Hot answers tagged

111 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

Simple Terms OpenID is about verifying a person's identity (authentication). OAuth is about accessing a person's stuff (authorization). OpenID Connect does both. All three let a person give their ...
Shaun Luttin's user avatar
  • 1,453
80 votes
Accepted

The most secure way to handle someone forgetting to verify their account?

What I see most commonly is allowing the authentication and signing the user in, but locking meaningful features away until the email is verified. You should bubble up an error reminding the user to ...
Buffalo5ix's user avatar
  • 2,696
45 votes
Accepted

When do you use OpenID vs. OpenID Connect

I don't think either of the other previous responses answer the question, which is asking the difference between OpenID Connect and OpenID 2.0. OpenID 2.0 is not OAuth 2.0. OpenID 2.0 and OpenID ...
theferrit32's user avatar
35 votes
Accepted

Is authentication using Facebook/Google considered good practice?

I am quite sure that there are some sites which require you to login with your facebook/google account on their site (so the URL shown is not facebook/google). I am sure there are some desktop ...
Out of Band's user avatar
  • 9,253
33 votes
Accepted

Why is it a bad idea to use plain oauth2 for authentication?

Note: If you are looking for something like OAuth2, but for authentication, you should use OpenId Connect instead. OAuth2 is meant for a user to authorize an application to load the user's ...
Jacco's user avatar
  • 7,622
28 votes
Accepted

How does a refresh token help?

The main advantage of a refresh token is that it is easier to detect if it is compromised. Consider these two scenarios: A single long-lasting auth token is used. A short duration auth token is used,...
TTT's user avatar
  • 9,192
28 votes

Why isn't PKCE encouraged for Single-Page Apps?

While all the other answers are correct, the latest OAuth 2.0 for Browser-Based Apps Best Practices Doc (January 29, 2019) states that (emphasis mine): Overview For authorizing users within a ...
Eran Medan's user avatar
27 votes
Accepted

Why use OpenID Connect instead of plain OAuth2?

This article is the best explanation I've found after a LOT of searching (h/t to @rickchristie for linking to it in a comment to another answer). Summary Relying on plain OAuth 2.0 for authentication ...
Nathan Wailes's user avatar
25 votes

Why isn't PKCE encouraged for Single-Page Apps?

@catanman makes excellent points regarding the technical considerations around PKCE in SPAs, however just recently the IETF Oauth working group has published a best current practice document (December ...
Brad J's user avatar
  • 351
18 votes

How secure are expiring tokens and refresh tokens?

Let's consider there is a server that validates and issues tokens to a client. Client (sends username & password) -> Server Server (validates the credentials and returns access and refresh ...
Pavan Vamsi's user avatar
18 votes
Accepted

In Oauth what is the benefit of the access token being opaque

In OAuth, or any other protocol where the token can be opaque or transparent, the benefits and risks swing based on what your desired result is: If you want the client to be able to parse the access ...
Nick Steele's user avatar
18 votes
Accepted

Does PKCE replace state in the Authorization Code OAuth flow?

The state is given back by the OAuth2 server in the redirected url, so the client app can verify that the request to open the authorization page was indeed triggered by itself. The code_challenge is ...
martinstoeckli's user avatar
17 votes

Why isn't PKCE encouraged for Single-Page Apps?

SPAs would not benefit from PKCE. PKCE solves a different problem than the one you're describing. First of all, for SPAs the current best practice is still to use the implicit flow, not the ...
el_tigro's user avatar
  • 714
16 votes
Accepted

What is the difference between API keys and API tokens usages?

API keys are public, by intent. They are an authorisation mechanism, not an authentication mechanism (this is mentioned in your links). It does not matter how they are generated but it matters how ...
schroeder's user avatar
  • 128k
15 votes

Where to store access and refresh tokens on ASP.NET client web app - calling a REST API

1. Where to authenticate the user? If it is a user who needs to authenticate, then you need something in your front-end. From your front-end, you can just do a POST to your back-end, with the user ...
Michael's user avatar
  • 5,443
15 votes
Accepted

OAuth2 and Authentication

1.What is the difference between authentication and authorization? Authentication is the process, by which a server checks if a user is indeed the user that it claims to be. This is usually done, ...
Dimos's user avatar
  • 266
15 votes

Why is it a bad idea to use plain oauth2 for authentication?

As explained by Jacco, a naive implementation of authentication on top of oauth2 has several vulnerabilities, the most common of which is CSRF. Given there's a perfectly good authentication protocol ...
GnP's user avatar
  • 2,299
12 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

We already have a diagram and a lot of good data so here is an example in case that helps. Let's say I want to post a comment to StackOverflow. StackOverflow only allows comments if a user has 50 ...
Pace's user avatar
  • 221
12 votes

Where should I store OAuth2 access tokens?

If the request to the 3rd party API is through your server, then store the access token in the database tied to the user, encrypted with a key that is stored as an environment variable. If the ...
Chloe's user avatar
  • 1,758
11 votes

How secure are expiring tokens and refresh tokens?

I answered a similar question that ended up being marked as a duplicate to this one. However, I feel that my answer to that question provides a stronger argument for how refresh tokens provide ...
TTT's user avatar
  • 9,192
11 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

In addition to the other responses: I think that a lot of confusion comes from inacurrate, or at least unusual use of the terms Authentication and Authorization OpenID Connect 1.0 is marketed as an ...
Guillaume's user avatar
  • 210
11 votes

How to do role-based authorization with OAuth2 / OpenID Connect?

The role concept can be used with access tokens in OpenID Connect (Oauth2). Consider that a scope is a request for claims about the user that should be included in the access token. The API ...
Geir Emblemsvag's user avatar
11 votes
Accepted

Authentication for SPA

TL;DR Go with implicit... Check Which OAuth 2.0 flow should I use? for a visualization of the decision process. When it comes to authentication, the devil is on the details... I'll try not to forget ...
João Angelo's user avatar
11 votes

What are the advantages of using JWT over Basic Auth with Https?

First, as Steffen's comment points out, you don't send credentials (certainly not complete ones, suitable for authentication) in JWTs. I mean, you could, but that both completely misses the point of a ...
CBHacking's user avatar
  • 46.3k
10 votes

Why are developers using embedded user agents for 3rd party auth? What are the alternatives?

Am I right to be concerned that this is a growing opportunity for phishing and MITM attacks (fake or hijacked browser in the middle which steals credentials and/or tokens in real time, also defeating ...
user196499's user avatar
  • 1,121
9 votes
Accepted

OAuth - What if the refresh token is stolen?

TL;DR: Yes refresh tokens are bearer token and so should be protected. Refresh tokens are powerful because in general they are: long term: meaning that they have long expiration times privileged ...
channel's user avatar
  • 401
9 votes

IN OAuth 2.0, how is the client secret supposed to be kept secret?

OAuth2 specification defines two types of clients confidential Clients capable of maintaining the confidentiality of their credentials (e.g., client implemented on a secure server with ...
AGrzes's user avatar
  • 606
9 votes

PKCE vs Client Secret

It boils down to whether there is a chance your authorization code might leak. PKCE is about preventing leaked "authorization code"s from being useful. When you ask for an authorization code,...
jnnnnn's user avatar
  • 191
9 votes

Why do big sites use cookies and not OpenID connect?

Hmm. I think there's a lot you don't understand, here. Tons of sites do use OAuth (and often OIDC) for initial authentication, StackExchance (optionally) being one of them. To answer the closest ...
CBHacking's user avatar
  • 46.3k

Only top scored, non community-wiki answers of a minimum length are eligible