Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with oauth
Search options answers only
not deleted
user 50051
OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.
2
votes
Does OAuth effectively mean allowing an app to do everything as me?
An OAuth access token has as much power as you give it. Usually, you get asked how much privilege you want to give through that access token at the moment you log in with the OAuth provider. … BUT, trusting a malicious application via OAuth is much better than giving it your password. …
- 7,011
0
votes
OAuth Authorization flow and redirect
It might be crazy, but the whole OAuth/OpenId security is based on the fact that your browser will do the right redirect. … Provider : The OAuth provider (Ex.: Google or Facebook)
Evil : The attacker. …
- 7,011
2
votes
Accepted
Create a web session from within a 3rd party website using an existing oauth2 token
You got things confused a bit. In OAuth2, you have 3 things :
OAuth2 Service Provider (acme in your example)
OAuth2 Client (3rd party in your example)
OAuth2 User (the browser of the physical user i …
- 7,011
6
votes
password grant without client secret?
There are multiple problems with what you are trying to do...
General Information
OAuth2 in the "traditional" way is not meant to be used on anything other than a webbrowser. This means that if you …
- 7,011
4
votes
Including a OAuth client_secret file in a Java application
You should not include the client secret in a javascript/desktop/mobile application
The reason is, like you said, it's very easy to access. You cannot protect it if you embedded it into your applicati …
- 7,011
2
votes
Accepted
OAuth 2.0 client side redirect instead of HTTP redirect
The roles
OAuth defines four roles:
resource owner :
An entity capable of granting access to a protected resource.
When the resource owner is a person, it is referred to as an
end-user. … I'm implementing an OAuth 2.0 resource server using the Authorization
Code flow (i.e. users will authorise client apps to connect to our
server). …
- 7,011
5
votes
OAuth2 and Authentication
@RaptisDimos gave a good answer but I think I will expend on point #3.
Why is OAuth2 implicit flow insecure for authentication while still secure for authorization?
The problem with the implicit f …
- 7,011
3
votes
What to use as 'state' in OAuth2 Authorization Code Grant workflow
Disclaimer : Couldn't find any reference on the subject so I will use a questionable tool called "logic". If someone find any good reference, please add them.
CSRF is dangereous
There is no doubt abou …
- 7,011
2
votes
Why do we trust session info over the wire but not an OAuth access token?
It might sounds crazy that OAuth allow something like that but it's true. OAuth just assume that the risk is acceptable because it was meant only for authorization and not authentication. … OAuth is only authorization.
OpenID is built on top of OAuth and add all the missing pieces that are required to provide authentication. …
- 7,011
4
votes
Accepted
Would this work to protect a cookie with an OAuth token?
You are not worrying about the right things
Protecting information located on the client?
You don't need to do anything once the information has reached your client (ex.: your browser) in order to pro …
- 7,011
3
votes
Accepted
Securing an OAuth / OpenID Connect identity in a cookie for easy login
Yes and no.
If done right it will be, but what you are describing is simply an authentication cookie.
I would suggest to not reinvent the wheel. The framework/programming language that you use proba …
- 7,011