3
votes
is mTLS authentication alone considered secure for authentication
Yes, mutual TLS (mTLS) is sufficient for client authentication.
With mutual TLS, the client knows it is actually talking to the server, and the server is actually talking to the client. Both parties ...
- 29.1k
1
vote
Simplest federated authentication protocol: is this the right way to do it?
This is what the original OpenID wanted to do.
And it’s basically how Kerberos works with its tickets.
Problem 1: identification, how does z.com verify A@a.com is actually A, and not A’ pretending to ...
- 8,478
1
vote
Accepted
Is csrf protection required for extremely short lived cookies?
CSRF requires user interaction to be exploited.
So unless you expect a user to access the attacker website within the 1 second period after executing your script, I wouldn't consider the likelihood of ...
- 401
Only top scored, non community-wiki answers of a minimum length are eligible