Questions tagged [authentication]

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

Filter by
Sorted by
Tagged with
0 votes
1 answer
18 views

Is using an Azure Function to forward a message to my App Service the best idea for handling a Twilio Web Hook?

I have an Azure App Service running a .NET (Core) API for an inhouse application, which I'm integrating with Twilio to handle Whatsapp communication. To handle the web hook responsible for receiving a ...
jarodsmk's user avatar
  • 141
2 votes
1 answer
48 views

Azure Managed Identity and Zero Trust

Azure Managed Identity provides a mean to only allow explicitly defined users/apps to access a given resource. For instance I can setup that no-one can access my database except the Managed Identities ...
Jakob Busk Sørensen's user avatar
1 vote
2 answers
206 views

How to best obfuscate a built-in key in an application?

We're building an application that needs to log into a website using built-in credentials. It's not optimal to say the least, but we're stuck with "knowing" the username and password ...
glades's user avatar
  • 351
0 votes
0 answers
37 views

Securely Handling Session Keys in Excel for API Authentication

I'm working on an Excel tool that needs to synchronize with a CRM via its API. The CRM's API authentication process involves logging in with a username and password, after which a session key is ...
Alon Cohen's user avatar
0 votes
0 answers
34 views

How to handle roles and scopes using oauth2 auth flow

I'm using python and fastapi with oauth2 flow (just for clarification as the question isn't language specific). I'm confused on how to implement scopes in an efficient and secure way. I was thinking ...
Gabriel Macus's user avatar
1 vote
0 answers
32 views

How to merge SQL Server database authentication with firebase authentication?

I have Firebase connected to my web app and users can authenticate using the 'microsoft' provider. The provider only allows authenticating with the active directory tenant that I specified in my ...
Clay Casper's user avatar
1 vote
1 answer
62 views

Persistant Browser Display Settings for Users

I have a question about what's the best approach to handle persistent data for web apps. I have a web app that is authenticating through an auth service. once authenticated it makes requests to the ...
BigL's user avatar
  • 13
2 votes
1 answer
137 views

web-dev: how to restrict access to costly backend API to authenticated clients only

I've created a small prototype browser plugin and am now thinking about making it accessible to the public. This brings up an important question about gatekeeping API access and the right way to ...
lhk's user avatar
  • 446
0 votes
0 answers
30 views

Per Request Authorization using Facebook Login

Stack: ASP.NET Core + Razor + SQLite TLDR: How do I rely solely on Facebook Login for authorization? I am building an app with sole integration to Facebook for my Facebook group. Essentially it is a &...
Zathura's user avatar
0 votes
0 answers
58 views

JWT Cookie and API Gateway

Background I have an authentication microservice that handles the user authentication and returns 2 JWT cookies (access_token and refresh_token). I want to incorporate an API gateway that does the JWS ...
Neil's user avatar
  • 9
-1 votes
1 answer
100 views

How are first-time users signup requests authenticated?

I have a web service. When a user makes a request, traefik first redirects it to my users micro service, to pass through an authentication function. The token (or username+password, on first request) ...
Juan Perez's user avatar
1 vote
0 answers
84 views

OpenID Connect and User Management Best Practices

Currently my company has 2 applications that use Identity Server for SSO. Not every client we have uses both applications but some do. The part I'm uneasy about is that both apps have a user ...
Brad Firesheets's user avatar
18 votes
9 answers
5k views

Authentication and authorisation for people with intellectual disabilities

Currently, I'm involved in a research project in which we are evaluating an existing web environment providing a safe online playground for children/adolescents with intellectual disabilities. Certain ...
KDW's user avatar
  • 349
5 votes
3 answers
943 views

Group set of commands as atomic transactions (C++)

We're designing the architecture of an embedded device (esp32). One of the tasks is that the device should connect to the internet and use a preprovisioned redeem code to register itself with our web ...
glades's user avatar
  • 351
0 votes
0 answers
179 views

Client or API Gateway to perform authentication on backend?

An system called X wants to consume APIs from the backend called Y. There's a definition from the Systems Architecture Team that states that every request from the X to Y must go through the corporate'...
Matheus's user avatar
  • 173
1 vote
1 answer
100 views

Is my security pattern correct for authenticating principal users to my microservices?

We are trying to implement an authorization and authentication service for our product. Now, we would have to cater to different kinds of IAM systems like SSO, LDAP and Basic Username+Password in ...
Anirban Das's user avatar
-1 votes
1 answer
57 views

What is the best way to authenticate a user over IVR?

I am trying to build an IVR system that requires some form of username & password/pin entry to access sensitive data. My naïve solution seemed obvious enough, until I realized that username/pass ...
Noob Saibot's user avatar
0 votes
1 answer
144 views

Using Azure AD as an identity provider in Keycloak-based applications: how can I add missing user data to my client applications?

I'm currently using Azure AD as my identity provider and Keycloak as my intermediary/broker for my client applications. However, I need some user attributes (such as phone, email, picture, and ...
linus's user avatar
  • 121
0 votes
1 answer
59 views

Including currect user/roles data within object state in .Net applications to control object behavior

I am building a .Net Core Blazor Server application. The application creates records of a Project class which move through a workflow with various phases of review and acceptance/rejection before ...
aterbo's user avatar
  • 111
0 votes
1 answer
50 views

How can a web application distinguish between sessions from trusted and non-trusted devices?

For compliance reasons, we want admins of a web app to work on it from devices (phones or computers) approved by IT. Or rather, they can work from other devices, but should get logged out quickly, so ...
Alexey Romanov's user avatar
0 votes
0 answers
134 views

How can I secure the backend in a meaningful way when users log in via OAuth2 in the frontend?

I'm thinking about a rewrite of a existing application. This legacy application does not separate frontend and backend. It's a single application with server side rendering. I want to rewrite it to a ...
samjaf's user avatar
  • 121
0 votes
0 answers
43 views

API authentication for iOS applications

I am currently working on my own iOS application and am going to be using a locally developed API for fetching data. I wanted to outline my current account sign-in architecture and verify this is ...
Trenton's user avatar
  • 17
0 votes
1 answer
612 views

Can I use a session cookie for API authentication?

I want to build a web application with a Single Page Application as the front end and an API as the back end. The front-end SPA will read and write data to the API. The SPA and the API will be hosted ...
Damien Monni's user avatar
0 votes
0 answers
83 views

WebApp: How and where to handle an expired authorization with 'back to login'

SituationI have a Single page web app with REST API. When the user logs in, they receive an authorization token. The token which will expire after some time. When the user tries to make a server ...
DarkTrick's user avatar
  • 207
0 votes
2 answers
73 views

OAuth Client Credentials Security Concern

I have a scenario I am considering, and I don't quite find out what's the best solution with OAuth. Hopefully I can learn good things here. We are company A and we specialize in managing secure text ...
diegosasw's user avatar
  • 377
1 vote
0 answers
709 views

Authorization using Azure AD B2C access tokens in Python / Flask

TLDR: I am trying to validate a Azure AD B2C access token in my Flask web API use scopes from that access token to authorize calling protected resources use timely and secure solutions such as PKCE ...
linus's user avatar
  • 121
0 votes
5 answers
315 views

Authentication for an app that only has one user

I'm going to write a blog app for myself, and though I've written authentication for multiple users. It seems heavy handed to use the same kind of architecture for one user. The only alternatives to ...
bonum_cete's user avatar
0 votes
1 answer
280 views

Any way to forward an auth session from OAuth system to another system (with API key)?

Description This is a long shot, but I'm in dire need of advice. If you know of a more appropriate forum for this type of question please share! I'm working with a legacy OAuth system using email + ...
cjhines's user avatar
3 votes
2 answers
1k views

Oauth 2.0 - MFA for REST APIs

We are looking at implementing Multi-factor authentication for our application, using Time-based one-time password (TOTP) algorithm. What we want to achieve: Users should have the option to enable ...
user1583803's user avatar
-1 votes
1 answer
153 views

iOS application token auth best practices

I am looking into building an iOS application and using an internally built API to access data. My API has some authentication endpoints that takes in a username and password and, if the login is ...
Trenton's user avatar
  • 17
0 votes
0 answers
155 views

What is the right way to update claims in identity-server 4 from Angular

I have a multitenant application where a user can belong to multiple tenants. I'm using Identity-Server 4 for the authentication. I have two applications Angular and API. When a user is not ...
Replay's user avatar
  • 109
0 votes
1 answer
155 views

Should an access token really be cryptographically signed?

In a web app I'm writing, a singed-in user is recognized by their cookie containing a session identifier. That session id has sixty-four bits of entropy, so I believe brute-force attacks are ...
Schmo's user avatar
  • 113
0 votes
0 answers
64 views

How to authenticate client and user

I could use some feedback on designing a solution for handling two OAuth flows in a single request. I have an API that currently supports OAuth2.0 (for users). It was requested that we should be able ...
Martin Nielsen's user avatar
-1 votes
1 answer
84 views

Auth flow between two services

We have two applications, each of them separated with its own backend and frontend. The first application is the user-facing one. They register on the site and as soon as they want to execute a ...
Matias's user avatar
  • 33
1 vote
2 answers
1k views

How to authenticate front end with backend in an anonymous user flow [closed]

I have an API that will be exposed on the internet publicly, the primary use of this API will be initially by a ReactJs front end but in the future we'd be looking to open this up to other clients ...
A. Murray's user avatar
  • 171
0 votes
0 answers
531 views

Best practice architecture to implement Spotify Auth for a Flutter frontend app and Node.js backend?

I am currently building an application that uses the Spotify API to work with a user's playlists. My frontend is a Flutter app, which is connected to the backend, that is built with Node.js. Currently ...
mic-ray's user avatar
1 vote
2 answers
341 views

Design of a passwordless signup and signin

I am currently planning to create an application. So far I have always been using the traditional username/password approach. But I would like to get rid of passwords for user authentication. This ...
Razmooo's user avatar
  • 143
0 votes
1 answer
1k views

How to share users between multiple web application?

Objective I have to create way to use the same users to connect to multiple application, and i am thinking about how to do it and how to share the data between the applications. Details Each ...
Gregory Boutte's user avatar
-1 votes
1 answer
564 views

Securing http communication between backend services [closed]

What is a good way to secure http communication between two backend services which are not hosted on the same network? One way might be to have a shared secret in both services but I feel like that is ...
mismaah's user avatar
  • 129
0 votes
1 answer
417 views

Understanding the JWT and refresh token approach

I've read a few articles which cover the set up for refresh tokens and JWT tokens Is there a best practice in how/when to get the next JWT token. In my head, there are a few different approaches. I ...
MyDaftQuestions's user avatar
0 votes
1 answer
106 views

How to model users in multiple workspaces

In Slack and other apps, a user's email can be tied to multiple workspaces. What’s the best approach to architecting that? Do you list workspace IDs on the user record, or do you maintain a list of ...
Nth.gol's user avatar
  • 125
-2 votes
1 answer
64 views

Should I wrap Azure AD B2C for authentication?

I want to implement an authentication system. The purpose of the system is to centralize account management and handle the complexity of account security. Internally, I don't want to implement the ...
someone's user avatar
-1 votes
2 answers
176 views

How to keep authentication in user context in reactive programming?

I want to execute everything in a user context. Meaning that if the request comes from one user then the service has a token of only this user and can't execute anything for another user. Now the ...
user980828's user avatar
1 vote
0 answers
121 views

What is the benefit of performing authn/authz at the API gateway instead of at the service?

I want to know is if we should perform authentication at the API gateway, at the individual service, or both. Let's frame this question and descussion in the context of new development. Specifically, ...
Mike G's user avatar
  • 239
2 votes
2 answers
282 views

Understanding passwordless sign up for mobile apps

How does phone number based authentication work, and what are its best practices? I've noticed there are apps with streamlined sign-up/log-in processes where only a phone number is required, simply ...
dev-brent's user avatar
0 votes
3 answers
647 views

What are the advantages of refresh token?

A good auth system contains access and refresh tokens. I know what access-tokens are for and I know what refresh tokens DO - but I don't understand their meaning. For example: If I authenticate myself ...
Bamba675's user avatar
1 vote
1 answer
192 views

Mobile authentication approaches, JWTs and refresh tokens

Context I'm developing togther with my dev team a mobile app in a client-server architecture, since there will be a webclient too, allowing some users (admins) to perform certain operations from the ...
Leonardo Viada's user avatar
6 votes
1 answer
731 views

Should user and service-to-service authentications be separate?

Say I have a system with 5 microservices behind a gateway, and a user signs in through an IDP (OAuth) A user U passes the access token in a request, and the call first reaches the gateway before it ...
Jerald Baker's user avatar
0 votes
1 answer
366 views

Can I store a refresh token in a queue?

We have a standard microservices setup (Identity Server, API Gateway, services, etc). Some of the services schedule events to be dispatched in the future (future = anything from mins to months ahead) -...
Keir's user avatar
  • 133
0 votes
0 answers
38 views

Synchronising OIDC Provider and User Table

I asked this question on SO which is related to this. In this question, I propose exchanging a token from my OIDC provider for a token in my own custom OIDC provider, which becomes the ultimate token ...
Tobi Akinyemi's user avatar

1
2 3 4 5
9