3
votes
is mTLS authentication alone considered secure for authentication
Yes, mutual TLS (mTLS) is sufficient for client authentication.
With mutual TLS, the client knows it is actually talking to the server, and the server is actually talking to the client. Both parties ...
1
vote
Simplest federated authentication protocol: is this the right way to do it?
This is what the original OpenID wanted to do.
And it’s basically how Kerberos works with its tickets.
Problem 1: identification, how does z.com verify A@a.com is actually A, and not A’ pretending to ...
1
vote
Accepted
Is csrf protection required for extremely short lived cookies?
CSRF requires user interaction to be exploited.
So unless you expect a user to access the attacker website within the 1 second period after executing your script, I wouldn't consider the likelihood of ...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
authentication × 4463passwords × 561
web-application × 415
tls × 345
encryption × 321
multi-factor × 300
oauth × 209
authorization × 208
certificates × 195
cryptography × 193
hash × 189
jwt × 158
cookies × 132
api × 124
oauth2 × 122
mobile × 118
session-management × 117
rest × 117
ssh × 116
account-security × 114
http × 112
password-management × 112
network × 99
public-key-infrastructure × 96
php × 94