111
votes
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
Simple Terms
OpenID is about verifying a person's identity (authentication).
OAuth is about accessing a person's stuff (authorization).
OpenID Connect does both.
All three let a person give their ...
80
votes
Accepted
The most secure way to handle someone forgetting to verify their account?
What I see most commonly is allowing the authentication and signing the user in, but locking meaningful features away until the email is verified. You should bubble up an error reminding the user to ...
45
votes
Accepted
When do you use OpenID vs. OpenID Connect
I don't think either of the other previous responses answer the question, which is asking the difference between OpenID Connect and OpenID 2.0. OpenID 2.0 is not OAuth 2.0.
OpenID 2.0 and OpenID ...
35
votes
Accepted
Is authentication using Facebook/Google considered good practice?
I am quite sure that there are some sites which require you to login with your facebook/google account on their site (so the URL shown is not facebook/google). I am sure there are some desktop ...
33
votes
Accepted
Why is it a bad idea to use plain oauth2 for authentication?
Note: If you are looking for something like OAuth2, but for authentication, you should
use OpenId Connect instead.
OAuth2 is meant for a user to authorize an application to load the user's ...
28
votes
Accepted
How does a refresh token help?
The main advantage of a refresh token is that it is easier to detect if it is compromised.
Consider these two scenarios:
A single long-lasting auth token is used.
A short duration auth token is used,...
28
votes
Why isn't PKCE encouraged for Single-Page Apps?
While all the other answers are correct, the latest OAuth 2.0 for Browser-Based Apps Best Practices Doc (January 29, 2019) states that (emphasis mine):
Overview
For authorizing users within a ...
27
votes
Accepted
Why use OpenID Connect instead of plain OAuth2?
This article is the best explanation I've found after a LOT of searching (h/t to @rickchristie for linking to it in a comment to another answer).
Summary
Relying on plain OAuth 2.0 for authentication ...
25
votes
Why isn't PKCE encouraged for Single-Page Apps?
@catanman makes excellent points regarding the technical considerations around PKCE in SPAs, however just recently the IETF Oauth working group has published a best current practice document (December ...
18
votes
How secure are expiring tokens and refresh tokens?
Let's consider there is a server that validates and issues tokens to a client.
Client (sends username & password) -> Server
Server (validates the credentials and returns access and refresh ...
18
votes
Accepted
In Oauth what is the benefit of the access token being opaque
In OAuth, or any other protocol where the token can be opaque or transparent, the benefits and risks swing based on what your desired result is:
If you want the client to be able to parse the access ...
18
votes
Accepted
Does PKCE replace state in the Authorization Code OAuth flow?
The state is given back by the OAuth2 server in the redirected url, so the client app can verify that the request to open the authorization page was indeed triggered by itself.
The code_challenge is ...
17
votes
Why isn't PKCE encouraged for Single-Page Apps?
SPAs would not benefit from PKCE. PKCE solves a different problem than the one you're describing.
First of all, for SPAs the current best practice is still to use the implicit flow, not the ...
16
votes
Accepted
What is the difference between API keys and API tokens usages?
API keys are public, by intent. They are an authorisation mechanism, not an authentication mechanism (this is mentioned in your links). It does not matter how they are generated but it matters how ...
15
votes
Where to store access and refresh tokens on ASP.NET client web app - calling a REST API
1. Where to authenticate the user?
If it is a user who needs to authenticate, then you need something in your front-end. From your front-end, you can just do a POST to your back-end, with the user ...
15
votes
Accepted
OAuth2 and Authentication
1.What is the difference between authentication and authorization?
Authentication is the process, by which a server checks if a user is indeed the user that it claims to be. This is usually done, ...
15
votes
Why is it a bad idea to use plain oauth2 for authentication?
As explained by Jacco, a naive implementation of authentication on top of oauth2 has several vulnerabilities, the most common of which is CSRF.
Given there's a perfectly good authentication protocol ...
12
votes
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
We already have a diagram and a lot of good data so here is an example in case that helps.
Let's say I want to post a comment to StackOverflow. StackOverflow only allows comments if a user has 50 ...
12
votes
Where should I store OAuth2 access tokens?
If the request to the 3rd party API is through your server, then store the access token in the database tied to the user, encrypted with a key that is stored as an environment variable. If the ...
11
votes
How secure are expiring tokens and refresh tokens?
I answered a similar question that ended up being marked as a duplicate to this one. However, I feel that my answer to that question provides a stronger argument for how refresh tokens provide ...
11
votes
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
In addition to the other responses: I think that a lot of confusion comes from inacurrate, or at least unusual use of the terms Authentication and Authorization
OpenID Connect 1.0 is marketed as an ...
11
votes
How to do role-based authorization with OAuth2 / OpenID Connect?
The role concept can be used with access tokens in OpenID Connect (Oauth2).
Consider that a scope is a request for claims about the user that should be included in the access token. The API ...
11
votes
Accepted
Authentication for SPA
TL;DR Go with implicit... Check Which OAuth 2.0 flow should I use? for a visualization of the decision process.
When it comes to authentication, the devil is on the details... I'll try not to forget ...
11
votes
What are the advantages of using JWT over Basic Auth with Https?
First, as Steffen's comment points out, you don't send credentials (certainly not complete ones, suitable for authentication) in JWTs. I mean, you could, but that both completely misses the point of a ...
10
votes
Why are developers using embedded user agents for 3rd party auth? What are the alternatives?
Am I right to be concerned that this is a growing opportunity for phishing and MITM attacks (fake or hijacked browser in the middle which steals credentials and/or tokens in real time, also defeating ...
9
votes
Accepted
OAuth - What if the refresh token is stolen?
TL;DR: Yes refresh tokens are bearer token and so should be protected.
Refresh tokens are powerful because in general they are:
long term: meaning that they have long expiration times
privileged ...
9
votes
IN OAuth 2.0, how is the client secret supposed to be kept secret?
OAuth2 specification defines two types of clients
confidential
Clients capable of maintaining the confidentiality of their
credentials (e.g., client implemented on a secure server with
...
9
votes
PKCE vs Client Secret
It boils down to whether there is a chance your authorization code might leak.
PKCE is about preventing leaked "authorization code"s from being useful. When you ask for an authorization code,...
9
votes
Why do big sites use cookies and not OpenID connect?
Hmm. I think there's a lot you don't understand, here. Tons of sites do use OAuth (and often OIDC) for initial authentication, StackExchance (optionally) being one of them.
To answer the closest ...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
oauth × 520authentication × 210
oauth2 × 110
authorization × 72
openid-connect × 59
jwt × 41
openid × 39
web-application × 36
api × 35
rest × 34
facebook × 20
google × 18
token × 18
passwords × 17
csrf × 17
sso × 16
cookies × 15
session-management × 15
mobile × 14
encryption × 13
http × 13
single-page-app × 12
tls × 11
android × 11
javascript × 11