Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with oauth
Search options answers only
not deleted
user 8340
OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.
21
votes
Accepted
How secure are expiring tokens and refresh tokens?
It could be that the access token might end up being used around the application over plain HTTP connections. So if an attacker sniffed it, they would only have short term access. This is what used to …
- 34.4k
2
votes
Accepted
Prevent CSRF attack using regular expression, session storage, and auth token?
Browser session storage isn't automatically sent by the browser when a cross domain request is initiated. Therefore, as you are adding the auth token manually, this acts as a CSRF defence in its own r …
- 34.4k
1
vote
Why should I include a client_id in an OAUTHv2 password grant request?
From RFC 6749 (emphasis mine):
A client MAY use the "client_id" request parameter to identify itself
when sending requests to the token endpoint. In the
"authorization_code" "grant_type" request to …
- 34.4k
3
votes
Accepted
Is it secure to use the same token as both refresh token and access token?
If you're in control of both the client and the server and you can ensure that both tokens are always transmitted securely, there is no drawback in using the same token for both.
Normally, the refres …
- 34.4k
6
votes
Accepted
OAuth + Confused Deputy + access token verification + state parameter
I believe proper use of the OAuth "state" parameter can also prevent
this vulnerability. … Their is nothing in the OAuth client-side
flow that proves the issuer you sent the request to through the
browser ever received it and is the one responding. …
- 34.4k
6
votes
Accepted
If I misuse OAuth 2.0 to do authentication, am I at risk?
Imagine you are using OAuth to authenticate users within your application.
However, an evil developer has their own application which also uses OAuth. … Say their application is a Solitaire game, which uses Google's OAuth API. A user authenticates for Solitaire using their Google account. …
- 34.4k
2
votes
Renew access token for OAuth2 implicit grant
If you control the CAS then it is upto you how you access a new access token.
Since your user has already authorised the SPA using your CAS, if the session is still valid with the CAS there is no need …
- 34.4k
6
votes
How does JTI prevent a JWT from being replayed?
How does a JTI prevent a JWT from being replayed?
How often should the JTI field be regenerated? On every request? or only when a new token is generated?
I believe the answers to these tw …
- 34.4k