Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authentication]

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

-2
votes
0answers
29 views

OAuth2 for 2 way communication between 1 Prod Server & 1000+ Client Servers

I am currently looking into re-architecture some of the APIs my organization is using. I'm currently trying to figure out the best approach for application communication. Some background: I have 1 ...
1
vote
0answers
42 views

How to solve circular dependency scenario while executing http calls which require authentication?

I am working on a project which requires me to execute standard HTTP calls with session tokens. I am building a custom HTTP client, with a custom authenticator, something like this: Client client = ...
0
votes
0answers
24 views

Microservice auth layer vs each service authorizing requests?

I approached our architect with a solution in which all of our microservices verify the auth of the user invoking the call. Basically, what I've been doing for years, on different projects. He ...
0
votes
0answers
11 views

First time connection with gRPC and mutual authentication

When making a gRPC connection, the client can optionally provide credentials so that they may also be authenticated. In the case of a new client, how can a set of keys and certificates be established?...
0
votes
1answer
82 views

API User identification

I'm designing an API, and I need to authenticate each request with a user. The simplest way to do that is to provide an API key to each user on their "My account" page, that they could regenerate at ...
0
votes
0answers
20 views

How to provide an extension point for library that should authenticate asynchronously using WebClient?

I'm trying to design a library (nuget package) that would read data from a REST API and deserialize it to DTO objects. The API requires authentication which is usually done with Microsoft's ADAL ...
0
votes
0answers
37 views

Authenticated ASP.NET Core MVC site consuming web API

I have an ASP.NET Core 2.2 MVC site, that uses Facebook as an identity provider. Users can click the login button, they are redirected to Facebook to enter their credentials, and are then redirected ...
1
vote
1answer
40 views

Multiple app authentication, universal user login, best practice

Please see the below diagram. There are two apps that each have a different set of functions, User A is a user of App1 and User B is a user of App2. They should not be able to log in directly to the ...
1
vote
0answers
38 views

Single Sign On implementation for CMS

This is a general question seeking guidance for the best practice(s) on implementing a Single Sign On (SSO) across many various installations of the same application. The hypothetical example I would ...
-5
votes
2answers
61 views

Authenticate Git Pulls on a Compromised Machine [closed]

I may have a tough one for you. I have a machine in the wild that is and will probably continue to be compromised. The machine is owned by a user who will be unable to keep it secure. I must have ...
0
votes
0answers
16 views

Keep sync Authentication Server user profile with App Server best practices

I have two servers first one is Authentication Server that handles refresh token, AccessToken and external login. On external login, I create user and store profile information like first name and ...
3
votes
2answers
83 views

So I am creating a user registration system with oauth login to four services. How do I handle username selection?

My registration system normally asks for 4 things: The user's full name, their email, their preferred username, and a password. I want to add four oauth2 registration services to make it easier and ...
0
votes
1answer
71 views

How to protect while loosely coupling a db server that is shared by 2 different services

Background information I have a database that will be used by two different web applications. Solution A (user driven web application) resides on the public internet and will write / update / delete ...
0
votes
2answers
116 views

When using Redux/Redux-Saga - should JWTs be set in the action creators/sagas?

Almost every blog post I've encountered around generic auth handling using JWTs in a React/Redux/Saga application does the same thing, which is to store the JWT in local storage, in the action/saga. ...
0
votes
1answer
54 views

How you can deal with making invalid a list of JWTs?

I design a new Rest API for a personal project and I am trying to implement the authentication and authorization mechanism as a separate project, so I ended up with a couple of problems which I am ...
1
vote
2answers
118 views

Security Issues with RESTful Authentication & Session Management

I'm trying to implement authentication and session management for a microservice. In order to do the process RESTfully, I understand that I'll need to use some kind of token-based authentication to ...
1
vote
0answers
15 views

Client synchronization of authentication tokens in parallel connections

In my app server's authentication implementation, an authentication token is generated for every user that has logged in. According to some highly recommended security tips (Implementing Secure User ...
1
vote
1answer
108 views

Onion Architecture, Project Architecting and Authentication

I am learning ASP.NET MVC & Web API and trying to implement Onion Architecture with Repository Pattern for one of my Test projects as part of my learning. I have developed single MVC Projects ...
1
vote
1answer
56 views

Help with definition of broad user types

I am trying to define the boundary between two broad types of users. The first are those who make use of corporate systems (accounting, ERP, CRM, etc.) and this also includes B2B users, for example ...
0
votes
2answers
75 views

Managing sign-on in mobile applications

I'm programming a mobile app which makes use of REST services. Some of the services are for logged users, so I have a login endpoint which lets me enter my credentials and get a JWT token for ...
5
votes
1answer
254 views

How can I obtain a CA certificate for my application if I do not own a business/company?

I have developed an application which I intend to sell. I set up a website with information and download links, advertising, payments, everything is ready to go - except the digital signature. I want ...
0
votes
2answers
356 views

Microservice authentication between services

Is there a way to ensure that serviceA is called only by serviceB(or a set of whitelisted services)? All the services are independent and do not go through a service gateway as they are completely ...
4
votes
0answers
237 views

Should an SPA use OIDC's Implicit flow or Auth Code flow?

We are developing a new Angular SPA which leverages Keycloak for its SSO abilities using OpenID Connect (OIDC). The app is currently designed to use the Implicit flow to retrieve short-lived access ...
-1
votes
1answer
53 views

How would you design the abstraction/class(es)/component(s) of a third-party service/api used in your application?

Lets say you were designing a Twitter client for people with people could see tweets and post tweets? How would you design the twitter api abstraction? Many of the api wrappers I've seen feature an ...
-2
votes
1answer
45 views

Should API also authenticate users from front end app?

I am building an API using Laravel and am looking at using Laravel/Passport for authentication - but I am struggling with a design decision. The API will be consumed by multiple other applications / ...
0
votes
1answer
60 views

Is changing the domain according to the user privilege on specific fields considered as anti-pattern?

Is changing the domain according to the user privilege on specific fields considered as anti-pattern? My case: I have Schedule Entity (aggregate root) like this: public class Schedule : Entity<...
-2
votes
1answer
95 views

How to migrate an existing ASP.NET MVC site to ASP.NET MVC Core - specifically on authorization

I am in the process of upgrading an existing website to ASP.NET Core 2.1. The goal is simplification and ease of maintenance. Existing site is using: EF and .NET 4.6.2 A [Users] table in SQL Server ...
0
votes
2answers
126 views

API Design - User Management

I work for an ecommerce site and we are looking to expose much of our core functionality via a set of APIs. We plan on re-writing some of our own public facing websites (e.g. the main shop website) to ...
1
vote
1answer
50 views

Should I separate the REST sessions from the sessions in the rest of the application?

Assuming I have resources I restrict access to with a username + password login in my web application and in my REST API. Should I keep different sessions for both meaning that a login via the web UI ...
1
vote
2answers
785 views

Stateful authentication in REST API using tokens

I have recently started on a project involving a REST API. The API requires authentication with requirements for administrators to be able to view logged in users and to be able to revoke specific ...
0
votes
1answer
50 views

LDAP with Dovecot

I have a mail server setup with Postfix and Dovecot, and an application server setup with node.js. I have user credentials stored in my application server, and I want to use the same credentials for ...
0
votes
1answer
61 views

What is Federated , Certified Authentication?

I was completing an infosec report and came across this. Does the APP support end-user authentication? Federated, Certified, other? I wanted to have some clarification on the terms. From what I ...
0
votes
1answer
229 views

How should I manage user session in CLI application?

I'm developing a CLI based application. It has a "login" command to perform authentication: $ myapp login $ Type username: hector $ Type password: ***** $ Login success! Internally, myapp login ...
5
votes
1answer
2k views

Should access permissions and roles be included in payload of JWT?

Should information about the permissions and roles of the client be included in JWT? Having such information in JWT token will be very helpful as everytime a valid token comes, it would be easier to ...
-1
votes
0answers
102 views

API Authentication with JWT by reference

We are in the process of rewriting our API and would like to have some advices. Requirements: Authentication will be done from various clients (mobile app, browser extension, single page app) ...
2
votes
1answer
85 views

Is it a good idea to reload the page every few failed login attempt?

I was reading about bruteforce login attack and one of the solution to prevent users from trying too many passwords in short amount of time is to add exponential delay for every failed login. But ...
0
votes
1answer
330 views

API design for multi-tenant web app - how to identify users from another system?

I have a multi-tenant web application that allows authenticated users to make changes to their application instance - making comments as an example. I'd like to build an API that allows a user of any ...
1
vote
2answers
314 views

token authentication security best practice

So I'm trying a few token based authentication in Laravel, each user have token they can use to access certain database. But there is something I still don't understand from these tutorial. The ...
4
votes
3answers
824 views

Token based vs session based authentication in back-end

I'm trying to build an application by creating an RESTful API(Koa.js) to communicate with clients(Web with React and Mobile with Ionic). But I'm facing issues when dealing with authentication. So my ...
0
votes
2answers
2k views

Ways to authenticate and redirect with decoupled front-end web application

I have a coupled web application (frontend and api backend served from the same application). It's worked well for our needs but I've been curious about the differences that would go into having a ...
0
votes
0answers
23 views

Should client initiate a session for a third party application server?

I want a third party JavaScript application which has its own back-end to be authenticated with my application server. The application is initiated using a JavaScript API where I can send my ...
0
votes
0answers
40 views

OAuth2 authorization and storing users to custom storage

My question is relating to securing API with Google OAuth2 authorization and multiple clients. But I also want to store users to my own storage so I can have additional info about them. So when the ...
1
vote
1answer
76 views

Showing confidential to a customer info without having him to create an account: GET or POST approach?

There's a website where a person should pay to get some service/product. After a person has made a reservation/product by paid for it, I want to allow him to track the progress without having to or ...
1
vote
1answer
145 views

Authorization and Domain Model

I have an enterprise system that is represented by a domain model, part of the requirement that the system should limit access to some of the features based on privileges of the logged in user. ...
-1
votes
1answer
165 views

How to delegate the refresh token renewal in a SOA

So, we've got SOA on the backend (BE) and on the frontend (FE) we've got micro-frontends (the separate micro-frontends are loaded as components into the frontend app when needed, so internal process ...
2
votes
1answer
504 views

Designing authentication and authorisation micro service

Background: There are three different applications A, B and C and they all share same user details but I had to implement authentication in each of them which was duplication of effort. After some ...
0
votes
0answers
30 views

Building multiple unrelated services website but one central user system so I don't have to recreate an authentication system

I have ideas for multiple applications that I would like to create over the next couple years. I do not want to have to make a new authentication system for each website/application. I do not want ...
0
votes
1answer
68 views

Login to application based on profile created on another application

I have a "difficult" problem that i am not sure how should i approach it. Basically i have a mobile app, that has a server side (in Go) and the appropriate base (PSSQL). User can register via the ...
-2
votes
1answer
111 views

Are user generated PW's a thing of the past for most apps?

I'm making a online game where I need to preserve some things for the players so each will have an account. However, I don't want to get into the business of storing user created passwords since that'...
6
votes
1answer
2k views

Microservice Architecture - using Auth Server as a User Resource server

I'm designing an application based on microservices architecture, In this application I will need Auth microservice, Also I will need to store some extra User information such as, perhaps, multiple ...