344 votes
Accepted

User can't navigate to webpage through the UI due to permissions, but are able to navigate to page by pasting the URL. How do I protect against this?

Do I need to verify the user for every single page? Absolutely. Not only every page, but every request to a privileged resource, e.g POST request to update data, delete, view, etc, etc. It is not ...
user avatar
  • 2,809
278 votes

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

The Authorization: <type> <credentials> pattern was introduced by the W3C in HTTP 1.0, and has been reused in many places since. Many web servers support multiple methods of authorization. ...
user avatar
  • 2,982
107 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

Simple Terms OpenID is about verifying a person's identity (authentication). OAuth is about accessing a person's stuff (authorization). OpenID Connect does both. All three let a person give their ...
user avatar
  • 1,413
84 votes
Accepted

Returning the wrong HTTP response code on purpose?

Has anyone ever thought about doing this? Yes, there was actually a talk about exactly this at defcon 21 (video, slides). Their conclusion was that working with response codes as offensive security ...
user avatar
  • 29k
70 votes
Accepted

Overarching term for 'authentication' and 'authorization'?

According to CISSP study guide , access control include IAAA (Identification, Authentication, Authorization and Accountability). So if you dont care about the rest then you can call Authentication ...
user avatar
  • 1,592
61 votes

Returning the wrong HTTP response code on purpose?

It won't actually slow down an attacker any appreciable amount, but will cause any future developers who work on your platform to be really annoyed at you. It may also cause certain nice features of ...
user avatar
59 votes

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

Long before bearer authorization, this header was used for Basic authentication. For interoperability, the use of these headers is governed by W3C norms, so even if you're reading and writing the ...
user avatar
  • 929
57 votes

Redirect to login page if authorization required -- security flaw?

What is your threat model? With a blanket approach you won't solve your use case. Correct, if you do as you describe you allow an attacker to enumerate your valid pages, theoretically. Does he have an ...
user avatar
  • 10.1k
42 votes

Should we store accesstoken in our database for oauth2?

Technically you can store the access token in your database, and use it for API calls until it expires. It might be more trouble than its worth, though. For one thing, as Jonathan notes in his ...
user avatar
  • 551
42 votes
Accepted

Authentication versus Authorisation

once A gets falsely authenticated as B... On any minimally secure system, this isn't how it happens. From the system's point of view, User B is authenticating himself, not User A. It was not falsely ...
user avatar
  • 50.5k
40 votes

When do you use OpenID vs. OpenID Connect

I don't think either of the other previous responses answer the question, which is asking the difference between OpenID Connect and OpenID 2.0. OpenID 2.0 is not OAuth 2.0. OpenID 2.0 and OpenID ...
user avatar
38 votes

User can't navigate to webpage through the UI due to permissions, but are able to navigate to page by pasting the URL. How do I protect against this?

The quick answer is yes, as you gathered. But it doesn't need to be the huge job you're thinking of. (The whole security thing might be big, but this is only one part of it). You have far more ...
user avatar
  • 1,664
35 votes

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

As Phil stated, you can still use the card using its number (as you would do on-line). Also, some ATM machine won't accept the card if not able to read the magnetic strip. The best thing is to use a ...
user avatar
  • 461
28 votes

User can't navigate to webpage through the UI due to permissions, but are able to navigate to page by pasting the URL. How do I protect against this?

You need to check the user permission level for every request (GET, POST, PUT, DELETE). Browsing to a page, like in your case is a GET request. A user shouldn't be able to post a request without ...
user avatar
27 votes

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

Yes, you can. On some places you can find a device called demagnetizer. Just run your card over it (or over a very strong magnet), and the magnetic track will be corrupted and you will only be able ...
user avatar
  • 50.5k
27 votes
Accepted

How does a refresh token help?

The main advantage of a refresh token is that it is easier to detect if it is compromised. Consider these two scenarios: A single long-lasting auth token is used. A short duration auth token is used,...
user avatar
  • 9,122
27 votes

Does multiple numbers per button have an effect on security?

Think about the technical implementation, not about the user or what's painted on the buttons: it's a keypad with 5 buttons. In order to unlock the device, it needs a sequence of those 5 buttons (...
user avatar
  • 123k
27 votes
Accepted

Public API with authorization token -- is it possible to protect the demo token?

As Steffen has said you cannot protect the token from users. I'd just like to add a suggestion for a more general scenario of having a "demo" Api. It sounds like your API doesn't have any stored ...
user avatar
25 votes

Redirect to login page if authorization required -- security flaw?

There is no correct solution as every site has there own things going on, but I'll give my two cents on how you can tackle this. Usually sensitive pages are behind a directory or on a separate ...
user avatar
20 votes

Redirect to login page if authorization required -- security flaw?

I don't think this is a serious flaw (see Tom's answer). However, if you think it is, the problem can be avoided. You have a list of "publicly available URLs", such as /about. For all other ...
user avatar
  • 2,403
18 votes

Why use OpenID Connect instead of plain OAuth2?

OAuth is an authorisation protocol, providing a way to give authorisation to access a protected resource. A by-product of the authorisation process is that the user is authenticated. Technically, ...
user avatar
  • 236
17 votes
Accepted

Claims based vs Permission based authorization

A claim is somewhat more arbitrary than a permission. A claim is 'blue eyes' whereas 'AddPerson' is a permission. It is an assertion from the identity provider that a given characteristic (or more ...
user avatar
  • 15.2k
16 votes

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

Embossed letters are still present on CC to allow to quickly carbon-copy (literally) the card on paper. That's in the (very) old days, but still allowed today, and it will count as PRESENTIAL. ...
user avatar
  • 693
15 votes

Should we store accesstoken in our database for oauth2?

I've been thinking about this and may have come up with an answer that will work for us, though I can't say whether it would work for you. In our environment, the main reason we might need to use ...
user avatar
  • 251
15 votes

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

The word Bearer wants to provide the authorization scheme. since there are Different Authorization Schemes like: Basic use for http-basic-Authentication Digest MD5 hashed http-basic-authentication (...
user avatar
  • 251
15 votes
Accepted

OAuth2 and Authentication

1.What is the difference between authentication and authorization? Authentication is the process, by which a server checks if a user is indeed the user that it claims to be. This is usually done, ...
user avatar
  • 266
13 votes

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

YES, but there is a big chance that an (internally chip-capable) ATM (depending on region) will reject the card! The most common 2 problems for an ATM (including chip-capable) to reject a card are: ...
user avatar
  • 321
13 votes

How much entropy does a smartphones' pattern lock have?

You cannot reach 42 bits of entropy with a regular android unlock pattern. The 3x3 grid is limited to 389,112 distinct patterns, giving you an entropy of 18.57 bits. This is less than you might assume ...
user avatar
  • 43.8k
13 votes
Accepted

Securing data and files so as they won't be openable anywhere else but your own server?

Why do you believe there should be a way? If an attacker can hack your server, they can presumably look at the data on that server - from that point, they could copy the plain data to anywhere else. ...
user avatar
  • 27.2k
13 votes
Accepted

2FA why not to ask the code before password

TL;DR Security is hard and making even small changes to the way security protocols work can open up unexpected attacks. While it may seem at first glance like putting the 2FA before the password helps ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible