3 votes

is mTLS authentication alone considered secure for authentication

Yes, mutual TLS (mTLS) is sufficient for client authentication. With mutual TLS, the client knows it is actually talking to the server, and the server is actually talking to the client. Both parties ...
Sjoerd's user avatar
  • 29.1k
1 vote

Simplest federated authentication protocol: is this the right way to do it?

This is what the original OpenID wanted to do. And it’s basically how Kerberos works with its tickets. Problem 1: identification, how does z.com verify A@a.com is actually A, and not A’ pretending to ...
LvB's user avatar
  • 8,478
1 vote
Accepted

Is csrf protection required for extremely short lived cookies?

CSRF requires user interaction to be exploited. So unless you expect a user to access the attacker website within the 1 second period after executing your script, I wouldn't consider the likelihood of ...
Shireheart's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible