Questions tagged [web-authentication]
The web-authentication tag has no usage guidance.
42 questions
0
votes
1
answer
81
views
Specific Security Risks in Decentralized Identity and Self-Sovereign Identity (SSI)
I am exploring Self-Sovereign Identity (SSI) as a decentralized approach to identity management, similar to how Bitcoin addresses financial systems through blockchain (as verifiable data registry (VDR)...
- 139
2
votes
1
answer
88
views
Storing a server secret in a user passkey user id
I want to implement passkey support as a full replacement for passwords but I have some server-side state that still needs to be encrypted to a specific user in a way that can not be decrypted or ...
- 123
1
vote
1
answer
45
views
Can I sufficiently protect my REST Service using shared Tokens?
I have a server exposing a REST service. I am thinking about a way to prevent unauthorized access to the service.
Setup
My current setup is as follows:
The server uses SSL.
There are exactly three ...
- 111
0
votes
0
answers
33
views
End user authN / authZ in a B2B2C setup
I am hosting a SaaS application that exposes an API and does authN using an API Key (M2M).
An organization can subscribe to this SaaS and consume the API. The end user (customer) of the organization ...
- 1
0
votes
1
answer
310
views
Do 2FA Codes on the same device defeat their purpose? [duplicate]
I have my iPhone connected to my MacBook and receive SMS codes on my computer, which is very convenient. I also recently learned you can have an authentication app on your MacBook too. I just wonder ...
- 329
-1
votes
1
answer
147
views
What 2FA should I use for my website login and what are the risks of 2FA?
Now I know this website is not for asking for specific software recommendations, but for my website for work purposes (as mentioned in another question,) I feel I need a more secure login protocol ...
- 3,035
0
votes
0
answers
520
views
httpOnly Session Cookies in an iframe context in the future w/o SameSite=None
My website is using session cookies (w/ SameSite=Lax, secure, httpOnly attributes) and a CSRF Token stored in localStorage. Recently I developed a teams app, which essentially loads the website ...
0
votes
0
answers
88
views
storing user hashed password into webauthn id
I am building a pure client-side app.
My users have a .kdbx vault stored in localStorage, and they can open it with a password.
In order to add a biometric\quick open feature into the app I thought ...
- 101
1
vote
1
answer
252
views
Are JWT's needed when implementing passwordless magic link authentication?
I'm working on a web application where a user gains access by clicking on a magic link sent to them by an internal co-worker. Upon clicking this link, the user is automatically authenticated and a ...
0
votes
0
answers
355
views
Refresh-token rotation without additional frontend requests
I'm implementing a refresh-token rotation mechanism. For the sake of simplicity in implementing the frontend I would like to remove the need for requesting a new access token when an old one expires.
...
- 101
-1
votes
1
answer
209
views
PATCH request on a login attempt
I have a problem deciding what is the most secure method to send a login request with a username and password strings, I understood that PATCH is less secure than PUT while both are less secure than ...
0
votes
1
answer
333
views
Google Security Cookies; Prevents cookie leak to malicious XHRs
Below is an excerpt from https://policies.google.com/technologies/cookies#security
The ‘pm_sess’, ‘YSC’ and ‘AEC’ cookies ensure that requests within a
browsing session are made by the user, and not ...
1
vote
1
answer
111
views
Authentication on public availble Restful API
We are using an API from a third party for managing content which is secured by an API key which does not change over time. Now we are building our own API to support part of that functionality.
So ...
1
vote
1
answer
119
views
Does using TouchID and WebAuthn with a password manager defeat the 2FA?
For quite some time WebKit and others support WebAuthn. This allows for a pretty seamless 2FA experience with a key, like Yubico. On Apple devices TouchID/FaceID can also be used as a hardware key.
...
- 141
1
vote
1
answer
144
views
Interpreting OWASP prohibition: no sensitive-account login to any frontend interface
OWASP’s Authentication Cheat Sheet states unequivocally:
Do NOT allow login with sensitive accounts (i.e. accounts that can be used internally within the solution such as to a back-end / middle-ware /...
- 143
2
votes
1
answer
946
views
Creating secure website-based login for a desktop app
This question relates to this post I made on StackOverflow recently, which I'll recap here briefly.
I have a desktop app that I would like to authenticate through a website, using the process outlined ...
- 123
0
votes
1
answer
373
views
What security concerns can arise from using HTTP Basic-Authentication? [duplicate]
During an engagement, i have been asked by a client to explain (with the use of one
or more examples) why they must update their website authentication mechanism,
as they are currently using HTTP ...
0
votes
0
answers
443
views
Authenticating (getting token) by making Http request
As the topic is a bit vague I have decided to ask you guys here what do you think and what is the best practice in given scenario.
Disclaimer: I am programmer, and although I know a bit about ...
- 101
0
votes
1
answer
1k
views
HTTP authentication with client-side private key
I'm designing a web service meant for storing data for users, but these users don't have proper server-side accounts, just a random master key the user generated and stores on their device (a bip39 ...
- 111
3
votes
3
answers
1k
views
Hashing sessions and retrieving them using cookie(s) with session "id" and "token"
I'm implementing custom authentication & session management system in Node.js & PostgreSQL. My goal is to implement sessions that expire after 2 weeks (if not refreshed/renewed).
OWASP and ...
22
votes
4
answers
4k
views
How will biometrics be a safe way to authenticate users across the internet?
Let's say Alice created a new account on a service and this service saved her fingerprint as a way of logging in later. Then Alice creates a new account on a new service, but unfortunately this second ...
- 1,229
30
votes
9
answers
6k
views
When does 'something you have' NOT become 'something you know'?
I am currently trying to get an understanding of multi factor authentication. The biggest issue so far: When does "something you have" NOT get reduced to "something you know"? I ...
- 737
2
votes
1
answer
691
views
CORS configuration for service with single browser client
Please note: although I mention Spring Boot (and by proxy, Java) I believe this is a pure HTTP/web development question at heart, and as such, can be answered by anyone with CORS-configuration ...
- 347
1
vote
3
answers
270
views
Use-case for decentralized identifiers (DIDs) with unique identities for each relationship
The W3C working group is working on the standardization of Decentralized Identifiers (DIDs). I watched a video presentation about DIDs and the presenter mentioned several times the possibility of ...
- 137
18
votes
4
answers
7k
views
Is it possible to calculate an encryption key when both the plain text and ciphertext are known?
I have implemented an authentication system which works like this:
Upon successful login, the server takes the username of client and encrypts it with AES-256.
This ciphertext is stored in the ...
- 684
1
vote
2
answers
139
views
Is access token confidentiality also ensured in the Authorization Code grant type in Oauth2.0
One of the really nice articles I came across while trying to understand the various grant types in Oauth2.0 was this. The author really has done a good job at explaining quite clearly what various ...
- 1,522
1
vote
2
answers
299
views
How can I give users access to thier data without requiring any authentication? [closed]
The premise of this question boils down to frictionless access to data. I have User A whose records I have kept on a database.
I want to send them a link to their records such that they can access ...
3
votes
1
answer
693
views
Web Authentication Offline
I've been working on a project and one of the requirements that came up is offline authentication. On the web what we would like to do is ask the user to login using their device authentication for ...
- 33
2
votes
2
answers
2k
views
Is it necessary to force a newly registered user to login?
In a web application, is there a security advantage to forcing a newly registered user to manually log into their account, or is it safe to automatically log in a new registration? Assume that the ...
- 121
1
vote
1
answer
371
views
If we're signing the id we send to the client, why not send the user id instead of session id?
I am learning about auth and session management, and using express-session in Node js. I am not able to find the need for this package. I read a about it online, but didn't get a satisfying answer. ...
- 13
0
votes
0
answers
740
views
Is caching the credentials hash and auth result secure?
I have an API that is handling a lot of volume and is using Basic authorization. This is causing me some performance issues and I'd like to move to token based auth but for various reasons, including ...
2
votes
1
answer
413
views
Authenticate limited client devices from server without login process
I have limited client devices and one server.
I want to create a client-server secure connection while app installation but don't want human-interaction between devices and server like registration or ...
- 121
0
votes
1
answer
316
views
How safe is my login system (conceptually)?
I implemented a 2FA authentication for a web app with PHP and Google Authenticator. In order to login to my system there are a few steps:
User types in a complex master password in order to access ...
- 145
8
votes
2
answers
4k
views
How good are Angular Route Guards from a security standpoint?
For an enterprise setting, how secure are Route Guards against script kiddies, hackers, and advanced threats?
If I understand correctly, the route guards are all available in .js files to the ...
- 1,675
2
votes
1
answer
709
views
How does the browser know windows logged in user id or Kerberos TGT?
My organization uses SSO for its applications i.e. Once a user logs into his Windows 10 workstation, he accesses his web application without login. I was informed that the web applications uses NetIQ ...
- 167
3
votes
1
answer
3k
views
Browser not generating kerberos ticket
Firstly, please apologise me if I'm still confused about stuff here, Kerberos auth is quite the complex issue for a java dev
So, I have the following scenario:
A suite of webapps which use kerberos ...
- 83
3
votes
0
answers
147
views
Comprehensive list of mechanisms that automatically send authentication information in browsers
I'm trying to come up with a list of built-in mechanisms that either automatically send authentication information or automatically prompt the user to provide them in browsers.
So far I have
...
- 941
0
votes
2
answers
915
views
Is it a bad practice to send sensitive information(like a session id) in the aspx response?
Lets say I have an aspx login page which validates user credentials, obtains a session id and then redirects to the home page in the following way.
login.aspx:
var sessionId = ValidateCredentials();
...
- 325
1
vote
1
answer
250
views
FIDO2: will FIDO foundation MDS 1.0 metadata statements be migrated to MDS 2.0?
The FIDO foundation provides with metadata web service for UAF (MDS 1.0, https://mds.fidoalliance.org/) and a new web services for FIDO2 / WebAuthn metadata (MDS 2.0, see https://fidoalliance.org/...
- 453
3
votes
3
answers
4k
views
Why are ASP.NET form authentication cookies deleted only on client side if client side can't be trusted?
ASP.NET documentation says:
FormsAuthentication.SignOut()
Removes the forms-authentication ticket from the browser
Why is the cookie not invalidated at the server as well? It would be easy ...
- 1,152
1
vote
1
answer
2k
views
how wifi web authentication works?
Some wifi are open networks, but when we connect, it redirects to a web page for authentication. How does this work? how the future packets will be authenticated? Does it bind IP and MAC address (...
- 11
1
vote
1
answer
251
views
What is the motivation behind supporting both `none` and `self` attestation in WebAuthN?
WebAuthN seems to provide essentially two different ways of not performing verifiable attestation: Either by the Relying Party requesting none or by the authenticator choosing self attestation.
Is ...
- 4,283