Questions tagged [openid]
An open Single Sign On (SSO) solution for the web, a problem also addressed by SAML.
98
questions
173
votes
7
answers
102k
views
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
53
votes
10
answers
6k
views
Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?
I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
- 631
45
votes
5
answers
9k
views
What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?
Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook.
One advantage ...
- 27.3k
44
votes
6
answers
17k
views
Can someone explain the "Covert Redirect" vulnerability in OAuth and OpenID?
CNet is reporting that all OpenID and OAuth sites are vulnerable to an attack called "Covert Redirect". What is this attack, how does it work, and as an end user, how can I mitigate the risk?
- 895
42
votes
3
answers
24k
views
Why isn't PKCE encouraged for Single-Page Apps?
A lot of services today still recommend the implicit flow for an OpenID Connect/Oauth2 token exchange when developing Single-Page Apps. (See Okta - now recommends PKCE w/ implicit fallback, Google, ...
- 766
37
votes
3
answers
38k
views
When do you use OpenID vs. OpenID Connect
Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context?
The reason I ask is because I'm trying to implement the following:
User "Bob"...
- 473
24
votes
4
answers
2k
views
How does using OpenID affect webapp security?
Using OpenID for authenticating users grows in popularity and, in fact, makes a webapp easier to use.
But what are the security considerations one should bear in mind when deciding whether to ...
- 2,127
22
votes
1
answer
7k
views
Does the practice of blocking an off-site "Referer:" HTTP requests improve website security?
Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites?
The pitch is that if such a HTTP request were to come in, then certain XSS ...
- 50.9k
21
votes
7
answers
2k
views
Appropriate password requirements for a login (OpenID) service/provider/delegate/thing
This is with regards* to Stack Exchange's upcoming OpenID provider (and in particular, discussion about password requirements).
Currently, password requirements are:
Must contain 3 of: lower case ...
- 311
21
votes
3
answers
600
views
Isn't openid with http an issue?
Many openid enabled sites default to http identifiers, even if the openid provider supports https (such as myopenid.com).
Does this pose a threat beside the identity being exposed? The second step of ...
- 27.3k
19
votes
2
answers
2k
views
Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML
It's clear there there is no consistent set of features among any of the popular authentication providers.
Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
- 50.9k
16
votes
2
answers
2k
views
Why is OpenID considered secure when password reuse is not?
OpenID allows you to use your e.g. Google/Facebook/Microsoft account to log into a third party website. It can be used to log into Stack Exchange.
Why is this considered an acceptable practice, ...
- 1,961
16
votes
4
answers
492
views
Are malicious relying parties able to abuse OpenID logins?
if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me?
Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...
- 3,313
15
votes
2
answers
15k
views
What are OpenID scopes and claims?
I need to implement SSO on our web API and I was reading about OpenID and IdentityServer. This is my first connection with SSO, OAuth and OpenID.
In the presentation movies I heard a lot about scopes ...
- 265
15
votes
3
answers
5k
views
Is there any drawback of using OAuth "pseudoauthentication" as opposed to OpenID?
I have seen posts that insist that OAuth is an orthogonally different thing from OpenID, because OpenID is about authenticating users, while OAuth is about giving access to certain services to a third ...
- 445
12
votes
4
answers
3k
views
Is Facebook Connect or Twitter OAuth PCI Compliant?
We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter.
Obviously this wouldn't be secure if we were trusting just any old ...
- 1,153
12
votes
2
answers
5k
views
How does openid implement Single sign on?
I'm wondering which security model is behind the OpenID. Is it anything like kerberos?
user705414
12
votes
1
answer
2k
views
What encryption prevents the tampering of Windows Identity Foundation (WIF) FedAuth cookies?
It occurred to me that the WIF FedAuth cookies contain identity information, that if tampered with, could permit someone to assume the identity of another user. Fortunately, WIF does ...
- 50.9k
11
votes
1
answer
745
views
Is logging in using OAuth/OpenID also vulnerable to heartbleed?
If one has logged into a "heartbleed-vulnerable" site using OpenID, for example, using Google to log into StackExchange, does that mean that the Google password is now at risk as well?
- 213
11
votes
2
answers
315
views
Does any OpenID identity provider allow site-unique arbitrary email addresses?
Since OpenID officially furnishes email address to sites (with the user's permission) as a convenience rather than an attestation, is there any OpenID identity provider who'll allow you to ...
- 331
10
votes
3
answers
2k
views
Usefulness of token sidejacking prevention mentioned by OWASP JWT Cheat Sheet
I was just reading through the "Token sidejacking" of the JWT Cheat Sheet of OWASP (https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet_for_Java.html#token-sidejacking)
At the ...
- 101
10
votes
2
answers
2k
views
How does an attacker abuse Facebook Connect with a leaked secret key?
I am reading about Facebook Connect and it looks a lot like OpenID Connect. Are these two similar enough that the Facebook Connect secret key is an OAuth Client Secret and therefore the same attacks ...
- 47.2k
8
votes
4
answers
2k
views
Is 'Bring your own Identity' as the only authentication option a valid practice?
This question is mainly aimed at OpenID Connect, when it is fully realized.
I understand the aversion to signing in with a social networking site, but from what I understand about OIDC, its supposed ...
- 2,007
8
votes
3
answers
2k
views
What authentication system (OpenID, Facebook, etc) permits Javascript-free and/or Cookie-Free operation?
I'm looking for an authentication system that relies on 3rd parties (ADFS, OpenID, SAML) but doesn't rely on cookies or Javascript... or at least can make them optional.
My intent is to gracefully ...
- 50.9k
8
votes
1
answer
306
views
Why does a web site operator need to trust an openid provider?
I am working on a web site and am considering using OpenID for authentication. The site will have some low cost ($3-$5) premium services, but will not be protecting particularly sensitive user data, ...
- 463
7
votes
4
answers
974
views
Isn't OpenID over HTTP (not HTTPS) fatally flawed when delegates are used?
First, I have a private delegate set up on my web site for OpenID and pointed my SE account at the URL on my web site; SE has no knowledge of the actual OpenID provider endpoint until my delegate ...
- 170
7
votes
1
answer
233
views
How to handle two sets of OpenID credentials providing the same information, on the same or different OpenID providers?
I recently encountered a situation where one site assumed that if two different people's credentials for the same OpenID network produce the same email address then they were they same person. Also, ...
- 595
6
votes
1
answer
711
views
Any scenario for using both, OpenID Connect and OAuth 2.0?
Since OpenID Connect builds on OAuth 2.0, I am assuming that everything that is possible with OAuth 2.0 is also possible with OpenID Connect.
In particular, say that my website stores some ...
- 163
6
votes
4
answers
1k
views
Authentication Middleware
We run a large distributed system consisting of a number (>10) of Django-based web services and web applications with a consumer base of about 10000 university students. Currently, we use a single ...
- 3,976
6
votes
1
answer
506
views
Open ID, Storing card details, and PCI compliance
If you store payment card details for a user, and you have a 'Login via openID' which includes services like Google and Facebook, is this allowed under PCI Compliance? Or do you need your own distinct ...
- 161
6
votes
2
answers
3k
views
Are JWT refresh tokens in browser really that bad?
Note: I fully acknowledge there may be something I'm missing in the picture, which is part of my reason for posting. I'd like to get the opinion of people more experienced than I am on authN/Z related ...
- 61
5
votes
1
answer
873
views
Are there risks of using the same OpenID provider for sites with different security levels?
I always use the same OpenID provider (Google, with a strong unique pw and 2-factor auth) in every site that supports it, without thinking twice. It's my understanding that, as long as the provider is ...
- 2,925
5
votes
1
answer
196
views
If a service that I registered with FB/Twitter/G+ is hacked, what mischief can be done with the oauth token?
Case in point, TrueCaller. I had logged into TC using a proxy twitter account. I am assuming that as part of the authentication process, an access_token must have been saved by TC.
If the hackers ...
- 193
5
votes
1
answer
150
views
What are the security challenges encountered with attribute exchange?
OpenID has Attribute Exchange, Facebook has Facebook Connect, and authorization services such as Oauth enable access to user data distributed across a range of content providers.
What are the security ...
- 221
4
votes
1
answer
14k
views
Why does OpenID Connect ("OIDC") use a `nonce` claim instead of the `jti` registered claim
According to the spec, OpenID Connect uses nonce as the registered claim name, but RFC 7519 already includes a registered claim named jti for this same purpose.
Was this an oversight, or was there ...
- 145
4
votes
2
answers
917
views
Google+ Sign In - One Time Code Flow vs Pure Server Side flow
I'm reading the documentation about Google+ Sign In, more specifically, its server side flow. It says (https://developers.google.com/+/web/signin/redirect-uri-flow) that one-time code flow has ...
- 231
4
votes
3
answers
242
views
implementing an authentication mechanism for understanding the basics of client authetication
I'm trying to implement a simple protocol to authenticate users and authorize them to access a certain web page/resource via a login form.
Please note that this is just something to use on my own and ...
- 41
4
votes
1
answer
782
views
How do I implement a Microsoft Login into my own website? [closed]
I am trying to make a website, which hosts a form for employees to enter their shift details into. The website itself is pretty basic, meaning it is mostly just HTML and PHP code.
Obviously I need to ...
4
votes
1
answer
2k
views
Securing a multi-tenant API with SSO and different roles per tenant
I am working on developing a REST API that will be used by first party clients that we develop, and third party clients in the future. The first party clients include a SPA client side application, ...
- 143
4
votes
1
answer
121
views
Do websites grant their own JWT token after successful OpenID/OAuth2 login?
I am looking at implementing an Authorization Code with PKCE grant on a mobile app to communicate to an API. What I am curious about is what applications currently do with the OpenID token that is ...
- 41
4
votes
0
answers
148
views
What are appropriate measures to only allow logins from a given trusted OpenID-Provider?
I have a bunch of applications, where users need to log in. Not everyone can be a user, each user has to be approved of by an admin. The authentication should be a SSO solution, where user accounts ...
- 191
3
votes
1
answer
917
views
SAML and OpenID, centralized and decentralized
I'm learning SAML, which is said to be centralized. To understand the difference with decentralized, I'm reading about OpenID.
I find it difficult to understand the difference between the two, ...
- 456
3
votes
1
answer
2k
views
Why is OAuth 2.0 being used for mobile devices, and not OpenID?
Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices.
Question
What ...
- 50.9k
3
votes
1
answer
563
views
What are the benefits of federated identity management over bare bones public key encryption?
What are the main reasons for having a federated identity system such as OpenID over having identities based purely on a public key?
OpenID uses an Identity Provider to confirm that a user owns a ...
- 221
3
votes
1
answer
1k
views
Should OIDC introspection endpoint be used to validate the JWT access token?
My resource server exposes an API that expects JWT access tokens obtained using OpenID Connect.
So far the validation in the resource server side consisted on using the Realm public key to validate ...
- 217
3
votes
1
answer
860
views
Google Open ID connect and ID token
I am wondering if it is safe to send "id token", which is one of the items that are result of authenticating a user using Google Open Id Connect, to the client and use it for further authentication.
...
- 231
3
votes
1
answer
1k
views
Are there any anonymous OpenID providers similar to Gawker's "burner"?
Gwaker has an anonymous commenting system called Burner. It is offered as an alternative to Facebook, Twitter and Google.
What's the difference between Burner and creating a throwaway Google , ...
- 50.9k
3
votes
1
answer
1k
views
OpenID Session Fixation with CSRF
This answer describes a situation where CSRF can be used to trick an end user to enter a credit card into another person's Paypal account. It also highlights the fact that state-changing GET requests ...
- 50.9k
2
votes
1
answer
3k
views
Is SSO without SSL possible and/or secure?
Lets imagine a site where HTTPS is not used, for any good or bad reasons. The admin of this site still need a way to secure connections and think about using unique authentication with social networks ...
- 541
2
votes
2
answers
2k
views
Is normal that a web site which use OpenID as SSO sends all the cookie without samesite header?
Is normal that a web site which uses OpenID as SSO sends all the cookie without samesite header?
Is this required in order to make OpenID work correctly?
- 567