107
votes
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
Simple Terms
OpenID is about verifying a person's identity (authentication).
OAuth is about accessing a person's stuff (authorization).
OpenID Connect does both.
All three let a person give their ...
- 1,413
80
votes
Accepted
The most secure way to handle someone forgetting to verify their account?
What I see most commonly is allowing the authentication and signing the user in, but locking meaningful features away until the email is verified. You should bubble up an error reminding the user to ...
- 2,606
72
votes
Accepted
Best place to store authentication tokens client side
There are two ways you can save authentication information in the browser:
Cookies
HTML5 Web Storage
In each case, you have to trust that browsers are implemented correctly, and that Website A can't ...
- 916
59
votes
Accepted
Can someone explain the "Covert Redirect" vulnerability in OAuth and OpenID?
This isn't a vulnerability of/in OAuth 2.0 at all. The issue has been wildly overblown and misstated by CNET and the original finder.
Here it is in a nutshell: If your web site (example.com) ...
- 706
59
votes
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
Many people still visit this so here's a very simple diagram to explain it
Courtesy Wikipedia
- 709
52
votes
Accepted
What are the dangers of allowing "less secure apps" to access my Google account?
In my understanding, "less secure apps" refers to applications that send your credentials directly to Gmail. Lots of things can go wrong when you give your credentials to third party to give to the ...
- 5,780
50
votes
OAuth2 Cross Site Request Forgery, and state parameter
Let's walk through how this attack works.
The Attack
I visit some client's website and start the process of authorizing that client to access some service provider using OAuth
The client asks the ...
- 601
42
votes
Should we store accesstoken in our database for oauth2?
Technically you can store the access token in your database, and use it for API calls until it expires. It might be more trouble than its worth, though.
For one thing, as Jonathan notes in his ...
- 551
40
votes
When do you use OpenID vs. OpenID Connect
I don't think either of the other previous responses answer the question, which is asking the difference between OpenID Connect and OpenID 2.0. OpenID 2.0 is not OAuth 2.0.
OpenID 2.0 and OpenID ...
- 501
32
votes
Accepted
Why is it a bad idea to use plain oauth2 for authentication?
Note: If you are looking for something like OAuth2, but for authentication, you should
use OpenId Connect instead.
OAuth2 is meant for a user to authorize an application to load the user's ...
- 7,362
27
votes
Accepted
How does a refresh token help?
The main advantage of a refresh token is that it is easier to detect if it is compromised.
Consider these two scenarios:
A single long-lasting auth token is used.
A short duration auth token is used,...
- 9,122
25
votes
Why isn't PKCE encouraged for Single-Page Apps?
@catanman makes excellent points regarding the technical considerations around PKCE in SPAs, however just recently the IETF Oauth working group has published a best current practice document (December ...
- 351
25
votes
Why isn't PKCE encouraged for Single-Page Apps?
While all the other answers are correct, the latest OAuth 2.0 for Browser-Based Apps Best Practices Doc (January 29, 2019) states that (emphasis mine):
Overview
For authorizing users within a ...
- 801
21
votes
Accepted
OAuth 2 vs OpenID Connect to secure API
From what you have explained it seems that OAuth 2.0 would better suit your needs. OpenID Connect was developed to add secure authentication to OAuth 2.0. Large providers i.e. Google, Facebook, Yahoo, ...
- 769
20
votes
Accepted
Is my JWT refresh plan secure?
Acceptably secure within the realm of what?
You have described the basic flow for all bearer tokens. They who bear the token have the power. You do have a condition where you check if the token has ...
- 15.2k
19
votes
Accepted
How secure are expiring tokens and refresh tokens?
It could be that the access token might end up being used around the application over plain HTTP connections. So if an attacker sniffed it, they would only have short term access. This is what used to ...
- 33.2k
18
votes
Why use OpenID Connect instead of plain OAuth2?
OAuth is an authorisation protocol, providing a way to give authorisation to access a protected resource. A by-product of the authorisation process is that the user is authenticated.
Technically, ...
- 236
18
votes
Accepted
In Oauth what is the benefit of the access token being opaque
In OAuth, or any other protocol where the token can be opaque or transparent, the benefits and risks swing based on what your desired result is:
If you want the client to be able to parse the access ...
- 296
17
votes
Why isn't PKCE encouraged for Single-Page Apps?
SPAs would not benefit from PKCE. PKCE solves a different problem than the one you're describing.
First of all, for SPAs the current best practice is still to use the implicit flow, not the ...
- 694
16
votes
Compromised JSON Web Token (JWT) Bearer Token
To answer your questions:
1) How do you handle a situation with a compromised token secret which is shared between a client and the server?
Add an expiry date to your token. Make sure the token ...
16
votes
How secure are expiring tokens and refresh tokens?
Let's consider there is a server that validates and issues tokens to a client.
Client (sends username & password) -> Server
Server (validates the credentials and returns access and refresh ...
- 161
15
votes
Should we store accesstoken in our database for oauth2?
I've been thinking about this and may have come up with an answer that will work for us, though I can't say whether it would work for you.
In our environment, the main reason we might need to use ...
- 251
15
votes
Where to store access and refresh tokens on ASP.NET client web app - calling a REST API
1. Where to authenticate the user?
If it is a user who needs to authenticate, then you need something in your front-end. From your front-end, you can just do a POST to your back-end, with the user ...
- 5,363
15
votes
Accepted
OAuth2 and Authentication
1.What is the difference between authentication and authorization?
Authentication is the process, by which a server checks if a user is indeed the user that it claims to be. This is usually done, ...
- 266
15
votes
Why is it a bad idea to use plain oauth2 for authentication?
As explained by Jacco, a naive implementation of authentication on top of oauth2 has several vulnerabilities, the most common of which is CSRF.
Given there's a perfectly good authentication protocol ...
- 2,299
14
votes
Accepted
What is the difference between API keys and API tokens usages?
API keys are public, by intent. They are an authorisation mechanism, not an authentication mechanism (this is mentioned in your links). It does not matter how they are generated but it matters how ...
- 123k
13
votes
Can someone explain the "Covert Redirect" vulnerability in OAuth and OpenID?
As others have stated, this is not a new idea. Eran Hammer (one of the creators of the Oauth 1.0 spec, who resigned from the Oauth 2.0 committe) wrote a good synopsis of the vulnerability, almost 3 ...
- 1,024
12
votes
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
We already have a diagram and a lot of good data so here is an example in case that helps.
Let's say I want to post a comment to StackOverflow. StackOverflow only allows comments if a user has 50 ...
- 221
12
votes
Accepted
Secure REST API and Single Page App by using external OAuth 2 Authorization Code
Firstly, and to be very clear, OAuth 2 is not an authentication protocol. If you wish to know the identity of the user, there are other protocols designed to solve this problem, such as OpenID Connect....
- 236
12
votes
Accepted
Why would you decouple your resource and login servers?
This way, if one of your applications gets hacked, you theoretically
don't lose any login credentials. But is that all there is to it?
No, an additional benefit (or possibly the main benefit) is ...
- 29k
Only top scored, non community-wiki answers of a minimum length are eligible