Hot answers tagged

107 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

Simple Terms OpenID is about verifying a person's identity (authentication). OAuth is about accessing a person's stuff (authorization). OpenID Connect does both. All three let a person give their ...
user avatar
  • 1,413
80 votes
Accepted

The most secure way to handle someone forgetting to verify their account?

What I see most commonly is allowing the authentication and signing the user in, but locking meaningful features away until the email is verified. You should bubble up an error reminding the user to ...
user avatar
  • 2,606
72 votes
Accepted

Best place to store authentication tokens client side

There are two ways you can save authentication information in the browser: Cookies HTML5 Web Storage In each case, you have to trust that browsers are implemented correctly, and that Website A can't ...
user avatar
59 votes
Accepted

Can someone explain the "Covert Redirect" vulnerability in OAuth and OpenID?

This isn't a vulnerability of/in OAuth 2.0 at all. The issue has been wildly overblown and misstated by CNET and the original finder. Here it is in a nutshell: If your web site (example.com) ...
user avatar
  • 706
59 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

Many people still visit this so here's a very simple diagram to explain it Courtesy Wikipedia
user avatar
52 votes
Accepted

What are the dangers of allowing "less secure apps" to access my Google account?

In my understanding, "less secure apps" refers to applications that send your credentials directly to Gmail. Lots of things can go wrong when you give your credentials to third party to give to the ...
user avatar
  • 5,780
50 votes

OAuth2 Cross Site Request Forgery, and state parameter

Let's walk through how this attack works. The Attack I visit some client's website and start the process of authorizing that client to access some service provider using OAuth The client asks the ...
user avatar
  • 601
42 votes

Should we store accesstoken in our database for oauth2?

Technically you can store the access token in your database, and use it for API calls until it expires. It might be more trouble than its worth, though. For one thing, as Jonathan notes in his ...
user avatar
  • 551
40 votes

When do you use OpenID vs. OpenID Connect

I don't think either of the other previous responses answer the question, which is asking the difference between OpenID Connect and OpenID 2.0. OpenID 2.0 is not OAuth 2.0. OpenID 2.0 and OpenID ...
user avatar
32 votes
Accepted

Why is it a bad idea to use plain oauth2 for authentication?

Note: If you are looking for something like OAuth2, but for authentication, you should use OpenId Connect instead. OAuth2 is meant for a user to authorize an application to load the user's ...
user avatar
  • 7,362
27 votes
Accepted

How does a refresh token help?

The main advantage of a refresh token is that it is easier to detect if it is compromised. Consider these two scenarios: A single long-lasting auth token is used. A short duration auth token is used,...
user avatar
  • 9,122
25 votes

Why isn't PKCE encouraged for Single-Page Apps?

@catanman makes excellent points regarding the technical considerations around PKCE in SPAs, however just recently the IETF Oauth working group has published a best current practice document (December ...
user avatar
  • 351
25 votes

Why isn't PKCE encouraged for Single-Page Apps?

While all the other answers are correct, the latest OAuth 2.0 for Browser-Based Apps Best Practices Doc (January 29, 2019) states that (emphasis mine): Overview For authorizing users within a ...
user avatar
21 votes
Accepted

OAuth 2 vs OpenID Connect to secure API

From what you have explained it seems that OAuth 2.0 would better suit your needs. OpenID Connect was developed to add secure authentication to OAuth 2.0. Large providers i.e. Google, Facebook, Yahoo, ...
user avatar
20 votes
Accepted

Is my JWT refresh plan secure?

Acceptably secure within the realm of what? You have described the basic flow for all bearer tokens. They who bear the token have the power. You do have a condition where you check if the token has ...
user avatar
  • 15.2k
19 votes
Accepted

How secure are expiring tokens and refresh tokens?

It could be that the access token might end up being used around the application over plain HTTP connections. So if an attacker sniffed it, they would only have short term access. This is what used to ...
user avatar
18 votes

Why use OpenID Connect instead of plain OAuth2?

OAuth is an authorisation protocol, providing a way to give authorisation to access a protected resource. A by-product of the authorisation process is that the user is authenticated. Technically, ...
user avatar
  • 236
18 votes
Accepted

In Oauth what is the benefit of the access token being opaque

In OAuth, or any other protocol where the token can be opaque or transparent, the benefits and risks swing based on what your desired result is: If you want the client to be able to parse the access ...
user avatar
17 votes

Why isn't PKCE encouraged for Single-Page Apps?

SPAs would not benefit from PKCE. PKCE solves a different problem than the one you're describing. First of all, for SPAs the current best practice is still to use the implicit flow, not the ...
user avatar
  • 694
16 votes

Compromised JSON Web Token (JWT) Bearer Token

To answer your questions: 1) How do you handle a situation with a compromised token secret which is shared between a client and the server? Add an expiry date to your token. Make sure the token ...
user avatar
16 votes

How secure are expiring tokens and refresh tokens?

Let's consider there is a server that validates and issues tokens to a client. Client (sends username & password) -> Server Server (validates the credentials and returns access and refresh ...
user avatar
15 votes

Should we store accesstoken in our database for oauth2?

I've been thinking about this and may have come up with an answer that will work for us, though I can't say whether it would work for you. In our environment, the main reason we might need to use ...
user avatar
  • 251
15 votes

Where to store access and refresh tokens on ASP.NET client web app - calling a REST API

1. Where to authenticate the user? If it is a user who needs to authenticate, then you need something in your front-end. From your front-end, you can just do a POST to your back-end, with the user ...
user avatar
  • 5,363
15 votes
Accepted

OAuth2 and Authentication

1.What is the difference between authentication and authorization? Authentication is the process, by which a server checks if a user is indeed the user that it claims to be. This is usually done, ...
user avatar
  • 266
15 votes

Why is it a bad idea to use plain oauth2 for authentication?

As explained by Jacco, a naive implementation of authentication on top of oauth2 has several vulnerabilities, the most common of which is CSRF. Given there's a perfectly good authentication protocol ...
user avatar
  • 2,299
14 votes
Accepted

What is the difference between API keys and API tokens usages?

API keys are public, by intent. They are an authorisation mechanism, not an authentication mechanism (this is mentioned in your links). It does not matter how they are generated but it matters how ...
user avatar
  • 123k
13 votes

Can someone explain the "Covert Redirect" vulnerability in OAuth and OpenID?

As others have stated, this is not a new idea. Eran Hammer (one of the creators of the Oauth 1.0 spec, who resigned from the Oauth 2.0 committe) wrote a good synopsis of the vulnerability, almost 3 ...
user avatar
  • 1,024
12 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

We already have a diagram and a lot of good data so here is an example in case that helps. Let's say I want to post a comment to StackOverflow. StackOverflow only allows comments if a user has 50 ...
user avatar
  • 221
12 votes
Accepted

Secure REST API and Single Page App by using external OAuth 2 Authorization Code

Firstly, and to be very clear, OAuth 2 is not an authentication protocol. If you wish to know the identity of the user, there are other protocols designed to solve this problem, such as OpenID Connect....
user avatar
12 votes
Accepted

Why would you decouple your resource and login servers?

This way, if one of your applications gets hacked, you theoretically don't lose any login credentials. But is that all there is to it? No, an additional benefit (or possibly the main benefit) is ...
user avatar
  • 29k

Only top scored, non community-wiki answers of a minimum length are eligible