Skip to main content

New answers tagged

1 vote

Login with roles without internet

If a user can read and modify all files of your application, it is impossible to make it secure. It doesn't matter what you program the application to do, because the user can just change the behavior ...
Sjoerd's user avatar
  • 30.7k
0 votes

Is passing claims about the user in an access token "abusing" OpenID Connect?

Yes it's an abuse. In OIDC, claims about the user can be obtained by the client in two ways: The ID token (which is a JWT). The userinfo JSON endpoint (by exchanging the OAuth access token). The ...
benjimin's user avatar
  • 155
0 votes

Do we really need refresh tokens?

This approach works (though the additional stuff you describe adds a ton of complexity and UX risk). You're basically taking the standard approach to "can we make refresh tokens be JWTs too?"...
CBHacking's user avatar
  • 48.5k
2 votes

Why does ASP.NET enforce authorization through page rendering rather than on the server?

It simply means that the server does not implement proper permissions check. It is not a matter of misconfiguration, you cannot configure server to do that. This has to be implemented on the backend ...
freakish's user avatar
  • 266

Top 50 recent answers are included