Questions tagged [authentication]
Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.
427 questions
3
votes
1
answer
68
views
Next Auth Flow For Use with Ruby on Rails API
I plan to have a frontend web app written with Next.js using the AuthJS library to provide user authentication using Oauth. This frontend application depends on a backend API. I want to make sure my ...
- 139
0
votes
1
answer
92
views
Database structure for two-step registration flow
I'm trying to design a database for supporting a multi-step registration flow. The registration flow goes like this: the user logs in via OAuth (which creates a session and user), then they're asked ...
0
votes
0
answers
74
views
Edge Case For Cookie Based Token Management
I have a React frontend and a Nodejs backend that uses authentication via an OIDC service provider. After a user goes through the SSO authentication flow I store the token (containing a refresh token ...
- 9
2
votes
3
answers
457
views
Race condition when issuing a refresh token: worth addressing or not?
I'm quite new to the world of access and refresh tokens, so bear with me.
Client uses its refresh token to get a new access token.
The server invalidates the just used refresh token and contextually ...
- 125
0
votes
1
answer
41
views
Best way to approach connection between game server to client connection with Django web server as middleman
I have a web game design question. I am trying to build a multiplayer web game with non-intensive graphics (ex tic-tac-toe, chess). I am trying to figure out how to take already authenticated users in ...
1
vote
1
answer
207
views
Necessity of one-time codes in 2FA
Why is it that some services, when they conduct 2FA ask you to rewrite a code from an app, even if that app is part of that service's infrastructure? For example, when I log in via the web to ...
- 21
3
votes
2
answers
613
views
How does "remember this computer" work?
Website multifactor authentication prompts will often include a "remember this computer" checkbox. How does this work?
In order to be secure, it needs to be more than just a cookie, as a ...
- 476
0
votes
1
answer
85
views
Designing a restful API for a desktop application to facilitate communication with other APIs
Just for some context, I am a CS student in my second-year who is working on a C++ desktop application (using the Qt framework) made by an engineering professor.
The application is an educational tool ...
- 1
0
votes
1
answer
112
views
Authorization business logic on claims or on app database?
Context: I have an API (using DDD) with an entity lets call it "Content" that only can be update by certain users.
For example Content with Id = 1, can only be modified by User Id = 1, ...
0
votes
0
answers
40
views
Passing JWTs securely back to the mobile app frontend after signing in with Google OAuth2
I have a server(API) written in Flask and a client(mobile app) written in React Native. The application allows for logging in with either email/password OR with Google. The Google authentication flow ...
0
votes
1
answer
38
views
Is using an Azure Function to forward a message to my App Service the best idea for handling a Twilio Web Hook?
I have an Azure App Service running a .NET (Core) API for an inhouse application, which I'm integrating with Twilio to handle Whatsapp communication.
To handle the web hook responsible for receiving a ...
- 141
2
votes
1
answer
69
views
Azure Managed Identity and Zero Trust
Azure Managed Identity provides a mean to only allow explicitly defined users/apps to access a given resource. For instance I can setup that no-one can access my database except the Managed Identities ...
1
vote
2
answers
311
views
How to best obfuscate a built-in key in an application?
We're building an application that needs to log into a website using built-in credentials. It's not optimal to say the least, but we're stuck with "knowing" the username and password ...
- 419
0
votes
0
answers
90
views
Securely Handling Session Keys in Excel for API Authentication
I'm working on an Excel tool that needs to synchronize with a CRM via its API. The CRM's API authentication process involves logging in with a username and password, after which a session key is ...
1
vote
0
answers
58
views
How to merge SQL Server database authentication with firebase authentication?
I have Firebase connected to my web app and users can authenticate using the 'microsoft' provider. The provider only allows authenticating with the active directory tenant that I specified in my ...
- 19
1
vote
1
answer
72
views
Persistant Browser Display Settings for Users
I have a question about what's the best approach to handle persistent data for web apps.
I have a web app that is authenticating through an auth service. once authenticated it makes requests to the ...
- 13
2
votes
1
answer
181
views
web-dev: how to restrict access to costly backend API to authenticated clients only
I've created a small prototype browser plugin and am now thinking about making it accessible to the public. This brings up an important question about gatekeeping API access and the right way to ...
- 446
0
votes
0
answers
158
views
JWT Cookie and API Gateway
Background
I have an authentication microservice that handles the user authentication and returns 2 JWT cookies (access_token and refresh_token).
I want to incorporate an API gateway that does the JWS ...
- 9
-1
votes
1
answer
108
views
How are first-time users signup requests authenticated?
I have a web service. When a user makes a request, traefik first redirects it to my users micro service, to pass through an authentication function.
The token (or username+password, on first request) ...
- 143
1
vote
0
answers
161
views
OpenID Connect and User Management Best Practices
Currently my company has 2 applications that use Identity Server for SSO. Not every client we have uses both applications but some do. The part I'm uneasy about is that both apps have a user ...
- 146
18
votes
9
answers
5k
views
Authentication and authorisation for people with intellectual disabilities
Currently, I'm involved in a research project in which we are evaluating an existing web environment providing a safe online playground for children/adolescents with intellectual disabilities. Certain ...
- 349
5
votes
3
answers
968
views
Group set of commands as atomic transactions (C++)
We're designing the architecture of an embedded device (esp32). One of the tasks is that the device should connect to the internet and use a preprovisioned redeem code to register itself with our web ...
- 419
1
vote
1
answer
105
views
Is my security pattern correct for authenticating principal users to my microservices?
We are trying to implement an authorization and authentication service for our product.
Now, we would have to cater to different kinds of IAM systems like SSO, LDAP and Basic Username+Password in ...
- 19
-1
votes
1
answer
116
views
What is the best way to authenticate a user over IVR?
I am trying to build an IVR system that requires some form of username & password/pin entry to access sensitive data. My naïve solution seemed obvious enough, until I realized that username/pass ...
- 579
0
votes
1
answer
327
views
Using Azure AD as an identity provider in Keycloak-based applications: how can I add missing user data to my client applications?
I'm currently using Azure AD as my identity provider and Keycloak as my intermediary/broker for my client applications. However, I need some user attributes (such as phone, email, picture, and ...
- 121
0
votes
1
answer
70
views
Including currect user/roles data within object state in .Net applications to control object behavior
I am building a .Net Core Blazor Server application. The application creates records of a Project class which move through a workflow with various phases of review and acceptance/rejection before ...
- 111
0
votes
1
answer
136
views
How can a web application distinguish between sessions from trusted and non-trusted devices?
For compliance reasons, we want admins of a web app to work on it from devices (phones or computers) approved by IT. Or rather, they can work from other devices, but should get logged out quickly, so ...
- 1,477
0
votes
0
answers
258
views
How can I secure the backend in a meaningful way when users log in via OAuth2 in the frontend?
I'm thinking about a rewrite of a existing application. This legacy application does not separate frontend and backend. It's a single application with server side rendering.
I want to rewrite it to a ...
- 121
0
votes
0
answers
51
views
API authentication for iOS applications
I am currently working on my own iOS application and am going to be using a locally developed API for fetching data. I wanted to outline my current account sign-in architecture and verify this is ...
- 17
0
votes
1
answer
1k
views
Can I use a session cookie for API authentication?
I want to build a web application with a Single Page Application as the front end and an API as the back end. The front-end SPA will read and write data to the API.
The SPA and the API will be hosted ...
- 101
0
votes
0
answers
142
views
WebApp: How and where to handle an expired authorization with 'back to login'
SituationI have a Single page web app with REST API. When the user logs in, they receive an authorization token. The token which will expire after some time.
When the user tries to make a server ...
- 276
0
votes
2
answers
103
views
OAuth Client Credentials Security Concern
I have a scenario I am considering, and I don't quite find out what's the best solution with OAuth. Hopefully I can learn good things here.
We are company A and we specialize in managing secure text ...
- 397
1
vote
0
answers
1k
views
Authorization using Azure AD B2C access tokens in Python / Flask
TLDR:
I am trying to
validate a Azure AD B2C access token in my Flask web API
use scopes from that access token to authorize calling protected resources
use timely and secure solutions such as PKCE ...
- 121
0
votes
5
answers
698
views
Authentication for an app that only has one user
I'm going to write a blog app for myself, and though I've written authentication for multiple users. It seems heavy handed to use the same kind of architecture for one user.
The only alternatives to ...
- 111
0
votes
1
answer
538
views
Any way to forward an auth session from OAuth system to another system (with API key)?
Description
This is a long shot, but I'm in dire need of advice. If you know of a more appropriate forum for this type of question please share!
I'm working with a legacy OAuth system using email + ...
- 1
3
votes
2
answers
2k
views
Oauth 2.0 - MFA for REST APIs
We are looking at implementing Multi-factor authentication for our application, using Time-based one-time password (TOTP) algorithm.
What we want to achieve:
Users should have the option to enable ...
- 133
-1
votes
1
answer
247
views
iOS application token auth best practices
I am looking into building an iOS application and using an internally built API to access data. My API has some authentication endpoints that takes in a username and password and, if the login is ...
- 17
0
votes
0
answers
199
views
What is the right way to update claims in identity-server 4 from Angular
I have a multitenant application where a user can belong to multiple tenants. I'm using Identity-Server 4 for the authentication.
I have two applications Angular and API. When a user is not ...
- 109
0
votes
1
answer
200
views
Should an access token really be cryptographically signed?
In a web app I'm writing, a singed-in user is recognized by their cookie containing a session identifier. That session id has sixty-four bits of entropy, so I believe brute-force attacks are ...
- 113
0
votes
0
answers
75
views
How to authenticate client and user
I could use some feedback on designing a solution for handling two OAuth flows in a single request.
I have an API that currently supports OAuth2.0 (for users).
It was requested that we should be able ...
-1
votes
1
answer
164
views
Auth flow between two services
We have two applications, each of them separated with its own backend and frontend.
The first application is the user-facing one. They register on the site and as soon as they want to execute a ...
- 31
2
votes
2
answers
1k
views
How to authenticate front end with backend in an anonymous user flow [closed]
I have an API that will be exposed on the internet publicly, the primary use of this API will be initially by a ReactJs front end but in the future we'd be looking to open this up to other clients ...
- 181
0
votes
0
answers
624
views
Best practice architecture to implement Spotify Auth for a Flutter frontend app and Node.js backend?
I am currently building an application that uses the Spotify API to work with a user's playlists. My frontend is a Flutter app, which is connected to the backend, that is built with Node.js. Currently ...
- 9
0
votes
2
answers
500
views
Design of a passwordless signup and signin
I am currently planning to create an application. So far I have always been using the traditional username/password approach. But I would like to get rid of passwords for user authentication. This ...
- 133
0
votes
1
answer
2k
views
How to share users between multiple web application?
Objective
I have to create way to use the same users to connect to multiple application, and i am thinking about how to do it and how to share the data between the applications.
Details
Each ...
- 121
-1
votes
1
answer
675
views
Securing http communication between backend services [closed]
What is a good way to secure http communication between two backend services which are not hosted on the same network?
One way might be to have a shared secret in both services but I feel like that is ...
- 129
0
votes
1
answer
680
views
Understanding the JWT and refresh token approach
I've read a few articles which cover the set up for refresh tokens and JWT tokens
Is there a best practice in how/when to get the next JWT token.
In my head, there are a few different approaches. I ...
- 1,881
0
votes
1
answer
179
views
How to model users in multiple workspaces
In Slack and other apps, a user's email can be tied to multiple workspaces.
What’s the best approach to architecting that? Do you list workspace IDs on the user record, or do you maintain a list of ...
- 125
-2
votes
1
answer
81
views
Should I wrap Azure AD B2C for authentication?
I want to implement an authentication system. The purpose of the system is to centralize account management and handle the complexity of account security. Internally, I don't want to implement the ...
- 1
-1
votes
2
answers
240
views
How to keep authentication in user context in reactive programming?
I want to execute everything in a user context. Meaning that if the request comes from one user then the service has a token of only this user and can't execute anything for another user.
Now the ...
- 384