to be a refresh-token issued by some IAM software.
The scope field in the JWT lists all the applications as URLs that this token can be used to obtain ...
- 98
1
vote
0
answers
148
views
Is it dangerous to expose a front-channel logout endpoint that does not require authentication?
I have several apps connected to a single Identity Provider, which allows a Single SignOn experience for our users, and requires also a Single LogOut one.
For the logout, any app will start the logout ...
- 111
0
votes
0
answers
81
views
Is there any sense in use of Authorization Code Binding To DPoP Key when client is confidential and uses PKCE?
This spec defined DPoP mechanism to bind cryptographically bind access tokens. There is also mention about authorization code binding.
But hey, do you see any sense in it? Ok, it obviously is a way to ...
- 309
3
votes
1
answer
422
views
OIDC ID Token nonce as "poor mans digital signature"
In absence of better solutions, is the nonce is an OpenID Connect ID Token usable to serve as digital signature. The process would be as follows:
A hash is created from the to-be-signed document/...
1
vote
1
answer
351
views
Best Way to handle Authorization tokens on mobile apps
in our organization we have our own OpenId server (Identity Server) that we use to authenticate people into our applications, let me explain how we currently handle our web clients.
so we have an API ...
- 111
0
votes
1
answer
262
views
Bearer JWT client authentication and access token issued by authorization server
An authorization server issues an access token with issuer details which are exposed in a well-known API of that server. This server uses client authentication JWT tokens with clients configured. ...
- 101
0
votes
0
answers
86
views
Is it worth replacing session based traditional auth with OpenID-Connect?
Details: traditional web-application with react frontend & nodejs API backend. FE & BE served on the same domain. FE -> example.com, API -> example.com/api
We have users and some of the ...
- 141
0
votes
1
answer
158
views
Using id_token for all user data instead of userinfo endpoint in OIDC
I need to provide high security for user data. So I would have to encrypt userinfo_endpoint response (despite using TLS, these are the requirements I got).
But encrypting userinfo_endpoint response ...
- 309
1
vote
0
answers
245
views
Sign vs hash HTTP body request
I use OAuth2 private_key_jwt authentication scheme to authenticate clients. Also, I need to be sure that request body isn't modified.
I see two ways:
In token which I use to authenticate client I can ...
- 309
2
votes
2
answers
743
views
Encrypted instead of signed access tokens in OAuth2
In OAuth2 access token is typically JWT signed by authorization server. Assuming that we will use Ed25519 to sign the JWT, we will have 128 bits of security.
But what about access tokens that would be ...
- 309
1
vote
1
answer
91
views
Using certificate-constrained access tokens created by private key used to authentication (with private_key_jwt)
I have a OIDC provider that can't use mutual TLS authentication due to mTLS problems like certificates expiration (what if client didn't rotate certificate and it's expired now? Client cant ...
- 309
1
vote
1
answer
131
views
How SSO with OpenID and Azure AD works?
I try to understand how the integration we are using with OpenID works. I have read documents and different websites, but I feel that something escapes me related with SSO - I didn´t find so much ...
- 113
1
vote
0
answers
93
views
Access token lifetime when tokens are client certificate constrained
When we use mTLS we can use access tokens constrained to client certificate that was sent to token endpoint to receive the access token. In this case, if only the client that send this request can use ...
- 309
1
vote
0
answers
90
views
Encrypting authorization response with state
Imagine a authorization_code flow which MUST use PAR and after succeded authorization at authorization_endpoint instead of returning code and state returns only code, but this response is encrypted ...
- 309
1
vote
0
answers
32
views
Does using JARM make sense when we use PKCE and PAR?
Following FAPI we should use JARM within authorization response (redirection to client with state and code parameter). Does it make any sense, when we use PKCE and PAR? Even if attacker take over code ...
- 309
0
votes
0
answers
48
views
Attack using the same scope names within differents api resources with OpenID Connect / OAuth2
Assume that we have a client X and client Y. There's also api resources: api-resource-1 and api-resource-2, and api scopes: test.read and test.write.
Client X is allowed to test.read within api-...
- 309
2
votes
1
answer
181
views
Handle authorization_code flow with Pushed Authorization Requests
When we use PAR, I see some problems:
When we redirect user to login page we have to store (while user is on the login page) the same data as contained in request object referenced by request_uri (...
- 309
1
vote
2
answers
150
views
Using oauth for authentication
I understand that oauth is an Authorization protocol, but it is possible to use it for authentication when clubbed with something like open ID Connect.
I am trying to understand why do we need an ...
- 283
0
votes
1
answer
86
views
When to use application layer encryption
When to use application layer encryption? Is it important in backchannel communication (machine-to-machine) without users?
And e.g. when we create state in OpenID Connect's client and redirect the ...
- 309
1
vote
1
answer
259
views
How to manage long-term access to profile data using OIDC?
I am designing an ecosystem of web applications that uses an Open ID Connect (OIDC) authorization server. The users authenticate to the authorization server using the Authorization Code Flow with ...
- 127
0
votes
0
answers
207
views
OpenID Connect for authenticating a web-api
I want to accomplish the following:
Having a web application or mobile app authenticating users using openid connect.
Having a REST Api authenticated using openid connect using the same user as for ...
1
vote
1
answer
3k
views
Why do big sites use cookies and not OpenID connect?
As I understand it, OAuth is the natural evolution of authentication protocols
I understand in a general way that evolution is as follows:
basic authentication
cookies
tokens, at this point you want ...
- 177
0
votes
1
answer
209
views
mTLS with OpenID Connect and validating self-signed certificates
OIDC says mTLS can be used to authenticate the client. But I haven't read anywhere whether the OIDC Provider is supposed to accept self-signed SSL certificates. Are there any dangers to accepting self-...
- 309
1
vote
0
answers
87
views
Passthrough authorization from web-application to web-api
I am designing an new web application with a web-api backend. We want to try using OpenID Connect and we are looking into the best way to authorize the user for the API.
Setup:
User logs in into ...
0
votes
0
answers
145
views
Encrypted request object in OpenID Connect
When I want to use encrypted request object with OpenID Connect then my OIDC provider must know my client_secret (used in JWT request object encryption). For the server to decrypt this object, that is,...
- 309
0
votes
0
answers
124
views
OpenID Connect security issues
Recently, I started to wonder if OpenID Connect is really secure enough. I have analyzed tons of different sites and official documentation and so far I don't see any problems except that stealing ...
- 309
0
votes
2
answers
739
views
Is it safe to use email from OAuth for authentication?
I am implementing OAuth (more specifically "Sign in with Google") for a website that has been using only email and password for years.
Now the guide that I'm reading suggests to read the uid ...
- 133
1
vote
1
answer
177
views
3rd party mobile app access our service via our APIs
We have a microservice backend system & we expose APIs for our customers to use. We are now developing our Authentication system with our identity provider service.
We have a customer(a company), ...
- 61
0
votes
0
answers
354
views
Using oauth2 to implement SSO between a desktop application and a web application
Is oauth2 designed to handle single-sign-on between a desktop application and a webapp?
The scenario looks like this:
The desktop app has a username/password login
After a user is authenticated in ...
- 43
0
votes
1
answer
195
views
Is passing an IDToken OK for seamless handover from app to website?
I am trying to assess the security implications for a session handover between an app and a website in the same company ecosystem.
The Setup
Mobile Application A and Website B use the same company ...
- 103
0
votes
0
answers
180
views
HTTP Bearer authentication with multiple identity providers?
Suppose I have a web application that uses OpenID Connect to enable users to log in with one of several 3rd party identity providers (e.g., "log in with Google", "log in with Facebook&...
- 396
3
votes
1
answer
833
views
What can attacker do with OpenID Connect id_token?
I have an application that stores the id_token in the localStorage of the browser.
Since there is no CSP and Web Storage does not have the same protections such as cookies (HttpOnly, SameSite) this &...
- 98
0
votes
1
answer
260
views
Modern security flow/process for trusted Mobile and SPA apps with self-hosted OIDC
Currently, there are two common auth flows i know:
Resource Owner Password Flow
Authentication Code Flow + PKCE (didn't mention other, since this one is more robust within redirect-based)
This theme ...
- 101
0
votes
2
answers
198
views
OpenId connect: Grant all available scopes in ClientCredentials flow
I have a microservice system with an OpenId connect Identity Provider, implemented with IdentityServer4.
I have one special (very generic) service which needs to be able to communicate with all other ...
2
votes
2
answers
1k
views
OpenID Connect with or without reverse proxy?
Many popular reverse proxies (tomcat, nginx, ...) seem to handle OpenID Connect and act as a Relying Party to hide the authentication complexity to all applications behind the reverse proxy, which ...
- 63
1
vote
1
answer
148
views
A Native Desktop App using PKCE - Can an id_token be consider valid authentication when passed to another protected server resource?
My understanding is that client impersonation cannot be prevented for Native Desktop Apps. If all standard controls: State, PKCE, Redirect_URI confirmation etc are in place, to prevent auth_code ...
- 123
0
votes
1
answer
225
views
How to encrypt REST body with openid connect OIDC
The big picture is:
an android application which authenticate user with an external openid provider (such as azure AD)
a Java EE server which expose rest endpoints securized with the validation of ...
2
votes
0
answers
344
views
Openid nonce replay attack in auth code flow
Looking at this question Openid connect nonce replay attack and the answer by @benbotto. I understand the replay attack in implicit flow but unable to understand it for auth code flow. Let's say an ...
- 21
0
votes
1
answer
514
views
Does "validating" a JWT token from prove authentication with OpenId?
I have a static react app which users login via an Okta SPA app.
The app receives a JWT, which it is stored in the browser, and passed to the backend API via Authentication header on every request.
...
- 143
1
vote
1
answer
1k
views
How to pentest oAuth2/oidc clients
imagine the following problem:
As a developer, I would like to check if my oAuth2 or OpenID Connect client is really secure.
I would like to check if it validates the JWT signature, uses the nonce etc....
- 2,713
1
vote
0
answers
92
views
What is Threat Profile is Microsoft addressing with the MSAL URI format?
Applications built for MSAL 1.0 and MSAL 2.0 have a default application URI of MSAL://GUIDHere/AppName
This is in contrast with what other IDP's are doing.
Can anyone explain the benefits or drawbacks ...
- 50.7k
2
votes
0
answers
118
views
Does OIDC explicitly handle refresh token exchange for multiple devices?
This question is inspired by this answer and question
I also use that method to handle the case where users can sign in and out of multiple devices, by storing a per-device refresh token for a device ...
- 159
1
vote
1
answer
886
views
Is PKCE really protecting public facing clients? Can't a rogue app steal the ClientID and Secret and make a AuthCode request of its own?
From what I have understood, for public facing clients such as JavaScript apps that run on the browser or mobile apps which have no backend there is no secure place to store client id and secret. ...
- 111
1
vote
0
answers
427
views
Implement an SPA with IFrames, but with Single Sign-on
I want to build an SPA with ASP.NET Core (Blazor server side) which some IFrames redirecting to other applications. In this example I have f.e. the SPA, Grafana to show graphs and Node-Red, but there ...
- 141
1
vote
1
answer
260
views
In Open ID Connect, why is the id token a JWT token whereas the access token is not?
I know that the access token can be of any format(it is up to the authorization server), but I noticed that most of the times the access token is not a JWT whereas the id token is a JWT. Why is that ...
- 315
6
votes
1
answer
4k
views
When using PKCE, are the state and nonce parameters still necessary protection from csrf and code injection?
When I'm using the authorization code flow with PKCE do I still need state and nonce?
For state (that prevents login-csrf), if an attacker sends me a malicious Authorization Response, the client may ...
- 552
1
vote
0
answers
75
views
Why do some "OAuth" providers ask for personal info?
I don't mean to start another OAuth vs OpenID discussion, but I want to share the underlying cause of my confusion.
When I want a Client to process my google docs for something, I have to go through ...
- 141
1
vote
0
answers
111
views
Change of domain without having to log in again
The question concerns the idea of transferring sessions between domains without having to log in again.
I would like to do it like this:
(user is logged in and changes the language to a language from ...
- 11
2
votes
3
answers
2k
views
Does OpenID Connect provide CSRF and XSS protection?
I've been reading several articles recently about how storing JWTs in local or session storage is inherently insecure. The mitigation is apparently to implement a "session ID pattern", i.e. ...
2
votes
0
answers
653
views
Keycloak and Open ID Connect best practices
I'm a bit lost as to the best practice surrounding a production-ready access management based on keycloak and open id connect.
My understanding is that if you use Keycloak's provided adapters, instead ...
- 21