Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [openid-connect]

OpenID Connect is an optional standardization of identify and profile data on top of OAuth 2.0 when OAuth is used for authentication.

Filter by
Sorted by
Tagged with
0 votes
1 answer
58 views

How OpenID over OAuth 2.0 can be trusted?

I am trying to implement "Login with Google/Apple etc..." on a web platform and I can't wrap my head around how you can trust the response that supposedly comes from the resource server ...
qUneT's user avatar
  • 3
0 votes
1 answer
47 views

How do AWS "Pod Identities" compare to (OIDC) IRSA?

In Kubernetes clusters, we often wish to provide temporary credentials to the containerised processes running in a particular pod, usually marked by associating the pod with a service account. ...
benjimin's user avatar
  • 165
1 vote
0 answers
77 views

OAuth2 OpenID Connect Third Party Initated Login with implicit flow

I'm working within a spec that uses the OpenID Connect third party initiated login + implicit flow. I first have to register my application with the third party, providing them a login initiation url, ...
ETLJ's user avatar
  • 11
1 vote
0 answers
95 views

Session/cookie expire time, match access token or refresh token from AD?

I am tasked with moving away from implicit flow in a SPA. It is a basic solution consisting of a react SPA and a .net API, on the same domain. This web app is a case management solution that deals ...
ryansan's user avatar
  • 113
3 votes
1 answer
446 views

OIDC with JWT in HTTP-only cookie instead of HTTP Authorization bearer header

I'm exploring the possibility of implementing OpenID Connect (OIDC) with an HTTP-only cookie to keep my frontend code completely authentication-agnostic, instead of passing the Authorization header ...
Luke 10X's user avatar
  • 131
2 votes
1 answer
131 views

Does an OIDC ID Token need validation in authorization-code flow?

In the OpenID Connect "authorisation-code flow" what security vulnerability is exposed, if the application relies on claims in the ID Token without validating that token? For example, Google ...
benjimin's user avatar
  • 165
0 votes
0 answers
122 views

URLs in JWT scope

During a pentest I have found a JWT that seems to be a refresh-token issued by some IAM software. The scope field in the JWT lists all the applications as URLs that this token can be used to obtain ...
John Nemo's user avatar
2 votes
1 answer
381 views

Is it dangerous to expose a front-channel logout endpoint that does not require authentication?

I have several apps connected to a single Identity Provider, which allows a Single SignOn experience for our users, and requires also a Single LogOut one. For the logout, any app will start the logout ...
Tao Gómez Gil's user avatar
2 votes
0 answers
178 views

Is there any sense in use of Authorization Code Binding To DPoP Key when client is confidential and uses PKCE?

This spec defined DPoP mechanism to bind cryptographically bind access tokens. There is also mention about authorization code binding. But hey, do you see any sense in it? Ok, it obviously is a way to ...
Szyszka947's user avatar
2 votes
1 answer
503 views

OIDC ID Token nonce as "poor mans digital signature"

In absence of better solutions, is the nonce is an OpenID Connect ID Token usable to serve as digital signature. The process would be as follows: A hash is created from the to-be-signed document/...
Cochise Ruhulessin's user avatar
2 votes
1 answer
1k views

Best Way to handle Authorization tokens on mobile apps

in our organization we have our own OpenId server (Identity Server) that we use to authenticate people into our applications, let me explain how we currently handle our web clients. so we have an API ...
MoTahir's user avatar
  • 121
0 votes
1 answer
417 views

Bearer JWT client authentication and access token issued by authorization server

An authorization server issues an access token with issuer details which are exposed in a well-known API of that server. This server uses client authentication JWT tokens with clients configured. ...
user890234's user avatar
0 votes
1 answer
269 views

Using id_token for all user data instead of userinfo endpoint in OIDC

I need to provide high security for user data. So I would have to encrypt userinfo_endpoint response (despite using TLS, these are the requirements I got). But encrypting userinfo_endpoint response ...
Szyszka947's user avatar
1 vote
0 answers
378 views

Sign vs hash HTTP body request

I use OAuth2 private_key_jwt authentication scheme to authenticate clients. Also, I need to be sure that request body isn't modified. I see two ways: In token which I use to authenticate client I can ...
Szyszka947's user avatar
2 votes
2 answers
1k views

Encrypted instead of signed access tokens in OAuth2

In OAuth2 access token is typically JWT signed by authorization server. Assuming that we will use Ed25519 to sign the JWT, we will have 128 bits of security. But what about access tokens that would be ...
Szyszka947's user avatar
1 vote
1 answer
192 views

Using certificate-constrained access tokens created by private key used to authentication (with private_key_jwt)

I have a OIDC provider that can't use mutual TLS authentication due to mTLS problems like certificates expiration (what if client didn't rotate certificate and it's expired now? Client cant ...
Szyszka947's user avatar
1 vote
1 answer
242 views

How SSO with OpenID and Azure AD works?

I try to understand how the integration we are using with OpenID works. I have read documents and different websites, but I feel that something escapes me related with SSO - I didn´t find so much ...
Kenzo_Gilead's user avatar
1 vote
0 answers
146 views

Access token lifetime when tokens are client certificate constrained

When we use mTLS we can use access tokens constrained to client certificate that was sent to token endpoint to receive the access token. In this case, if only the client that send this request can use ...
Szyszka947's user avatar
1 vote
0 answers
156 views

Encrypting authorization response with state

Imagine a authorization_code flow which MUST use PAR and after succeded authorization at authorization_endpoint instead of returning code and state returns only code, but this response is encrypted ...
Szyszka947's user avatar
1 vote
0 answers
77 views

Does using JARM make sense when we use PKCE and PAR?

Following FAPI we should use JARM within authorization response (redirection to client with state and code parameter). Does it make any sense, when we use PKCE and PAR? Even if attacker take over code ...
Szyszka947's user avatar
0 votes
0 answers
98 views

Attack using the same scope names within differents api resources with OpenID Connect / OAuth2

Assume that we have a client X and client Y. There's also api resources: api-resource-1 and api-resource-2, and api scopes: test.read and test.write. Client X is allowed to test.read within api-...
Szyszka947's user avatar
2 votes
1 answer
260 views

Handle authorization_code flow with Pushed Authorization Requests

When we use PAR, I see some problems: When we redirect user to login page we have to store (while user is on the login page) the same data as contained in request object referenced by request_uri (...
Szyszka947's user avatar
1 vote
2 answers
203 views

Using oauth for authentication

I understand that oauth is an Authorization protocol, but it is possible to use it for authentication when clubbed with something like open ID Connect. I am trying to understand why do we need an ...
gaurav5430's user avatar
0 votes
1 answer
121 views

When to use application layer encryption

When to use application layer encryption? Is it important in backchannel communication (machine-to-machine) without users? And e.g. when we create state in OpenID Connect's client and redirect the ...
Szyszka947's user avatar
1 vote
1 answer
352 views

How to manage long-term access to profile data using OIDC?

I am designing an ecosystem of web applications that uses an Open ID Connect (OIDC) authorization server. The users authenticate to the authorization server using the Authorization Code Flow with ...
DurandA's user avatar
  • 127
0 votes
0 answers
297 views

OpenID Connect for authenticating a web-api

I want to accomplish the following: Having a web application or mobile app authenticating users using openid connect. Having a REST Api authenticated using openid connect using the same user as for ...
Wilko van der Veen's user avatar
2 votes
1 answer
4k views

Why do big sites use cookies and not OpenID connect?

As I understand it, OAuth is the natural evolution of authentication protocols I understand in a general way that evolution is as follows: basic authentication cookies tokens, at this point you want ...
user60108's user avatar
  • 187
0 votes
1 answer
276 views

mTLS with OpenID Connect and validating self-signed certificates

OIDC says mTLS can be used to authenticate the client. But I haven't read anywhere whether the OIDC Provider is supposed to accept self-signed SSL certificates. Are there any dangers to accepting self-...
Szyszka947's user avatar
1 vote
0 answers
162 views

Passthrough authorization from web-application to web-api

I am designing an new web application with a web-api backend. We want to try using OpenID Connect and we are looking into the best way to authorize the user for the API. Setup: User logs in into ...
Wilko van der Veen's user avatar
0 votes
0 answers
195 views

Encrypted request object in OpenID Connect

When I want to use encrypted request object with OpenID Connect then my OIDC provider must know my client_secret (used in JWT request object encryption). For the server to decrypt this object, that is,...
Szyszka947's user avatar
0 votes
0 answers
191 views

OpenID Connect security issues

Recently, I started to wonder if OpenID Connect is really secure enough. I have analyzed tons of different sites and official documentation and so far I don't see any problems except that stealing ...
Szyszka947's user avatar
1 vote
2 answers
1k views

Is it safe to use email from OAuth for authentication?

I am implementing OAuth (more specifically "Sign in with Google") for a website that has been using only email and password for years. Now the guide that I'm reading suggests to read the uid ...
collimarco's user avatar
2 votes
1 answer
228 views

3rd party mobile app access our service via our APIs

We have a microservice backend system & we expose APIs for our customers to use. We are now developing our Authentication system with our identity provider service. We have a customer(a company), ...
user842225's user avatar
0 votes
0 answers
457 views

Using oauth2 to implement SSO between a desktop application and a web application

Is oauth2 designed to handle single-sign-on between a desktop application and a webapp? The scenario looks like this: The desktop app has a username/password login After a user is authenticated in ...
pulse00's user avatar
  • 43
0 votes
1 answer
268 views

Is passing an IDToken OK for seamless handover from app to website?

I am trying to assess the security implications for a session handover between an app and a website in the same company ecosystem. The Setup Mobile Application A and Website B use the same company ...
Vankog's user avatar
  • 103
0 votes
0 answers
233 views

HTTP Bearer authentication with multiple identity providers?

Suppose I have a web application that uses OpenID Connect to enable users to log in with one of several 3rd party identity providers (e.g., "log in with Google", "log in with Facebook&...
Richard Hansen's user avatar
3 votes
1 answer
1k views

What can attacker do with OpenID Connect id_token?

I have an application that stores the id_token in the localStorage of the browser. Since there is no CSP and Web Storage does not have the same protections such as cookies (HttpOnly, SameSite) this &...
John Nemo's user avatar
0 votes
1 answer
318 views

Modern security flow/process for trusted Mobile and SPA apps with self-hosted OIDC

Currently, there are two common auth flows i know: Resource Owner Password Flow Authentication Code Flow + PKCE (didn't mention other, since this one is more robust within redirect-based) This theme ...
uptoyou's user avatar
  • 101
0 votes
2 answers
325 views

OpenId connect: Grant all available scopes in ClientCredentials flow

I have a microservice system with an OpenId connect Identity Provider, implemented with IdentityServer4. I have one special (very generic) service which needs to be able to communicate with all other ...
PhotonTamer's user avatar
2 votes
2 answers
2k views

OpenID Connect with or without reverse proxy?

Many popular reverse proxies (tomcat, nginx, ...) seem to handle OpenID Connect and act as a Relying Party to hide the authentication complexity to all applications behind the reverse proxy, which ...
bobif's user avatar
  • 73
1 vote
1 answer
182 views

A Native Desktop App using PKCE - Can an id_token be consider valid authentication when passed to another protected server resource?

My understanding is that client impersonation cannot be prevented for Native Desktop Apps. If all standard controls: State, PKCE, Redirect_URI confirmation etc are in place, to prevent auth_code ...
Phatmandrake's user avatar
0 votes
1 answer
285 views

How to encrypt REST body with openid connect OIDC

The big picture is: an android application which authenticate user with an external openid provider (such as azure AD) a Java EE server which expose rest endpoints securized with the validation of ...
Francesco Clementi's user avatar
2 votes
1 answer
507 views

Openid nonce replay attack in auth code flow

Looking at this question Openid connect nonce replay attack and the answer by @benbotto. I understand the replay attack in implicit flow but unable to understand it for auth code flow. Let's say an ...
user267581's user avatar
0 votes
1 answer
623 views

Does "validating" a JWT token from prove authentication with OpenId?

I have a static react app which users login via an Okta SPA app. The app receives a JWT, which it is stored in the browser, and passed to the backend API via Authentication header on every request. ...
NSjonas's user avatar
  • 143
1 vote
1 answer
1k views

How to pentest oAuth2/oidc clients

imagine the following problem: As a developer, I would like to check if my oAuth2 or OpenID Connect client is really secure. I would like to check if it validates the JWT signature, uses the nonce etc....
rdmueller's user avatar
  • 2,763
1 vote
0 answers
116 views

What is Threat Profile is Microsoft addressing with the MSAL URI format?

Applications built for MSAL 1.0 and MSAL 2.0 have a default application URI of MSAL://GUIDHere/AppName This is in contrast with what other IDP's are doing. Can anyone explain the benefits or drawbacks ...
makerofthings7's user avatar
2 votes
0 answers
146 views

Does OIDC explicitly handle refresh token exchange for multiple devices?

This question is inspired by this answer and question I also use that method to handle the case where users can sign in and out of multiple devices, by storing a per-device refresh token for a device ...
Frank's user avatar
  • 159
3 votes
1 answer
1k views

Is PKCE really protecting public facing clients? Can't a rogue app steal the ClientID and Secret and make a AuthCode request of its own?

From what I have understood, for public facing clients such as JavaScript apps that run on the browser or mobile apps which have no backend there is no secure place to store client id and secret. ...
SamuraiJack's user avatar
1 vote
0 answers
499 views

Implement an SPA with IFrames, but with Single Sign-on

I want to build an SPA with ASP.NET Core (Blazor server side) which some IFrames redirecting to other applications. In this example I have f.e. the SPA, Grafana to show graphs and Node-Red, but there ...
Max R.'s user avatar
  • 141
1 vote
1 answer
395 views

In Open ID Connect, why is the id token a JWT token whereas the access token is not?

I know that the access token can be of any format(it is up to the authorization server), but I noticed that most of the times the access token is not a JWT whereas the id token is a JWT. Why is that ...
Nagarjuna Borra's user avatar

1
2 3 4 5