Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [authentication]

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

Filter by
Sorted by
Tagged with
0 votes
0 answers
13 views

What is the right way to update claims in identity-server 4 from Angular

I have a multitenant application where a user can belong to multiple tenants. I'm using Identity-Server 4 for the authentication. I have two applications Angular and API. When a user is not ...
user avatar
  • 109
0 votes
0 answers
21 views

Preferred way to handle authentication in a microservice architecture

I have a dummy application that serves tickets separated in two apps and a database. One app is the backend app, it knows only JSON and serves a port in a specific container locally. It handles ...
user avatar
  • 2,011
0 votes
1 answer
84 views

Should an access token really be cryptographically signed?

In a web app I'm writing, a singed-in user is recognized by their cookie containing a session identifier. That session id has sixty-four bits of entropy, so I believe brute-force attacks are ...
user avatar
  • 13
0 votes
0 answers
46 views

How to authenticate client and user

I could use some feedback on designing a solution for handling two OAuth flows in a single request. I have an API that currently supports OAuth2.0 (for users). It was requested that we should be able ...
user avatar
0 votes
0 answers
13 views

Whats the common "flow" for authentication using ADFS and OpenId Connect when building an API?

Im trying to "grasp" how a user should authenticate to our API. Our API is setup to use OpenID Connect thats issued by an ADFS-server. However.. as a "consumer" of our application, ...
user avatar
  • 193
-1 votes
1 answer
56 views

Auth flow between two services

We have two applications, each of them separated with its own backend and frontend. The first application is the user-facing one. They register on the site and as soon as they want to execute a ...
user avatar
  • 11
0 votes
2 answers
79 views

How to authenticate front end with backend in an anonymous user flow [closed]

I have an API that will be exposed on the internet publicly, the primary use of this API will be initially by a ReactJs front end but in the future we'd be looking to open this up to other clients ...
user avatar
  • 161
0 votes
0 answers
88 views

Best practice architecture to implement Spotify Auth for a Flutter frontend app and Node.js backend?

I am currently building an application that uses the Spotify API to work with a user's playlists. My frontend is a Flutter app, which is connected to the backend, that is built with Node.js. Currently ...
user avatar
0 votes
0 answers
32 views

How do I use OAuth2 for user management and authentication in my application?

I'm building an application where I want to be able to create and authenticate users using Discord and OAuth2. The reasons are: The application can be considered a "companion" app to a ...
user avatar
  • 101
1 vote
2 answers
139 views

Design of a passwordless signup and signin

I am currently planning to create an application. So far I have always been using the traditional username/password approach. But I would like to get rid of passwords for user authentication. This ...
user avatar
  • 143
0 votes
0 answers
21 views

Multitenet architecture with AWS cognito

I want to build a multi-tenant application with AWS Cognito. One user can belong to many tenants and they can have different roles in each tenant. Each tenant will have resources like S3 buckets and ...
user avatar
  • 101
0 votes
1 answer
277 views

How to share users between multiple web application?

Objective I have to create way to use the same users to connect to multiple application, and i am thinking about how to do it and how to share the data between the applications. Details Each ...
user avatar
0 votes
0 answers
26 views

Securing an API in production with Spring Security

At work I have to develop an API that queries data from a Hbase Cluster. They asked me to implement basic authentication in order to secure this API. The use case is very simple. For the moment we ...
user avatar
-2 votes
1 answer
139 views

Securing http communication between backend services [closed]

What is a good way to secure http communication between two backend services which are not hosted on the same network? One way might be to have a shared secret in both services but I feel like that is ...
user avatar
  • 19
0 votes
1 answer
70 views

Understanding the JWT and refresh token approach

I've read a few articles which cover the set up for refresh tokens and JWT tokens Is there a best practice in how/when to get the next JWT token. In my head, there are a few different approaches. I ...
user avatar
0 votes
1 answer
49 views

How to model users in multiple workspaces

In Slack and other apps, a user's email can be tied to multiple workspaces. What’s the best approach to architecting that? Do you list workspace IDs on the user record, or do you maintain a list of ...
user avatar
  • 125
-2 votes
1 answer
42 views

Should I wrap Azure AD B2C for authentication?

I want to implement an authentication system. The purpose of the system is to centralize account management and handle the complexity of account security. Internally, I don't want to implement the ...
user avatar
0 votes
2 answers
77 views

How to keep authentication in user context in reactive programming?

I want to execute everything in a user context. Meaning that if the request comes from one user then the service has a token of only this user and can't execute anything for another user. Now the ...
user avatar
1 vote
0 answers
57 views

What is the benefit of performing authn/authz at the API gateway instead of at the service?

I want to know is if we should perform authentication at the API gateway, at the individual service, or both. Let's frame this question and descussion in the context of new development. Specifically, ...
user avatar
  • 229
0 votes
0 answers
14 views

Consume Identity enabled WebApi in an MVC Project

I have an MVC project with no authentication. The project uses webapi as a backend to retreive and send information through the controllers. Now we need to add authentication to the webapi project as ...
user avatar
2 votes
2 answers
243 views

Understanding passwordless sign up for mobile apps

How does phone number based authentication work, and what are its best practices? I've noticed there are apps with streamlined sign-up/log-in processes where only a phone number is required, simply ...
user avatar
0 votes
3 answers
201 views

What are the advantages of refresh token?

A good auth system contains access and refresh tokens. I know what access-tokens are for and I know what refresh tokens DO - but I don't understand their meaning. For example: If I authenticate myself ...
user avatar
1 vote
1 answer
96 views

Mobile authentication approaches, JWTs and refresh tokens

Context I'm developing togther with my dev team a mobile app in a client-server architecture, since there will be a webclient too, allowing some users (admins) to perform certain operations from the ...
user avatar
0 votes
0 answers
44 views

Architecture with a login

I am on my first big solo task and I am required to create an application that allows companies to work with permits, fill them out, get them signed etc. This web-app is with invite only i.e. it is ...
user avatar
  • 101
3 votes
1 answer
151 views

Should user and service-to-service authentications be separate?

Say I have a system with 5 microservices behind a gateway, and a user signs in through an IDP (OAuth) A user U passes the access token in a request, and the call first reaches the gateway before it ...
user avatar
0 votes
0 answers
30 views

Looking for suggestions while implementing JWT token with encryption for webhooks

I need to start providing webhook support for some of my apps, and I was looking at how github seems to implement it on their website and they include a "secret" that one can include in ...
user avatar
  • 287
0 votes
1 answer
187 views

Can I store a refresh token in a queue?

We have a standard microservices setup (Identity Server, API Gateway, services, etc). Some of the services schedule events to be dispatched in the future (future = anything from mins to months ahead) -...
user avatar
  • 133
0 votes
0 answers
23 views

Implementing Federated authentication/SSO

We are building a SASS application that is making use of an existing application agnostic set of APIs that provide authentication functionality (among other things). This set of APIs provide OAuth ...
user avatar
  • 101
0 votes
0 answers
30 views

Synchronising OIDC Provider and User Table

I asked this question on SO which is related to this. In this question, I propose exchanging a token from my OIDC provider for a token in my own custom OIDC provider, which becomes the ultimate token ...
user avatar
1 vote
1 answer
744 views

Authentication with JWT in HTTP only cookie without refresh token

The motto of the upcoming question is "I don't know what I don't know". I would like to know if there are downsides or security risks with an authentication implementation. Right now, I'm ...
user avatar
0 votes
0 answers
29 views

Autherization flow - one party accessing another party as third party - is this a correct way to do so?

I've been suggested an authorization flow between three parties that seems not secure to me, and I would like to know if I'm assuming correctly. Let's say Party A has many customers (one of them let's ...
user avatar
0 votes
2 answers
68 views

What's the right way to handle authentication of users across 2 web applications

There are 2 independently functioning web applications. Web-app1: (Flutter+Django+Postgres). Web-app2: (Angular+Spring+Postgres). Each of the web-apps has its own user database and are functioning ...
user avatar
  • 3
-3 votes
1 answer
43 views

Serving content to authenticated users

I'm wanting to store lots of data in cloud storage - like S3. I want some data to only be accessed by authorised users, one way I could do this is to authenticate the user on my service, download the ...
user avatar
0 votes
1 answer
127 views

Enriching JWT after OpenID Connect flow

I am struggling to find a good solution for authorization of users after they were properly authenticated through an oidc flow. Let's assume the following setup: An angular SPA is interacting with ...
user avatar
0 votes
1 answer
109 views

Why do users and programs have different client authentication mechanisms?

Typically in any application, the way a user (human) is authenticated is using a username/id and a password, whereas programmatic or api based access is authenticated using API keys (based on system ...
user avatar
  • 145
-2 votes
1 answer
78 views

authentication flows for secured applications

There are many secured applications developed in node.js. However, I could not find any framework (like Spring-security in Java) that can be used to save the trouble of managing the authentication (...
user avatar
  • 203
2 votes
4 answers
498 views

How to compare passwords which is stored in DB in encrypted form in secure way?

Recently In an interview I was asked this question - Question- If are storing passwords in encrypted format in DB and in future when user login into our website how will we perform authentication? Me:...
user avatar
  • 147
1 vote
1 answer
308 views

Implementing SSO on a REST API

I have a REST API server with its own authentication methods. I need to provide to some third party apps an authentication solution which should be processed on my server, I don't want them to handle ...
user avatar
1 vote
1 answer
91 views

How to randomly allocate a set of IDs digitally, one ID per person, such that everyone knows that the particular allocations are kept private?

I have a set of UUIDs that I want to assign to a set of people. I want to deliver these UUIDs to people in a secure manner, such that everyone knows that I do not know which UUID corresponds to which ...
user avatar
2 votes
1 answer
814 views

Refresh tokens by example using Angular and Spring Boot

I am designing out an app that would have an Angular frontend and Spring Boot (Java) backend. I was considering (but not married to) the prospect of JWT-based authentication: User logs in with ...
user avatar
1 vote
3 answers
494 views

Offline user authentication

One of our customers had a pen test performed on our application this week and let's just say it didn't go well. The main issue they have is that user authentication takes place on the client, rather ...
user avatar
2 votes
2 answers
122 views

Authenticate users (REST-API)

What I'm trying to build REST-API using Express and SQLite 5 to 10 authors should be able to post articles to /articles except them, no one is allowed to post anything My approach to build it ...
user avatar
  • 129
-1 votes
1 answer
146 views

Can I call a WCF endpoint from ASP.Net Web API?

I have a web api with controller methods that use rest http(post/get calls). Clients consume this API with normal httpclient calls and I pass an http response back. My use case is I have a legacy ...
user avatar
0 votes
0 answers
123 views

Providing guest users with full accounts vs only sessions (a.k.a. guest checkout)

I'm working on a web application with JWT authentication (with token stored in cookie) and an SQL database. Upon loading, the frontend makes a request to the backend to determine whether the user is ...
user avatar
  • 101
0 votes
0 answers
72 views

How to authenticate an API in a headless web-app?

For learning purposes, I'm trying to build an Expense Tracker web-app from scratch. I'm in the process of designing it before coding it. I decided to attempt to make it a Headless Web-app: The main ...
user avatar
-2 votes
1 answer
58 views

Authentication solution for custom PHP-based API

Here is description of my app I'm working on. On the client-side (index.html) a user can interact with a data. When he needs to call a server operation for example reading or writing a file on the ...
user avatar
  • 97
5 votes
0 answers
122 views

Is it possible to use a reverse proxy authentication in a native mobile app

We have a few backend services that our frontend SPAs fetch data from. Right now, the SPAs use JS libraries to authenticate with the Auth server (Azure AD) which returns a JWT which is validated by my ...
user avatar
4 votes
0 answers
141 views

Is it possible to use an SPA as the UI for an OAuth 2.0 authorization server?

Using SPAs as the UI in front of an API has become standard practice, with OAuth 2.0 / OIDC being the common authz mechanism for this. This approach generally entails the SPA receiving its access via ...
user avatar
  • 1,215
1 vote
1 answer
58 views

Authentication-as-a-Service (Auth0) and retrieving user profiles for many different users

For my recent project I decided to leverage Authentication-as-a-Service, in particular I am using Auth0 but I do not think this particularly matters. I've got my React client set up correctly and I am ...
user avatar
2 votes
1 answer
253 views

API AuthN/AuthZ and API Gateway

I have implemented authentication on an API Gateway level using NGINX+ and now I have concern if APIs behind it should still to authenticate using API Keys or JWT? What are best practices? My point is ...
user avatar

1
2 3 4 5
8