Questions tagged [authentication]

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

Filter by
Sorted by
Tagged with
0
votes
1answer
67 views

Can I store a refresh token in a queue?

We have a standard microservices setup (Identity Server, API Gateway, services, etc). Some of the services schedule events to be dispatched in the future (future = anything from mins to months ahead) -...
0
votes
0answers
23 views

Implementing login sessions in SwiftUI-WebView app that connects to web service

I am in the process of developing a business app for iOS using SwiftUI, that will have CRUD operations to logged in users. Most of the functionality will be provided using a webview (with WKWebView), ...
0
votes
0answers
22 views

Implementing Federated authentication/SSO

We are building a SASS application that is making use of an existing application agnostic set of APIs that provide authentication functionality (among other things). This set of APIs provide OAuth ...
0
votes
0answers
15 views

Best practices using OAuth 2 for authentication in existing API

I am extending an existing API (GraphQL) with authentication through OAuth 2.0 and OICD: The current API uses JWT tokens for authentication (there is more than one type of token, but I don't think ...
0
votes
0answers
26 views

Synchronising OIDC Provider and User Table

I asked this question on SO which is related to this. In this question, I propose exchanging a token from my OIDC provider for a token in my own custom OIDC provider, which becomes the ultimate token ...
1
vote
1answer
76 views

Authentication with JWT in HTTP only cookie without refresh token

The motto of the upcoming question is "I don't know what I don't know". I would like to know if there are downsides or security risks with an authentication implementation. Right now, I'm ...
0
votes
0answers
29 views

Autherization flow - one party accessing another party as third party - is this a correct way to do so?

I've been suggested an authorization flow between three parties that seems not secure to me, and I would like to know if I'm assuming correctly. Let's say Party A has many customers (one of them let's ...
0
votes
2answers
61 views

What's the right way to handle authentication of users across 2 web applications

There are 2 independently functioning web applications. Web-app1: (Flutter+Django+Postgres). Web-app2: (Angular+Spring+Postgres). Each of the web-apps has its own user database and are functioning ...
-3
votes
1answer
39 views

Serving content to authenticated users

I'm wanting to store lots of data in cloud storage - like S3. I want some data to only be accessed by authorised users, one way I could do this is to authenticate the user on my service, download the ...
0
votes
1answer
33 views

Enriching JWT after OpenID Connect flow

I am struggling to find a good solution for authorization of users after they were properly authenticated through an oidc flow. Let's assume the following setup: An angular SPA is interacting with ...
0
votes
0answers
24 views

Auth strategy for local Docker services

I'm trying to choose an authentication/authorization strategy for some Docker services that all run on a single Linux IoT device. There are N number of 1st party services, and a single 3rd party ...
0
votes
1answer
108 views

Why do users and programs have different client authentication mechanisms?

Typically in any application, the way a user (human) is authenticated is using a username/id and a password, whereas programmatic or api based access is authenticated using API keys (based on system ...
-2
votes
1answer
45 views

authentication flows for secured applications

There are many secured applications developed in node.js. However, I could not find any framework (like Spring-security in Java) that can be used to save the trouble of managing the authentication (...
2
votes
4answers
293 views

How to compare passwords which is stored in DB in encrypted form in secure way?

Recently In an interview I was asked this question - Question- If are storing passwords in encrypted format in DB and in future when user login into our website how will we perform authentication? Me:...
1
vote
1answer
72 views

Implementing SSO on a REST API

I have a REST API server with its own authentication methods. I need to provide to some third party apps an authentication solution which should be processed on my server, I don't want them to handle ...
1
vote
1answer
85 views

How to randomly allocate a set of IDs digitally, one ID per person, such that everyone knows that the particular allocations are kept private?

I have a set of UUIDs that I want to assign to a set of people. I want to deliver these UUIDs to people in a secure manner, such that everyone knows that I do not know which UUID corresponds to which ...
2
votes
1answer
492 views

Refresh tokens by example using Angular and Spring Boot

I am designing out an app that would have an Angular frontend and Spring Boot (Java) backend. I was considering (but not married to) the prospect of JWT-based authentication: User logs in with ...
0
votes
0answers
51 views

How to generate refresh token and store in database for multiple devices of one user?

Sorry for the title. I went through possible attacks when JWT is stored inside localstorage of browsers. Now, I am storing both accessToken and refreshToken inside a cookie with secure flag and ...
-1
votes
3answers
239 views

Offline user authentication

One of our customers had a pen test performed on our application this week and let's just say it didn't go well. The main issue they have is that user authentication takes place on the client, rather ...
0
votes
0answers
25 views

How to manage sftp users from a web portal

I currently have an sftp server (OpenSSH on CentOS) which uses the local system users for authentication, with a 2FA by Google authenticator. Now, this solution is not optimal, because: the users do ...
2
votes
2answers
117 views

Authenticate users (REST-API)

What I'm trying to build REST-API using Express and SQLite 5 to 10 authors should be able to post articles to /articles except them, no one is allowed to post anything My approach to build it ...
0
votes
1answer
72 views

Can I call a WCF endpoint from ASP.Net Web API?

I have a web api with controller methods that use rest http(post/get calls). Clients consume this API with normal httpclient calls and I pass an http response back. My use case is I have a legacy ...
0
votes
0answers
49 views

Providing guest users with full accounts vs only sessions (a.k.a. guest checkout)

I'm working on a web application with JWT authentication (with token stored in cookie) and an SQL database. Upon loading, the frontend makes a request to the backend to determine whether the user is ...
0
votes
0answers
37 views

How to authenticate an API in a headless web-app?

For learning purposes, I'm trying to build an Expense Tracker web-app from scratch. I'm in the process of designing it before coding it. I decided to attempt to make it a Headless Web-app: The main ...
-2
votes
1answer
53 views

Authentication solution for custom PHP-based API

Here is description of my app I'm working on. On the client-side (index.html) a user can interact with a data. When he needs to call a server operation for example reading or writing a file on the ...
5
votes
0answers
85 views

Is it possible to use a reverse proxy authentication in a native mobile app

We have a few backend services that our frontend SPAs fetch data from. Right now, the SPAs use JS libraries to authenticate with the Auth server (Azure AD) which returns a JWT which is validated by my ...
2
votes
0answers
74 views

Is it possible to use an SPA as the UI for an OAuth 2.0 authorization server?

Using SPAs as the UI in front of an API has become standard practice, with OAuth 2.0 / OIDC being the common authz mechanism for this. This approach generally entails the SPA receiving its access via ...
1
vote
1answer
52 views

Authentication-as-a-Service (Auth0) and retrieving user profiles for many different users

For my recent project I decided to leverage Authentication-as-a-Service, in particular I am using Auth0 but I do not think this particularly matters. I've got my React client set up correctly and I am ...
1
vote
1answer
102 views

API AuthN/AuthZ and API Gateway

I have implemented authentication on an API Gateway level using NGINX+ and now I have concern if APIs behind it should still to authenticate using API Keys or JWT? What are best practices? My point is ...
0
votes
2answers
244 views

Should I return user data in an authentication endpoint using JWT?

I implement an auth endpoint which takes an email and password and returns a JWT token. Inside the JWT there is a payload containing the user ID. Does it matter from a REST/JWT standards perspective ...
2
votes
0answers
213 views

How to retrieve login token from repository in network layer? Domain Driven Design - DDD

I am trying to come up with a design for an application I am working on. Here is a basic picture of what I am looking to do. Everything up to the Data Layer is totally fine but the Data Layer makes ...
1
vote
1answer
63 views

Token based authentication to multiple API servers

We have a Web server (which also does authentication and authorization) that manages, via an API, one or more servers that contain highly sensitive data. In the below architecture diagram, we manage ...
0
votes
0answers
42 views

Where to carry JWT Tokens in Requests

I have an AspNet application which I'm authenticating using a separate AspNet Core application. It returns a JWT token which is then carried in a Http Cookie. The AspNet application validates each ...
0
votes
1answer
177 views

What is the most common stateless way for authentication in microservices?

I'm trying to get into Microservices by creating a project, so far I've stumbled upon authentication mechanisms, in a monolithic architecture, the client (web app) would send a request with the user ...
0
votes
1answer
40 views

How to secure messaging-based communication with microservices

I'm comfortable with a lot of OpenID Connect and OAuth2 concepts in the context of HTTP-based communication between microservices. I'm currently leveraging Azure AD. In the HTTP-based scenario I would ...
1
vote
1answer
117 views

Securing API with JWT and elevated access using MFA

At my company we have a central auth server running IdentityServer. There are a number of applications providing some API to client applications. API requests are authenticated with JWT tokens issued ...
1
vote
1answer
78 views

How can I share authentication information between all the server?

I'm developing a web service that have following structure: Web Server: this is implemented with NextJS which do Server-Side Rendering and serve server-side rendered webpage data to Client. API ...
1
vote
0answers
33 views

Building an app+backend with extraneous functionality for an existing web shop. How to handle authentication on the backend?

This is an architecture question as I've been asked by an existing web store to build a mobile app (they don't have a mobile app) that provides extra functionality to the store, a web admin panel to ...
2
votes
3answers
121 views

When to derive user ID from authentication token vs. validate against?

I am using JSON web tokens, but this authentication token can be any token from which a unique user can be derived. I am designing a REST API that allows CRUD operations on resources owned by specific ...
0
votes
1answer
116 views

API / System Design [Flexible Authentication / Authorization]?

Background: We're a smaller shop that puts out a number of products that require authentication and authorization. We're currently using a 3rd party service to "spin up new auth APIs" for ...
0
votes
1answer
107 views

How to handle authentication & authorization inside microservices

Example Application I will try to explain my problem by using a familiar application. Lets'say I'm building a Discord / Slack / Microsoft Teams clone; and for simplicity’s sake, it will contain 2 ...
1
vote
0answers
70 views

Reactjs + nodejs external authentication flow

I am developing a RESTful application with nodejs in the backend with express.js as middleware. I am also developing a client in Reactjs. I want to use an external authentication service (LDAP/AD/ADFS)...
1
vote
1answer
217 views

HTTP(S) API authentication: why not many services require signing (HMAC)?

I am currently researching existing authentication/authorization solution that are used for REST APIs. More specifically I'm interested in backend-to-backend interactions but client-to-backend is ...
1
vote
0answers
62 views

Best Way To Store Password & JWT on Mobile

I have a Flutter and Angular application that previously used Firebase, but for various reasons I'm working on switching it over to my own RESTful API with ExpressJS. One topic I'm a little confused ...
0
votes
1answer
164 views

Moving authentication outside the domain layer

In discussion about an architecture decision that we do consider wrong and how exactly to address it, some lack of understanding on the matter arose. In dealing with authentication and authorization, ...
1
vote
2answers
96 views

Authenticating requests from third party users to our APIs

We have a web app which has certain APIs. Users of our webapp will use these APIs when they login to our webapp (like how many records me as a user do I own, user specific, etc). We are creating ...
0
votes
3answers
163 views

What is a recommended authentication architecture for a front GUI app that I want to control but that will be used by others to control their servers?

I have a front end (WEB GUI) app that I designed (Python for now + JavaScript in the future) that I use to access a controller, it uses REST APIs. I want to publish this app in the cloud so that ...
1
vote
0answers
21 views

Design REST API for Mobile Apps with Unregister Users

I'd like to know some best practices on how to build rest API for a backend which shall communicate with a mobile app by anonymous users. This is the scenario with details: I'm building a demo library ...
1
vote
0answers
54 views

How does Google Analytics prevent tampering?

I'm building a simplified web tracker as a side project. One of the things I'm unsure about these cloud-based trackers (like Google Analytics) is how they prevent abuse of their platform; in other ...
-3
votes
1answer
44 views

Do I need MongoDB (or another type of database) to authenticate with Google?

I'm creating a web application using Node.js and Pug, and have recently been looking at adding external OAuth authentication to this site, using Express and Passport.js. I've found a lot of examples ...

1
2 3 4 5
8