Questions tagged [authentication]

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

Filter by
Sorted by
Tagged with
-4
votes
0answers
20 views

Token Authentication for Rest WCF Services

I had built Electonic Medical Records (EMR) App using a 3-Tier Architectural style. Storage Tier: SQL Server Application Tier: WCF Rest Services hosted in IIS Presentation Tier: Website calling ...
2
votes
1answer
45 views
+50

Chaining openID token

I'm working in microservices environment, where each service authenticates using OpenID Connect to an authentication service (local IdP), based on Users I keep locally on my Database. Now, I want ...
0
votes
1answer
46 views

Offline-Login Procedure in PWA

I have kind of a unique usecase: Phones that are used to connect to the app might be shared Connections are very unstable (sometimes no connection for half a day) Data should be accessible through ...
1
vote
1answer
45 views

Using Django Sessions when views are accessed by API

I'm making an app which is a Django backend and a React frontend (being developed by someone else). The plan currently is to fully decouple the two and have them communicate over API. However, I would ...
2
votes
3answers
128 views

Securing API for third party use

We have a set of microservices and would like to expose endpoints from a subset of these for third parties to use. To this end, we will build an API Gateway that acts as the access control mechanism ...
0
votes
2answers
129 views

Is it ok to use .Replace(“ ”, “+”) when reading hashes in a querystring?

I am letting users change their password after a reset, by following a link containing hashes of the password and user name (e-mail address). The link can look like this: www.example.domain/login?...
0
votes
0answers
40 views

Which authentication should be used for external users (not registered with the system)

I'm working with a project that uses ASP.NET Core 2.2. The main solution contains different projects, including APIs for a mobile application, APIs to integrate the system with third parties, a web ...
21
votes
9answers
8k views

Is this scenario an exception to the rule of never storing passwords in plaintext?

I am making a full-stack web application for a professor. At his request, the passwords and usernames are generated programmatically, and they cannot be changed or reset by the students. (If you ...
3
votes
1answer
38 views

Securing a voice assistant skill/app - any established patterns?

When creating new skills/apps for a voice assistant such as Google Home or Amazon Echo, are there any established patterns for providing an extra level of security for certain actions that go beyond ...
0
votes
1answer
83 views

Authentication and Signup with Microservices

I am looking for the best practice to do authentication (login) and signup using microservices, given that microservices are not supposed to share the same data. At the moment I am thinking: Two ...
0
votes
0answers
23 views

oauth2 + angular - Most elegant way to pass the JWT auth token

I have an angular application, which is querying an API as a client (written on Spring Boot 2.2.1 + Spring 5.2.1) that supports 3rd party authentication over OAuth2. The API has altogether 3 different ...
2
votes
0answers
24 views

How authorize web application and manage sessions

i am building a single page react app that uses redux as state manager and an express node js as backend server but i don't know what is the best way to authorize my users in the application! if it ...
1
vote
1answer
88 views

Hashing from within the database or outside?

I am in the process of evolving architecture for an 'equity analysis system'. I will be using SQLServer as the database, but I am not going the .NET route and won't be using the built-in 'membership' ...
4
votes
1answer
58 views

Shared access tokens in a distributed system

I'm building a system that horizontally scales with many nodes. Any of these nodes could consume an API that's hosted on https://example.com/api. The authentication for this API is token based. My ...
2
votes
3answers
80 views

PHP : authentication with a temporary link

in my system users register with their email address and receive a temporary link to log in. hostname/login/OYkwIJt6be1V5kMg10G The token must be generated from the email adress of user and valid ...
0
votes
0answers
61 views

Granular application security in a multitenant application that utilizes a centralized identity server

We are currently rewriting many of our internal desktop applications and converting them over to white-labeled, multi-tenant web applications. As part of the transition, we've setup a centralized ...
2
votes
2answers
93 views

How to combine session-based authentication and stateless REST API

What is the proper way of combining session-based authentication with stateless, token-based authentication for a REST API? Use case: User logs-in in the standard, traditional, session-based way. ...
0
votes
1answer
82 views

Why should an authentication server and a gateway be two distinct components?

Why should I decouple an authentication server from a gateway in a micro services architecture ? A clear drawback is the additional network load needed to query the auth server in each request. ...
2
votes
1answer
58 views

Role based authentication/authorization security

I have my backend endpoint for registering and logging in the users delivered trough RestApi or GraphQL to be more specific. I want to implement role based system for my users. The admins and ...
-5
votes
1answer
64 views

Upload fingerprint from android/ios to cloud

I am working on a project to use fingerprint to authenticate the user. I don't want the authentication to be device specific. Hence want to upload the user fingerprint to cloud. I do understand that ...
1
vote
0answers
44 views

Grant type/flow to use for multitenant application

Let's image we have a multitenant(organization) application having a separate database per tenant(organization). The core of the application is a REST api service protected by an authorization ...
0
votes
0answers
12 views

Using both jwt tokens & api lifetime tokes in Laravel app

Previously I had some experience using JWT tokens when making SPA. The workflow is: User enters email & password, gets JWT token, the token is stored in local storage and is passed in each ...
2
votes
4answers
527 views

Is there a way to store a secret API key to my backend, which the frontend can safely ask for?

I'm using the google maps API, which has a secret key that I need to use on the client side. I was thinking of some alternatives to store it safely. One of them is storing it in my flask database. ...
1
vote
2answers
843 views

Authentication and authorization - front-end vs back-end dilemma

I'm working on centralized authentication and authorization API system and got stuck in front-end vs back-end dilemma. Front-end person is telling that should to have only one request to that API to ...
2
votes
0answers
25 views

Architecting OAuth2 Flow With an API and Static JS Client

I'm building a very security conscious application. (All applications should be security conscious, but this one may contain a lot of red data). Assuming that I will use a Vue/React JavaScript Single ...
0
votes
0answers
25 views

Methods for storing data pre-registration in a web app

I have a web app - it's more complicated than a todo list but for simplicity sake let us assume it is a todo list. The user has the choice to sign up and create an account thus allowing them to store ...
3
votes
0answers
89 views

Are session with cookie for authentication are dead? [closed]

I have an unpleasant discussion with a colleague who said using session in Java Web Application to validate authenticated users with cookies from Web browser after users logged in is problematic (...
4
votes
1answer
154 views

Delaying sensitive database operations until additional authentication conditions are met

I have a REST API where authorised users sometimes need to make changes to data about their company. For the most important information (e.g. IBAN details might fall under this category), we need to ...
3
votes
0answers
61 views

Architecture and Security in a Web/Native app while generating PDFs

I am trying to make a system where a user can view/download his statements (say salary slips). The user will have ability to download PDF versions of these statements and can also save them to Google ...
0
votes
1answer
56 views

Authentication, Sign In mobile

I am new to mobile development. As i understand the best way to authenticate/give authorization to a user is using OAuth2.0 with the social providers as Facebook, Google ect ... When we enter the ...
0
votes
1answer
42 views

Adding authentication and filtering in the service layer

I am currently developing a simple web-based application that consists of various layers: Model Layer Performs simple CRUD operations and provides access to the databes. Implements functions such as ...
0
votes
1answer
53 views

Designing Rest API endpoint for viewing bearer access token

We have several endpoints which were authenticated using a bearer access-token. There was another endpoint which will renew/generate a new bearer access-token on passing valid secret_id and client_id. ...
1
vote
1answer
69 views

Api limit access to subscribers only

I have a vanilla php api(on a vds) and I want to make data coming from that api available to a few clients that are using a python app that's also written by me. That python app is running on my ...
4
votes
2answers
304 views

Authentication setup advice for web app and its backend API

I am fairly new to web development, and I am learning to build web applications. I am facing a problem figuring out how to set up authentication mechanisms for a multi-user application. Let me provide ...
1
vote
2answers
440 views

How to keep user logged in when using OpenID Connect & Cookies in dotnet core?

I'm working on an OpenID Connect Hybrid flow, basically the response type in my case is: code id_token Problem: I can't seem to persist the session of the user when logged in using the id_token. I ...
1
vote
1answer
131 views

How to handle API token(s) that expires after time

I'm currently building a facade that's supposed to be in front of a system we are currently using. This system has its own API, but we have decided to simplfy things, and therefore the facade. ...
0
votes
0answers
29 views

Recommendation for user synchronization between organization and external website

We are building a small social media platform for collaboration among a group of similar (but disparate) organizations. Each organization will have a small group of users who will be able to post ...
-4
votes
1answer
117 views

Is it bad to leave Azure secrets keys as plaintext in my source code if I don't release the code, only the exe? [closed]

Specifically worried that someone might be able to extract the API key in a way I am unaware of and make calls to my own Cognitive Services subscription outside of the context of my program.
0
votes
2answers
125 views

Is creating a leaderboard web API that can't be fudged possible?

Let's say you have a game, and players of your game can get scores. You also want to be able to post these scores to a server using calls to a web API. Obviously, you want to be able to tell who sent ...
4
votes
0answers
49 views

How to authenticate third-party callbacks that don't support authentication

I'm working on a project that integrates with a third-party service via API, and the third-party uses callbacks to update us on the status of the operations being performed. These callbacks can be hit ...
1
vote
2answers
122 views

Handling refresh token revocation

I've been implementing an authentication flow for an app that I've been making that uses JWTs. When a user is initially logged in or when they register (which immediately logs them in), I provide an ...
0
votes
1answer
78 views

Is a refresh token an entity or value object?

I have a User entity, which may have a RefreshToken (for authentication). Notes: A refresh token doesn't have "identity", but is related to a single user - it is only valid for that user. In the db ...
1
vote
0answers
80 views

ACL entity and microservices database relations

I would like to build a microservices architecture to handle the following scenario: I have a building. The building has some kinds of devices. And the devices can be used by the users. In the system, ...
0
votes
1answer
61 views

Authorization & Profiles considerations for ASP.NET MVC Customer Portal

there's an up and running self-serve customer portal built that I'm trying to make a bit better when it comes to displaying proper items for different client types and auto-logging users. Here are a ...
3
votes
1answer
432 views

REST API Authentication: Cookie vs Web Storage

Note: This question might sound like a duplicate, but all other similar questions did not take into account (mobile apps, iot's, web, 3rd party usage). Specifically, in dealing with the clients ...
0
votes
0answers
27 views

Authentication, bussiness logic and several entities in asp.net core

I'm working on an asp.net core application, using Identity as authentication/authorization management. Depending on the role the user can do "some thing", this is the normal way of authorization. But ...
2
votes
0answers
417 views

How to support anonymous user in web application?

I work for a publishing company that also provides content distribution to their users. In order to access a piece of content the user must be entitled to do so. Traditionally this authorization check ...
2
votes
0answers
32 views

OAuth2 - client_credentials

I am in the process of building out a private REST API. This API is intended for machine to machine communication. In short someone else's server will kick off a job via CRON that pulls information ...
4
votes
3answers
492 views

Authorization and Audit on models in MVC architecture

What are the best practices to extend Authorization to the Model layer if in a monolith MVC application (i.e rails) you have other entry-points than just the Controller? I.e background jobs, or the ...
1
vote
0answers
72 views

Is there any flaw in my API-to-API authentication concept I missed? [closed]

I've been thinking lately about how all of the authentication methods used in API to API communications (RESTful API's) are mostly methods that have been designed to be human oriented first (tokens\...