user avatar
user avatar
user avatar
Bartosz Rosa
  • Member for 5 years, 7 months
  • Last seen more than a week ago
4 votes

Could encryption become a security breach?

2 votes

Is a secure cookie without the HttpOnly flag a problem?

1 vote

Fine grained authorization with OAuth2

1 vote

Is this private network authentication system secure?

1 vote

OpenID connect authentication with cookie authentication middleware [Asp.Net MVC ]

1 vote
Accepted

Why ASP.Net Identity sends sensitive information to clients?

1 vote

Is sending token authentication information via cookie headers secure?

1 vote

Why does Authorization Code flow need the authorization code?

1 vote
Accepted

Where should 'reset password' functionality be?

1 vote

Is access token confidentiality also ensured in the Authorization Code grant type in Oauth2.0

1 vote

ASP.Net XSS - How does this vulnerability work

1 vote

OIDC/OAuth2 id_token and it's usage in the client application

1 vote
Accepted

ASP.NET Core - are files put in the Shared folder under Pages (where the Razor pages reside) publicly accessible?

0 votes

Logging access tokens

0 votes

Validating JWT in server-to-auth-server scenario

0 votes

JWT is being sent in cookies, but when I try for CSRF they are not sent

0 votes

OAuth2 - using Id Token for authentication to a backend service

0 votes

XSS cookie Stealing with Character limitations

0 votes

Does OpenID Connect provide CSRF and XSS protection?

0 votes

A couple of questions about ASP.Net Core default implementation for login security

0 votes

Alternative to using Refresh Tokens?

0 votes

May I use OAuth2 for non third-party applications?

0 votes

Can I rely on the CSRF cookie to check if a user is authenticated on the client-side?

0 votes
Accepted

How to handle sensitive data like API-keys and DB passwords on production

0 votes

Storing certificate bundles (.pfx files)

0 votes

How does a user get authenticated on server B if they are already authenticated on server A through OAuth2?

0 votes

OIDC SPA Keycloak refresh_token storage location

0 votes

Validating iss and aud for internally signed JWT

-1 votes

What's the concrete case for code flow being more secure than implicit flow?