Skip to main content
Geir Emblemsvag's user avatar
Geir Emblemsvag's user avatar
Geir Emblemsvag's user avatar
Geir Emblemsvag
  • Member for 8 years, 10 months
  • Last seen this week
0 votes

What is the purpose of JSON Web Token (JWS)'s issued at "iat" field?

0 votes

Multiple user sessions at the same time in a backoffice

2 votes

Could a bad actor get hold of your credential sent via https if you are connect to their fake network?

1 vote
Accepted

Logout functionality with JWT Session tokens

4 votes

Authorization Header in dev tools

3 votes

How to ensure JWT security in authentication?

4 votes

Are downloads from http connections safe?

0 votes

OIDC SPA Keycloak refresh_token storage location

55 votes

Should 2FA be enabled on service accounts?

1 vote
Accepted

Attacker models of long-term logins: how should sensitive server endpoints require re-authentication?

3 votes
Accepted

What are the security risks to displaying an image loaded over http in a page loaded over https?

1 vote

Is using haveibeenpwned to validate password strength rational?

1 vote
Accepted

Store user credentials vs store refresh token

2 votes

Id token contains sensitive information sent by the GET method

3 votes
Accepted

Why " Simple Integrity Property" axiom of Biba model protects data integrity?

1 vote
Accepted

SQL databases password profiling: Same password for all DBs (while it is different from root) - A meaningless step?

1 vote
Accepted

What does Frank Abagnale mean by "Level 4 security" in his talk at Google?

0 votes

Is it ok to write OidC Bearer token to log?

2 votes
Accepted

App hosted Oauth login pages: what stops forgery?

1 vote

How does the authorization work after authentication using OpenID Connect

11 votes

How to do role-based authorization with OAuth2 / OpenID Connect?

-1 votes

What kind of security comes from blocking cross-origin-requests when cors exist?

9 votes
Accepted

Why does OpenID Connect ("OIDC") use a `nonce` claim instead of the `jti` registered claim

1 vote

Prevent CSRF on public website with no login

2 votes

CORS clarification

1 vote
Accepted

oAuth2 scopes and filter conditions in url

4 votes
Accepted

Is my password compromised?

3 votes

JWT or public-private keys for service to service API calls

1 vote

Can users read client SSL certificates from a react native mobile apps APK?

7 votes

Why are developers using embedded user agents for 3rd party auth? What are the alternatives?