Hot answers tagged

47 votes
Accepted

If JWT tokens are stateless how does the auth server know a token is revoked?

RFC 7009 is about OAuth, not JWT. You are mixing two different technologies: JWT and OAuth. This question on StackExchange summarizes it well. JWT is a token format. It defines the fields, the signing ...
ThoriumBR's user avatar
  • 53.9k
41 votes

What are the differences between JSON Web Tokens, SAML and OAuth 2?

SAML and OAuth 2 are protocols used in authentication/authorization. JSON Web Tokens (JWT) is a specification for a token that can be used in many applications or protocols - it happens that the ...
HTKLee's user avatar
  • 1,842
35 votes
Accepted

Is authentication using Facebook/Google considered good practice?

I am quite sure that there are some sites which require you to login with your facebook/google account on their site (so the URL shown is not facebook/google). I am sure there are some desktop ...
Out of Band's user avatar
  • 9,293
30 votes

What is PKCE actually protecting?

The reason PKCE is important is that on mobile OS, the OS allows apps to register to handle redirect URIs so a malicious app can register and receive redirects with the authorization code for ...
Grokify's user avatar
  • 579
28 votes
Accepted

Why use OpenID Connect instead of plain OAuth2?

This article is the best explanation I've found after a LOT of searching (h/t to @rickchristie for linking to it in a comment to another answer). Summary Relying on plain OAuth 2.0 for authentication ...
Nathan Wailes's user avatar
28 votes
Accepted

Spoofing POST/GET requests in a RESTful service

My question is what prevents users from intercepting their regular post form the app (getting the token) and then possibly sending bunch of POST requests (using something like postman or fiddler) to ...
Hector's user avatar
  • 11k
28 votes

Why isn't PKCE encouraged for Single-Page Apps?

While all the other answers are correct, the latest OAuth 2.0 for Browser-Based Apps Best Practices Doc (January 29, 2019) states that (emphasis mine): Overview For authorizing users within a ...
Eran Medan's user avatar
25 votes

Why isn't PKCE encouraged for Single-Page Apps?

@catanman makes excellent points regarding the technical considerations around PKCE in SPAs, however just recently the IETF Oauth working group has published a best current practice document (December ...
Brad J's user avatar
  • 351
23 votes
Accepted

What is PKCE actually protecting?

This write-up Okta has on this subject explains this pretty well IMHO. I believe it's because PKCE is intended for native applications (e.g. Android, iOS, UWP, Electron, etc.) where you leave the ...
someone1's user avatar
  • 766
20 votes
Accepted

Why is OAuth2/OpenID Connect considered less secure than SAML/WS-*?

tl;dr Most security issues are with implementation and not protocol, the simpler the better. SAML/WS-Federation and OpenID Connect all use cryptographically signed tokens that support optional ...
Karl McGuinness's user avatar
19 votes

If JWT tokens are stateless how does the auth server know a token is revoked?

Do you need to store the refresh token in a database or store Leaving aside the rest of your question: generally, yes. JWTs need to be short-lived, specifically because there's no good way to revoke ...
CBHacking's user avatar
  • 47.5k
18 votes
Accepted

Does PKCE replace state in the Authorization Code OAuth flow?

The state is given back by the OAuth2 server in the redirected url, so the client app can verify that the request to open the authorization page was indeed triggered by itself. The code_challenge is ...
martinstoeckli's user avatar
17 votes

Why isn't PKCE encouraged for Single-Page Apps?

SPAs would not benefit from PKCE. PKCE solves a different problem than the one you're describing. First of all, for SPAs the current best practice is still to use the implicit flow, not the ...
el_tigro's user avatar
  • 714
16 votes
Accepted

What is the difference between API keys and API tokens usages?

API keys are public, by intent. They are an authorisation mechanism, not an authentication mechanism (this is mentioned in your links). It does not matter how they are generated but it matters how ...
schroeder's user avatar
  • 129k
12 votes

Spoofing POST/GET requests in a RESTful service

My question is what prevents users from intercepting their regular post form the app Nothing. Does the fact that the traffic to the service will eventually go via TLS make this a non-issue? If ...
Ruben_NL's user avatar
  • 119
11 votes
Accepted

Do I need CSRF protection in this setup with a REST API backed with oauth2 and a basic auth SSO auth server?

To answer your initial question: you do not need to implement CSRF counter-measures on your resource server, if you are not using cookies (sessions) and you are not using basic authentication within ...
Daniel's user avatar
  • 361
10 votes

IN OAuth 2.0, how is the client secret supposed to be kept secret?

OAuth2 specification defines two types of clients confidential Clients capable of maintaining the confidentiality of their credentials (e.g., client implemented on a secure server with ...
AGrzes's user avatar
  • 616
10 votes

Is a "magic link" a kind of authentication?

Is a "magic link" a kind of authentication? Yes, it is. It authenticates the user; similarly to reciting a password, calculating a TOTP/HOTP, dipping a possessed smartcard, or presenting a ...
JamesTheAwesomeDude's user avatar
9 votes

PKCE vs Client Secret

It boils down to whether there is a chance your authorization code might leak. PKCE is about preventing leaked "authorization code"s from being useful. When you ask for an authorization code,...
jnnnnn's user avatar
  • 191
8 votes
Accepted

How to verify Google sign-in screen is legit? (Linux Desktop)

Here are some ways I can think of but if someone tried hard enough I don't think there would be a way to stop him. Check a fake email - Google's login will only display a password input if the ...
Bubble Hacker's user avatar
8 votes

Why use OpenID Connect instead of plain OAuth2?

OpenID Connect is a profile of OAuth2... defining an architecture that enables a person to authorize an identity provider to release certain user claims to a client (website / mobile application). ...
Mike Schwartz's user avatar
8 votes

Why CORS preflight is not available for POST requests when Content-Type is application/x-www-form-urlencoded

So my understanding of why this is allowed is so that the implementation of CORS wouldn't break existing and well understood functionality which was already allowed by browsers. This also means that ...
GreatSeaSpider's user avatar
8 votes
Accepted

Is OpenID Connect implicit flow safe to use?

Implicit Flow is now discouraged in favour of Code Flow with PKCE. This is a fairly recent change (in the last year or so), which is why you might see quite a lot of documentation and libraries still ...
Shaun Killingbeck's user avatar
7 votes

Is CORS ever needed during any aspect of OAuth / OpenIDConnect Authentication?

I'm not sure about OpenID, but for OAuth there is no CORS involved for the actual authentication part, though it may be required on the resource server depending on the type of client that is ...
JackW's user avatar
  • 713
7 votes

Oauth2 vs APIKey in a server to server communication

This is an interesting topic and there are a couple of things to consider. First we need to come at it from the API provider, not just the consumer. Who? The main consideration is Authentication vs. “...
llorrac's user avatar
  • 324
7 votes
Accepted

When using PKCE, are the state and nonce parameters still necessary protection from csrf and code injection?

My answer tries to give a short sum up of the most important information, based on Daniel Fett's article "PKCE vs. Nonce: Equivalent or Not?". For a detailed descirption of attacker models ...
katexochen's user avatar
7 votes

Is a "magic link" a kind of authentication?

Do you know those "Login with Facebook" and "Login with Gmail" buttons all around the web? They are almost the same. When you allow someone to login with their Facebook account, ...
ThoriumBR's user avatar
  • 53.9k
6 votes

Why use OpenID Connect instead of plain OAuth2?

Using OAuth as an authentication method is not recommended, it is explicitly designed as a delegated authorisation method. Facebook was using OAuth as an authentication method, but an enterprising ...
Alex White's user avatar
6 votes

Is authentication using Facebook/Google considered good practice?

First part is mainly a partial answer for the desktop application case. Installing a desktop application is not the same as browsing a remote site. In the latter, you trust your browser to protect you ...
Serge Ballesta's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible