111
votes
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
Simple Terms
OpenID is about verifying a person's identity (authentication).
OAuth is about accessing a person's stuff (authorization).
OpenID Connect does both.
All three let a person give their ...
- 1,453
80
votes
Accepted
The most secure way to handle someone forgetting to verify their account?
What I see most commonly is allowing the authentication and signing the user in, but locking meaningful features away until the email is verified. You should bubble up an error reminding the user to ...
- 2,696
45
votes
Accepted
When do you use OpenID vs. OpenID Connect
I don't think either of the other previous responses answer the question, which is asking the difference between OpenID Connect and OpenID 2.0. OpenID 2.0 is not OAuth 2.0.
OpenID 2.0 and OpenID ...
- 566
35
votes
Accepted
Is authentication using Facebook/Google considered good practice?
I am quite sure that there are some sites which require you to login with your facebook/google account on their site (so the URL shown is not facebook/google). I am sure there are some desktop ...
- 9,253
33
votes
Accepted
Why is it a bad idea to use plain oauth2 for authentication?
Note: If you are looking for something like OAuth2, but for authentication, you should
use OpenId Connect instead.
OAuth2 is meant for a user to authorize an application to load the user's ...
- 7,622
28
votes
Accepted
How does a refresh token help?
The main advantage of a refresh token is that it is easier to detect if it is compromised.
Consider these two scenarios:
A single long-lasting auth token is used.
A short duration auth token is used,...
- 9,192
28
votes
Why isn't PKCE encouraged for Single-Page Apps?
While all the other answers are correct, the latest OAuth 2.0 for Browser-Based Apps Best Practices Doc (January 29, 2019) states that (emphasis mine):
Overview
For authorizing users within a ...
- 891
27
votes
Accepted
Why use OpenID Connect instead of plain OAuth2?
This article is the best explanation I've found after a LOT of searching (h/t to @rickchristie for linking to it in a comment to another answer).
Summary
Relying on plain OAuth 2.0 for authentication ...
- 386
25
votes
Why isn't PKCE encouraged for Single-Page Apps?
@catanman makes excellent points regarding the technical considerations around PKCE in SPAs, however just recently the IETF Oauth working group has published a best current practice document (December ...
- 351
18
votes
How secure are expiring tokens and refresh tokens?
Let's consider there is a server that validates and issues tokens to a client.
Client (sends username & password) -> Server
Server (validates the credentials and returns access and refresh ...
- 181
18
votes
Accepted
In Oauth what is the benefit of the access token being opaque
In OAuth, or any other protocol where the token can be opaque or transparent, the benefits and risks swing based on what your desired result is:
If you want the client to be able to parse the access ...
- 296
18
votes
Accepted
Does PKCE replace state in the Authorization Code OAuth flow?
The state is given back by the OAuth2 server in the redirected url, so the client app can verify that the request to open the authorization page was indeed triggered by itself.
The code_challenge is ...
- 5,259
17
votes
Why isn't PKCE encouraged for Single-Page Apps?
SPAs would not benefit from PKCE. PKCE solves a different problem than the one you're describing.
First of all, for SPAs the current best practice is still to use the implicit flow, not the ...
- 714
16
votes
Accepted
What is the difference between API keys and API tokens usages?
API keys are public, by intent. They are an authorisation mechanism, not an authentication mechanism (this is mentioned in your links). It does not matter how they are generated but it matters how ...
- 128k
15
votes
Where to store access and refresh tokens on ASP.NET client web app - calling a REST API
1. Where to authenticate the user?
If it is a user who needs to authenticate, then you need something in your front-end. From your front-end, you can just do a POST to your back-end, with the user ...
- 5,443
15
votes
Accepted
OAuth2 and Authentication
1.What is the difference between authentication and authorization?
Authentication is the process, by which a server checks if a user is indeed the user that it claims to be. This is usually done, ...
- 266
15
votes
Why is it a bad idea to use plain oauth2 for authentication?
As explained by Jacco, a naive implementation of authentication on top of oauth2 has several vulnerabilities, the most common of which is CSRF.
Given there's a perfectly good authentication protocol ...
- 2,299
12
votes
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
We already have a diagram and a lot of good data so here is an example in case that helps.
Let's say I want to post a comment to StackOverflow. StackOverflow only allows comments if a user has 50 ...
- 221
12
votes
Where should I store OAuth2 access tokens?
If the request to the 3rd party API is through your server, then store the access token in the database tied to the user, encrypted with a key that is stored as an environment variable. If the ...
- 1,758
11
votes
How secure are expiring tokens and refresh tokens?
I answered a similar question that ended up being marked as a duplicate to this one. However, I feel that my answer to that question provides a stronger argument for how refresh tokens provide ...
- 9,192
11
votes
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
In addition to the other responses: I think that a lot of confusion comes from inacurrate, or at least unusual use of the terms Authentication and Authorization
OpenID Connect 1.0 is marketed as an ...
- 210
11
votes
How to do role-based authorization with OAuth2 / OpenID Connect?
The role concept can be used with access tokens in OpenID Connect (Oauth2).
Consider that a scope is a request for claims about the user that should be included in the access token. The API ...
- 1,619
11
votes
Accepted
Authentication for SPA
TL;DR Go with implicit... Check Which OAuth 2.0 flow should I use? for a visualization of the decision process.
When it comes to authentication, the devil is on the details... I'll try not to forget ...
- 463
11
votes
What are the advantages of using JWT over Basic Auth with Https?
First, as Steffen's comment points out, you don't send credentials (certainly not complete ones, suitable for authentication) in JWTs. I mean, you could, but that both completely misses the point of a ...
- 46.3k
10
votes
Why are developers using embedded user agents for 3rd party auth? What are the alternatives?
Am I right to be concerned that this is a growing opportunity for phishing and MITM attacks (fake or hijacked browser in the middle which steals credentials and/or tokens in real time, also defeating ...
- 1,121
9
votes
Accepted
OAuth - What if the refresh token is stolen?
TL;DR: Yes refresh tokens are bearer token and so should be protected.
Refresh tokens are powerful because in general they are:
long term: meaning that they have long expiration times
privileged ...
- 401
9
votes
IN OAuth 2.0, how is the client secret supposed to be kept secret?
OAuth2 specification defines two types of clients
confidential
Clients capable of maintaining the confidentiality of their
credentials (e.g., client implemented on a secure server with
...
- 606
9
votes
PKCE vs Client Secret
It boils down to whether there is a chance your authorization code might leak.
PKCE is about preventing leaked "authorization code"s from being useful. When you ask for an authorization code,...
- 191
9
votes
Why do big sites use cookies and not OpenID connect?
Hmm. I think there's a lot you don't understand, here. Tons of sites do use OAuth (and often OIDC) for initial authentication, StackExchance (optionally) being one of them.
To answer the closest ...
- 46.3k
Only top scored, non community-wiki answers of a minimum length are eligible