342 votes
Accepted

User can't navigate to webpage through the UI due to permissions, but are able to navigate to page by pasting the URL. How do I protect against this?

Do I need to verify the user for every single page? Absolutely. Not only every page, but every request to a privileged resource, e.g POST request to update data, delete, view, etc, etc. It is not ...
TrickyDupes's user avatar
  • 2,849
300 votes

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

The Authorization: <type> <credentials> pattern was introduced by the W3C in HTTP 1.0, and has been reused in many places since. Many web servers support multiple methods of authorization. ...
Vegard's user avatar
  • 3,202
114 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

Simple Terms OpenID is about verifying a person's identity (authentication). OAuth is about accessing a person's stuff (authorization). OpenID Connect does both. All three let a person give their ...
Shaun Luttin's user avatar
  • 1,483
83 votes
Accepted

Returning the wrong HTTP response code on purpose?

Has anyone ever thought about doing this? Yes, there was actually a talk about exactly this at defcon 21 (video, slides). Their conclusion was that working with response codes as offensive security ...
tim's user avatar
  • 29.6k
63 votes

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

Long before bearer authorization, this header was used for Basic authentication. For interoperability, the use of these headers is governed by W3C norms, so even if you're reading and writing the ...
bbsimonbb's user avatar
  • 969
60 votes

Returning the wrong HTTP response code on purpose?

It won't actually slow down an attacker any appreciable amount, but will cause any future developers who work on your platform to be really annoyed at you. It may also cause certain nice features of ...
Xiong Chiamiov's user avatar
57 votes

Redirect to login page if authorization required -- security flaw?

What is your threat model? With a blanket approach you won't solve your use case. Correct, if you do as you describe you allow an attacker to enumerate your valid pages, theoretically. Does he have an ...
Tom's user avatar
  • 10.4k
47 votes
Accepted

When do you use OpenID vs. OpenID Connect

I don't think either of the other previous responses answer the question, which is asking the difference between OpenID Connect and OpenID 2.0. OpenID 2.0 is not OAuth 2.0. OpenID 2.0 and OpenID ...
theferrit32's user avatar
42 votes
Accepted

Authentication versus Authorisation

once A gets falsely authenticated as B... On any minimally secure system, this isn't how it happens. From the system's point of view, User B is authenticating himself, not User A. It was not falsely ...
ThoriumBR's user avatar
  • 54k
38 votes

User can't navigate to webpage through the UI due to permissions, but are able to navigate to page by pasting the URL. How do I protect against this?

The quick answer is yes, as you gathered. But it doesn't need to be the huge job you're thinking of. (The whole security thing might be big, but this is only one part of it). You have far more ...
Stilez's user avatar
  • 1,694
35 votes
Accepted

Can fingerprint readers be trusted?

It's certainly possible that the fingerprint reader contains some kind of backdoor or malicious code. But that's also true of the motherboard, the network card(s), the camera and microphone, the CPU, ...
Gh0stFish's user avatar
  • 11k
28 votes
Accepted

Why use OpenID Connect instead of plain OAuth2?

This article is the best explanation I've found after a LOT of searching (h/t to @rickchristie for linking to it in a comment to another answer). Summary Relying on plain OAuth 2.0 for authentication ...
Nathan Wailes's user avatar
28 votes
Accepted

How does a refresh token help?

The main advantage of a refresh token is that it is easier to detect if it is compromised. Consider these two scenarios: A single long-lasting auth token is used. A short duration auth token is used,...
TTT's user avatar
  • 9,212
28 votes

User can't navigate to webpage through the UI due to permissions, but are able to navigate to page by pasting the URL. How do I protect against this?

You need to check the user permission level for every request (GET, POST, PUT, DELETE). Browsing to a page, like in your case is a GET request. A user shouldn't be able to post a request without ...
Silencer310's user avatar
27 votes
Accepted

Public API with authorization token -- is it possible to protect the demo token?

As Steffen has said you cannot protect the token from users. I'd just like to add a suggestion for a more general scenario of having a "demo" Api. It sounds like your API doesn't have any stored ...
GreatSeaSpider's user avatar
26 votes

Does multiple numbers per button have an effect on security?

Think about the technical implementation, not about the user or what's painted on the buttons: it's a keypad with 5 buttons. In order to unlock the device, it needs a sequence of those 5 buttons (...
schroeder's user avatar
  • 129k
25 votes

Redirect to login page if authorization required -- security flaw?

There is no correct solution as every site has there own things going on, but I'll give my two cents on how you can tackle this. Usually sensitive pages are behind a directory or on a separate ...
Bubble Hacker's user avatar
23 votes

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

The word Bearer wants to provide the authentication scheme. since there are Different Authentication Schemes provided with the Authorization header like: Basic use for http-basic-Authentication ...
Abilogos's user avatar
  • 331
20 votes

Redirect to login page if authorization required -- security flaw?

I don't think this is a serious flaw (see Tom's answer). However, if you think it is, the problem can be avoided. You have a list of "publicly available URLs", such as /about. For all other ...
Stig Hemmer's user avatar
  • 2,433
19 votes

Can fingerprint readers be trusted?

On modern Windows systems, biometric authentication (including fingerprints) is handled by Windows Hello, which makes it basically as trustworthy as the rest of the system, and leaves less room for a ...
josh3736's user avatar
  • 2,555
15 votes
Accepted

OAuth2 and Authentication

1.What is the difference between authentication and authorization? Authentication is the process, by which a server checks if a user is indeed the user that it claims to be. This is usually done, ...
Dimos's user avatar
  • 266
14 votes
Accepted

2FA why not to ask the code before password

TL;DR Security is hard and making even small changes to the way security protocols work can open up unexpected attacks. While it may seem at first glance like putting the 2FA before the password helps ...
Mike Ounsworth's user avatar
14 votes
Accepted

Will "Authorization: Bearer" in request header fix CSRF attacks?

Would this approach actually work to prevent CSRF attacks? Yes. An attacker can't make a browser send a request that includes the authorization header with the correct bearer token. This is for two ...
Anders's user avatar
  • 65.6k
13 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

We already have a diagram and a lot of good data so here is an example in case that helps. Let's say I want to post a comment to StackOverflow. StackOverflow only allows comments if a user has 50 ...
Pace's user avatar
  • 231
13 votes
Accepted

Does multiple numbers per button have an effect on security?

No, assuming equally long passcodes, having fewer buttons cannot increase security in any way. Depending on how the passcodes are chosen, and whether or not the buttons are regularly cleaned to ...
Ilmari Karonen's user avatar
13 votes

How much entropy does a smartphones' pattern lock have?

You cannot reach 42 bits of entropy with a regular android unlock pattern. The 3x3 grid is limited to 389,112 distinct patterns, giving you an entropy of 18.57 bits. This is less than you might assume ...
Arminius's user avatar
  • 44.8k
13 votes
Accepted

Securing data and files so as they won't be openable anywhere else but your own server?

Why do you believe there should be a way? If an attacker can hack your server, they can presumably look at the data on that server - from that point, they could copy the plain data to anywhere else. ...
Matthew's user avatar
  • 27.3k
12 votes

Public API with authorization token -- is it possible to protect the demo token?

It is not possible to protect the token because as you noticed yourself the user can simply look what kind of request was sent. Since the demo site is under your control you can though change the demo ...
Steffen Ullrich's user avatar
11 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

In addition to the other responses: I think that a lot of confusion comes from inacurrate, or at least unusual use of the terms Authentication and Authorization OpenID Connect 1.0 is marketed as an ...
Guillaume's user avatar
  • 210
11 votes

How to do role-based authorization with OAuth2 / OpenID Connect?

The role concept can be used with access tokens in OpenID Connect (Oauth2). Consider that a scope is a request for claims about the user that should be included in the access token. The API ...
Geir Emblemsvag's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible