Hot answers tagged

39 votes

What are the differences between JSON Web Tokens, SAML and OAuth 2?

SAML and OAuth 2 are protocols used in authentication/authorization. JSON Web Tokens (JWT) is a specification for a token that can be used in many applications or protocols - it happens that the ...
user avatar
  • 1,762
29 votes
Accepted

Spoofing POST/GET requests in a RESTful service

My question is what prevents users from intercepting their regular post form the app (getting the token) and then possibly sending bunch of POST requests (using something like postman or fiddler) to ...
user avatar
  • 10.9k
29 votes

What is PKCE actually protecting?

The reason PKCE is important is that on mobile OS, the OS allows apps to register to handle redirect URIs so a malicious app can register and receive redirects with the authorization code for ...
user avatar
  • 539
25 votes

Why isn't PKCE encouraged for Single-Page Apps?

@catanman makes excellent points regarding the technical considerations around PKCE in SPAs, however just recently the IETF Oauth working group has published a best current practice document (December ...
user avatar
  • 351
25 votes

Why isn't PKCE encouraged for Single-Page Apps?

While all the other answers are correct, the latest OAuth 2.0 for Browser-Based Apps Best Practices Doc (January 29, 2019) states that (emphasis mine): Overview For authorizing users within a ...
user avatar
20 votes
Accepted

Why is OAuth2/OpenID Connect considered less secure than SAML/WS-*?

tl;dr Most security issues are with implementation and not protocol, the simpler the better. SAML/WS-Federation and OpenID Connect all use cryptographically signed tokens that support optional ...
user avatar
18 votes

Why use OpenID Connect instead of plain OAuth2?

OAuth is an authorisation protocol, providing a way to give authorisation to access a protected resource. A by-product of the authorisation process is that the user is authenticated. Technically, ...
user avatar
  • 236
18 votes
Accepted

What is PKCE actually protecting?

This write-up Okta has on this subject explains this pretty well IMHO. I believe it's because PKCE is intended for native applications (e.g. Android, iOS, UWP, Electron, etc.) where you leave the ...
user avatar
  • 676
17 votes

Why isn't PKCE encouraged for Single-Page Apps?

SPAs would not benefit from PKCE. PKCE solves a different problem than the one you're describing. First of all, for SPAs the current best practice is still to use the implicit flow, not the ...
user avatar
  • 694
14 votes
Accepted

What is the difference between API keys and API tokens usages?

API keys are public, by intent. They are an authorisation mechanism, not an authentication mechanism (this is mentioned in your links). It does not matter how they are generated but it matters how ...
user avatar
  • 123k
12 votes

Spoofing POST/GET requests in a RESTful service

My question is what prevents users from intercepting their regular post form the app Nothing. Does the fact that the traffic to the service will eventually go via TLS make this a non-issue? If ...
user avatar
  • 119
10 votes
Accepted

Do I need CSRF protection in this setup with a REST API backed with oauth2 and a basic auth SSO auth server?

To answer your initial question: you do not need to implement CSRF counter-measures on your resource server, if you are not using cookies (sessions) and you are not using basic authentication within ...
user avatar
  • 351
10 votes
Accepted

Does PKCE replace state in the Authorization Code OAuth flow?

The state is given back by the OAuth2 server in the redirected url, so the client app can verify that the request to open the authorization page was indeed triggered by itself. The code_challenge is ...
user avatar
8 votes

Why use OpenID Connect instead of plain OAuth2?

OpenID Connect is a profile of OAuth2... defining an architecture that enables a person to authorize an identity provider to release certain user claims to a client (website / mobile application). ...
user avatar
7 votes

Is CORS ever needed during any aspect of OAuth / OpenIDConnect Authentication?

I'm not sure about OpenID, but for OAuth there is no CORS involved for the actual authentication part, though it may be required on the resource server depending on the type of client that is ...
user avatar
  • 713
7 votes

Oauth2 vs APIKey in a server to server communication

This is an interesting topic and there are a couple of things to consider. First we need to come at it from the API provider, not just the consumer. Who? The main consideration is Authentication vs. “...
user avatar
  • 324
7 votes

Is a "magic link" a kind of authentication?

Is a "magic link" a kind of authentication? Yes, it is. It authenticates the user; similarly to recalling a password, dipping a possessed smartcard, or presenting a fingerprint, "...
user avatar
6 votes
Accepted

How to verify Google sign-in screen is legit? (Linux Desktop)

Here are some ways I can think of but if someone tried hard enough I don't think there would be a way to stop him. Check a fake email - Google's login will only display a password input if the ...
user avatar
6 votes

Why does oAuth and oAuth 2 have access tokens at all?

maybe this is to increase the security in case someone gets unauthorized access to the client app's symmetric secret. That's one valid reason, yes. Sending around short-lived access tokens instead of ...
user avatar
  • 9,135
6 votes

Fine grained authorization with OAuth2

I think the intent of OAuth scopes was to provide a framework for delegated consent, which is a form of discretionary authorization, but different from policy-driven authorization, which is what it ...
user avatar
6 votes

Spoofing POST/GET requests in a RESTful service

My question is what prevents users from intercepting their regular post from the app (getting the token) and then possibly sending bunch of POST requests (using something like postman or fiddler) to ...
user avatar
6 votes

Why CORS preflight is not available for POST requests when Content-Type is application/x-www-form-urlencoded

So my understanding of why this is allowed is so that the implementation of CORS wouldn't break existing and well understood functionality which was already allowed by browsers. This also means that ...
user avatar
6 votes
Accepted

How to get better IAM understanding

Your question is a pretty good one and as an IAM practitioner I can only apologize for the confusion. IAM is indeed a large field. I think it may be worthwhile taking a step back and going through the ...
user avatar
6 votes
Accepted

What can someone do with a Google auth token?

Martin's answer has good info and steps to prevent further potential risk. Concerning the authtoken it’s pretty straight forward. For example, when you use your Google account to login to a site, ...
user avatar
6 votes
Accepted

Is OpenID Connect implicit flow safe to use?

Implicit Flow is now discouraged in favour of Code Flow with PKCE. This is a fairly recent change (in the last year or so), which is why you might see quite a lot of documentation and libraries still ...
user avatar
5 votes

Why use OpenID Connect instead of plain OAuth2?

Using OAuth as an authentication method is not recommended, it is explicitly designed as a delegated authorisation method. Facebook was using OAuth as an authentication method, but an enterprising ...
user avatar
5 votes

Why are passwords sent unhashed by most modern websites?

Your question boils down to why do passwords get sent in clear text over an encrypted channel and are not hashed on the client before submission? The answer is: if the client is compromised to ...
user avatar
  • 14.3k
5 votes
Accepted

How does security work in a cloud-to-cloud backup scenario?

How are they limited Using OAuth, you ask for scopes, which are similar to permissions, this means they can only use the credentials for what they ask for, and cannot do things that are out of scope. ...
user avatar
  • 3,159
5 votes

PKCE vs Client Secret

It boils down to whether there is a chance your authorization code might leak. PKCE is about preventing leaked "authorization code"s from being useful. When you ask for an authorization code, PKCE ...
user avatar
  • 151
5 votes
Accepted

OAuth2: Where should I store my refresh token in a stateless application?

Put is simply the answer is "Don't use the refresh token" because it's not how the system is supposed to work when you're having SPA, apis and an identity provider. The documentation is a ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible