Tangui
  • Member for 2 years, 8 months
  • Last seen more than a month ago
OpenIdConnect: Is there an advantage to using code flow over implicit flow with form_post?
Accepted answer
4 votes

I don't see any security advantage of using the authorization code flow in your case (traditional web application). Indeed, form_post is not vulnerable to referrer leaking or browser history leaking. ...

View answer
What are the benefits of using WebAuthn?
Accepted answer
3 votes

WebAuthn essentially protects against phishing. An attacker can create a fake website (of your bank, for example) and convince you to enter your password on the fake website. Then, the attacker can ...

View answer
How to store Oauth2 Access Token in a Cookie correctly?
2 votes

You don't want to store access token in a cookie. Depending on the application, you want: typical web application: store the tokens in your backend (database...) native mobile application: store the ...

View answer
How to report error if redirect_uri doesn't match?
Accepted answer
1 votes

According to the specification, you should display an error message on the authorization server (option 1): If the request fails due to a missing, invalid, or mismatching redirection URI, or if the ...

View answer
OAuth Authorization Flow without external user agent for iOS application
Accepted answer
1 votes

Issue 1 - Avoid using a browser at all. First important thing to understand is that originally, OAuth2 was designed for 3rd-party API access, which is why flows and security models are designed for ...

View answer
Is OAuth2.0 really secure for a mobile application?
Accepted answer
1 votes

OAuth2 is a way of storing a session token. It is, however, standardized and the the threat model is well documented. Even though OAuth2 was indeed designed for 3rd-party access to APIs, it is still ...

View answer
What's the concrete case for code flow being more secure than implicit flow?
1 votes

1st question: it mitigates attacks described in OAuth 2.0 Security Best Current practice draft-ietf-oauth-security-topics-133.1.2. Implicit Grant, mainly: browser history token leakage compromised ...

View answer
Attacker models of long-term logins: how should sensitive server endpoints require re-authentication?
1 votes

Geir's answer is great and valid for OpenID Connect. One note though: as of today we're still struggling with SSO solutions (Single-Sign On, supporting OAuth2 / Openid Connect / SAML2, etc. protocols) ...

View answer
Is it recommended to send an authentication request to the Resource Owner (by the Authorization Server) if it already has an active session?
Accepted answer
1 votes

Actually you won't know from the client side whether the resource owner has an active web session on the authorization server or not, and it's not the client's matter. That's however up to the ...

View answer
Authentication via HTTP on VPN
Accepted answer
0 votes

If you consider that the network between the VPN's endpoint and the OAuth2 server is safe (because request are reencrypted, or it's a "trusted network"), then an HTTPS tunnel or a VPN tunnel ...

View answer
Logging access tokens
-1 votes

As long as your access tokens are opaque randomly generated strings, it seems to me there won't be any security issue proceeding like this.

View answer