47
votes
Accepted
If JWT tokens are stateless how does the auth server know a token is revoked?
RFC 7009 is about OAuth, not JWT. You are mixing two different technologies: JWT and OAuth. This question on StackExchange summarizes it well.
JWT is a token format. It defines the fields, the signing ...
- 53.5k
41
votes
What are the differences between JSON Web Tokens, SAML and OAuth 2?
SAML and OAuth 2 are protocols used in authentication/authorization. JSON Web Tokens (JWT) is a specification for a token that can be used in many applications or protocols - it happens that the ...
- 1,832
35
votes
Accepted
Is authentication using Facebook/Google considered good practice?
I am quite sure that there are some sites which require you to login with your facebook/google account on their site (so the URL shown is not facebook/google). I am sure there are some desktop ...
- 9,253
30
votes
What is PKCE actually protecting?
The reason PKCE is important is that on mobile OS, the OS allows apps to register to handle redirect URIs so a malicious app can register and receive redirects with the authorization code for ...
- 579
28
votes
Accepted
Spoofing POST/GET requests in a RESTful service
My question is what prevents users from intercepting their regular post form the app (getting the token) and then possibly sending bunch of POST requests (using something like postman or fiddler) to ...
- 10.9k
28
votes
Why isn't PKCE encouraged for Single-Page Apps?
While all the other answers are correct, the latest OAuth 2.0 for Browser-Based Apps Best Practices Doc (January 29, 2019) states that (emphasis mine):
Overview
For authorizing users within a ...
- 891
27
votes
Accepted
Why use OpenID Connect instead of plain OAuth2?
This article is the best explanation I've found after a LOT of searching (h/t to @rickchristie for linking to it in a comment to another answer).
Summary
Relying on plain OAuth 2.0 for authentication ...
- 386
25
votes
Why isn't PKCE encouraged for Single-Page Apps?
@catanman makes excellent points regarding the technical considerations around PKCE in SPAs, however just recently the IETF Oauth working group has published a best current practice document (December ...
- 351
21
votes
Accepted
What is PKCE actually protecting?
This write-up Okta has on this subject explains this pretty well IMHO.
I believe it's because PKCE is intended for native applications (e.g. Android, iOS, UWP, Electron, etc.) where you leave the ...
- 746
20
votes
Accepted
Why is OAuth2/OpenID Connect considered less secure than SAML/WS-*?
tl;dr
Most security issues are with implementation and not protocol, the
simpler the better.
SAML/WS-Federation and OpenID Connect all use
cryptographically signed tokens that support optional ...
- 316
19
votes
If JWT tokens are stateless how does the auth server know a token is revoked?
Do you need to store the refresh token in a database or store
Leaving aside the rest of your question: generally, yes. JWTs need to be short-lived, specifically because there's no good way to revoke ...
- 46.2k
18
votes
Accepted
Does PKCE replace state in the Authorization Code OAuth flow?
The state is given back by the OAuth2 server in the redirected url, so the client app can verify that the request to open the authorization page was indeed triggered by itself.
The code_challenge is ...
- 5,259
17
votes
Why isn't PKCE encouraged for Single-Page Apps?
SPAs would not benefit from PKCE. PKCE solves a different problem than the one you're describing.
First of all, for SPAs the current best practice is still to use the implicit flow, not the ...
- 714
16
votes
Accepted
What is the difference between API keys and API tokens usages?
API keys are public, by intent. They are an authorisation mechanism, not an authentication mechanism (this is mentioned in your links). It does not matter how they are generated but it matters how ...
- 128k
12
votes
Spoofing POST/GET requests in a RESTful service
My question is what prevents users from intercepting their regular post form the app
Nothing.
Does the fact that the traffic to the service will eventually go via TLS make this a non-issue?
If ...
- 119
11
votes
Accepted
Do I need CSRF protection in this setup with a REST API backed with oauth2 and a basic auth SSO auth server?
To answer your initial question: you do not need to implement CSRF counter-measures on your resource server, if you are not using cookies (sessions) and you are not using basic authentication within ...
- 361
9
votes
IN OAuth 2.0, how is the client secret supposed to be kept secret?
OAuth2 specification defines two types of clients
confidential
Clients capable of maintaining the confidentiality of their
credentials (e.g., client implemented on a secure server with
...
- 596
9
votes
PKCE vs Client Secret
It boils down to whether there is a chance your authorization code might leak.
PKCE is about preventing leaked "authorization code"s from being useful. When you ask for an authorization code,...
- 191
9
votes
Is a "magic link" a kind of authentication?
Is a "magic link" a kind of authentication?
Yes, it is.
It authenticates the user; similarly to reciting a password, calculating a TOTP/HOTP, dipping a possessed smartcard, or presenting a ...
8
votes
Accepted
How to verify Google sign-in screen is legit? (Linux Desktop)
Here are some ways I can think of but if someone tried hard enough I don't think there would be a way to stop him.
Check a fake email - Google's login will only display a password input if the ...
- 3,821
8
votes
Why use OpenID Connect instead of plain OAuth2?
OpenID Connect is a profile of OAuth2... defining an architecture that enables a person to authorize an identity provider to release certain user claims to a client (website / mobile application).
...
- 261
8
votes
Why CORS preflight is not available for POST requests when Content-Type is application/x-www-form-urlencoded
So my understanding of why this is allowed is so that the implementation of CORS wouldn't break existing and well understood functionality which was already allowed by browsers. This also means that ...
- 2,064
8
votes
Accepted
Is OpenID Connect implicit flow safe to use?
Implicit Flow is now discouraged in favour of Code Flow with PKCE. This is a fairly recent change (in the last year or so), which is why you might see quite a lot of documentation and libraries still ...
7
votes
Is CORS ever needed during any aspect of OAuth / OpenIDConnect Authentication?
I'm not sure about OpenID, but for OAuth there is no CORS involved for the actual authentication part, though it may be required on the resource server depending on the type of client that is ...
- 713
7
votes
Oauth2 vs APIKey in a server to server communication
This is an interesting topic and there are a couple of things to consider. First we need to come at it from the API provider, not just the consumer.
Who?
The main consideration is Authentication vs. “...
- 324
7
votes
Accepted
When using PKCE, are the state and nonce parameters still necessary protection from csrf and code injection?
My answer tries to give a short sum up of the most important information, based on Daniel Fett's article "PKCE vs. Nonce: Equivalent or Not?". For a detailed descirption of attacker models ...
- 333
7
votes
Is a "magic link" a kind of authentication?
Do you know those "Login with Facebook" and "Login with Gmail" buttons all around the web? They are almost the same.
When you allow someone to login with their Facebook account, ...
- 53.5k
6
votes
Why use OpenID Connect instead of plain OAuth2?
Using OAuth as an authentication method is not recommended, it is explicitly designed as a delegated authorisation method.
Facebook was using OAuth as an authentication method, but an enterprising ...
- 221
6
votes
Is authentication using Facebook/Google considered good practice?
First part is mainly a partial answer for the desktop application case. Installing a desktop application is not the same as browsing a remote site. In the latter, you trust your browser to protect you ...
- 26.4k
Only top scored, non community-wiki answers of a minimum length are eligible