Questions tagged [authentication]
Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.
409
questions
0
votes
0
answers
24
views
Client or API Gateway to perform authentication on backend?
An system called X wants to consume APIs from the backend called Y.
There's a definition from the Systems Architecture Team that states that every request from the X to Y must go through the corporate'...
- 173
1
vote
1
answer
96
views
Is my security pattern correct for authenticating principal users to my microservices?
We are trying to implement an authorization and authentication service for our product.
Now, we would have to cater to different kinds of IAM systems like SSO, LDAP and Basic Username+Password in ...
- 19
-1
votes
1
answer
37
views
What is the best way to authenticate a user over IVR?
I am trying to build an IVR system that requires some form of username & password/pin entry to access sensitive data. My naïve solution seemed obvious enough, until I realized that username/pass ...
- 437
0
votes
1
answer
56
views
Using Azure AD as an identity provider in Keycloak-based applications: how can I add missing user data to my client applications?
I'm currently using Azure AD as my identity provider and Keycloak as my intermediary/broker for my client applications. However, I need some user attributes (such as phone, email, picture, and ...
- 121
0
votes
1
answer
48
views
Including currect user/roles data within object state in .Net applications to control object behavior
I am building a .Net Core Blazor Server application. The application creates records of a Project class which move through a workflow with various phases of review and acceptance/rejection before ...
- 111
0
votes
1
answer
40
views
How can a web application distinguish between sessions from trusted and non-trusted devices?
For compliance reasons, we want admins of a web app to work on it from devices (phones or computers) approved by IT. Or rather, they can work from other devices, but should get logged out quickly, so ...
- 1,467
0
votes
0
answers
41
views
How can I secure the backend in a meaningful way when users log in via OAuth2 in the frontend?
I'm thinking about a rewrite of a existing application. This legacy application does not separate frontend and backend. It's a single application with server side rendering.
I want to rewrite it to a ...
- 121
0
votes
0
answers
25
views
API authentication for iOS applications
I am currently working on my own iOS application and am going to be using a locally developed API for fetching data. I wanted to outline my current account sign-in architecture and verify this is ...
- 17
0
votes
1
answer
175
views
Can I use a session cookie for API authentication?
I want to build a web application with a Single Page Application as the front end and an API as the back end. The front-end SPA will read and write data to the API.
The SPA and the API will be hosted ...
- 101
0
votes
0
answers
46
views
WebApp: How and where to handle an expired authorization with 'back to login'
SituationI have a Single page web app with REST API. When the user logs in, they receive an authorization token. The token which will expire after some time.
When the user tries to make a server ...
- 215
0
votes
2
answers
66
views
OAuth Client Credentials Security Concern
I have a scenario I am considering, and I don't quite find out what's the best solution with OAuth. Hopefully I can learn good things here.
We are company A and we specialize in managing secure text ...
- 359
1
vote
0
answers
330
views
Authorization using Azure AD B2C access tokens in Python / Flask
TLDR:
I am trying to
validate a Azure AD B2C access token in my Flask web API
use scopes from that access token to authorize calling protected resources
use timely and secure solutions such as PKCE ...
- 121
0
votes
5
answers
168
views
Authentication for an app that only has one user
I'm going to write a blog app for myself, and though I've written authentication for multiple users. It seems heavy handed to use the same kind of architecture for one user.
The only alternatives to ...
- 111
0
votes
0
answers
39
views
Auth0 Middleware Layer Abstraction
I am currently spearheading a project to rearchitect our authentication, and we've signed on with Auth0 as a vendor that will manage the authentication component (for the time being - authorization ...
- 101
0
votes
1
answer
144
views
Any way to forward an auth session from OAuth system to another system (with API key)?
Description
This is a long shot, but I'm in dire need of advice. If you know of a more appropriate forum for this type of question please share!
I'm working with a legacy OAuth system using email + ...
- 1
0
votes
0
answers
46
views
microservice separate data server auth server an website
I have an API server related to users and employees data with database.
There is another API server for users authentication.
The last one is website client UI with social providers to authenticate ...
3
votes
2
answers
414
views
Oauth 2.0 - MFA for REST APIs
We are looking at implementing Multi-factor authentication for our application, using Time-based one-time password (TOTP) algorithm.
What we want to achieve:
Users should have the option to enable ...
- 133
-1
votes
1
answer
66
views
iOS application token auth best practices
I am looking into building an iOS application and using an internally built API to access data. My API has some authentication endpoints that takes in a username and password and, if the login is ...
- 17
0
votes
0
answers
78
views
What is the right way to update claims in identity-server 4 from Angular
I have a multitenant application where a user can belong to multiple tenants. I'm using Identity-Server 4 for the authentication.
I have two applications Angular and API. When a user is not ...
- 109
0
votes
0
answers
69
views
Preferred way to handle authentication in a microservice architecture
I have a dummy application that serves tickets separated in two apps and a database.
One app is the backend app, it knows only JSON and serves a port in a specific container locally. It handles ...
- 2,056
0
votes
1
answer
116
views
Should an access token really be cryptographically signed?
In a web app I'm writing, a singed-in user is recognized by their cookie containing a session identifier. That session id has sixty-four bits of entropy, so I believe brute-force attacks are ...
- 113
0
votes
0
answers
55
views
How to authenticate client and user
I could use some feedback on designing a solution for handling two OAuth flows in a single request.
I have an API that currently supports OAuth2.0 (for users).
It was requested that we should be able ...
-1
votes
1
answer
72
views
Auth flow between two services
We have two applications, each of them separated with its own backend and frontend.
The first application is the user-facing one. They register on the site and as soon as they want to execute a ...
- 21
1
vote
2
answers
629
views
How to authenticate front end with backend in an anonymous user flow [closed]
I have an API that will be exposed on the internet publicly, the primary use of this API will be initially by a ReactJs front end but in the future we'd be looking to open this up to other clients ...
- 171
0
votes
0
answers
379
views
Best practice architecture to implement Spotify Auth for a Flutter frontend app and Node.js backend?
I am currently building an application that uses the Spotify API to work with a user's playlists. My frontend is a Flutter app, which is connected to the backend, that is built with Node.js. Currently ...
- 9
1
vote
2
answers
234
views
Design of a passwordless signup and signin
I am currently planning to create an application. So far I have always been using the traditional username/password approach. But I would like to get rid of passwords for user authentication. This ...
- 143
0
votes
1
answer
961
views
How to share users between multiple web application?
Objective
I have to create way to use the same users to connect to multiple application, and i am thinking about how to do it and how to share the data between the applications.
Details
Each ...
- 121
-1
votes
1
answer
411
views
Securing http communication between backend services [closed]
What is a good way to secure http communication between two backend services which are not hosted on the same network?
One way might be to have a shared secret in both services but I feel like that is ...
- 129
0
votes
1
answer
244
views
Understanding the JWT and refresh token approach
I've read a few articles which cover the set up for refresh tokens and JWT tokens
Is there a best practice in how/when to get the next JWT token.
In my head, there are a few different approaches. I ...
- 1,881
0
votes
1
answer
81
views
How to model users in multiple workspaces
In Slack and other apps, a user's email can be tied to multiple workspaces.
What’s the best approach to architecting that? Do you list workspace IDs on the user record, or do you maintain a list of ...
- 125
-2
votes
1
answer
54
views
Should I wrap Azure AD B2C for authentication?
I want to implement an authentication system. The purpose of the system is to centralize account management and handle the complexity of account security. Internally, I don't want to implement the ...
- 1
-1
votes
2
answers
143
views
How to keep authentication in user context in reactive programming?
I want to execute everything in a user context. Meaning that if the request comes from one user then the service has a token of only this user and can't execute anything for another user.
Now the ...
- 354
1
vote
0
answers
85
views
What is the benefit of performing authn/authz at the API gateway instead of at the service?
I want to know is if we should perform authentication at the API gateway, at the individual service, or both.
Let's frame this question and descussion in the context of new development. Specifically, ...
- 239
2
votes
2
answers
264
views
Understanding passwordless sign up for mobile apps
How does phone number based authentication work, and what are its best practices?
I've noticed there are apps with streamlined sign-up/log-in processes where only a phone number is required, simply ...
- 23
0
votes
3
answers
428
views
What are the advantages of refresh token?
A good auth system contains access and refresh tokens. I know what access-tokens are for and I know what refresh tokens DO - but I don't understand their meaning.
For example:
If I authenticate myself ...
- 31
1
vote
1
answer
129
views
Mobile authentication approaches, JWTs and refresh tokens
Context
I'm developing togther with my dev team a mobile app in a client-server architecture, since there will be a webclient too, allowing some users (admins) to perform certain operations from the ...
- 113
4
votes
1
answer
358
views
Should user and service-to-service authentications be separate?
Say I have a system with 5 microservices behind a gateway, and a user signs in through an IDP (OAuth)
A user U passes the access token in a request, and the call first reaches the gateway before it ...
- 151
0
votes
1
answer
290
views
Can I store a refresh token in a queue?
We have a standard microservices setup (Identity Server, API Gateway, services, etc).
Some of the services schedule events to be dispatched in the future (future = anything from mins to months ahead) -...
- 133
0
votes
0
answers
35
views
Synchronising OIDC Provider and User Table
I asked this question on SO which is related to this.
In this question, I propose exchanging a token from my OIDC provider for a token in my own custom OIDC provider, which becomes the ultimate token ...
- 675
2
votes
1
answer
1k
views
Authentication with JWT in HTTP only cookie without refresh token
The motto of the upcoming question is "I don't know what I don't know".
I would like to know if there are downsides or security risks with an authentication implementation.
Right now, I'm ...
- 133
0
votes
0
answers
32
views
Autherization flow - one party accessing another party as third party - is this a correct way to do so?
I've been suggested an authorization flow between three parties that seems not secure to me, and I would like to know if I'm assuming correctly.
Let's say Party A has many customers (one of them let's ...
- 107
0
votes
2
answers
72
views
What's the right way to handle authentication of users across 2 web applications
There are 2 independently functioning web applications. Web-app1: (Flutter+Django+Postgres). Web-app2: (Angular+Spring+Postgres). Each of the web-apps has its own user database and are functioning ...
- 3
-3
votes
1
answer
46
views
Serving content to authenticated users
I'm wanting to store lots of data in cloud storage - like S3.
I want some data to only be accessed by authorised users, one way I could do this is to authenticate the user on my service, download the ...
- 675
0
votes
1
answer
250
views
Enriching JWT after OpenID Connect flow
I am struggling to find a good solution for authorization of users after they were properly authenticated through an oidc flow. Let's assume the following setup:
An angular SPA is interacting with ...
- 153
0
votes
1
answer
110
views
Why do users and programs have different client authentication mechanisms?
Typically in any application, the way a user (human) is authenticated is using a username/id and a password, whereas programmatic or api based access is authenticated using API keys (based on system ...
- 293
-2
votes
1
answer
98
views
authentication flows for secured applications
There are many secured applications developed in node.js. However, I could not find any framework (like Spring-security in Java) that can be used to save the trouble of managing the authentication (...
- 203
2
votes
4
answers
1k
views
How to compare passwords which is stored in DB in encrypted form in secure way?
Recently In an interview I was asked this question -
Question- If are storing passwords in encrypted format in DB and in future when user login into our website how will we perform authentication?
Me:...
- 147
1
vote
1
answer
2k
views
Implementing SSO on a REST API
I have a REST API server with its own authentication methods. I need to provide to some third party apps an authentication solution which should be processed on my server, I don't want them to handle ...
2
votes
1
answer
102
views
How to randomly allocate a set of IDs digitally, one ID per person, such that everyone knows that the particular allocations are kept private?
I have a set of UUIDs that I want to assign to a set of people. I want to deliver these UUIDs to people in a secure manner, such that everyone knows that I do not know which UUID corresponds to which ...
- 31
2
votes
1
answer
1k
views
Refresh tokens by example using Angular and Spring Boot
I am designing out an app that would have an Angular frontend and Spring Boot (Java) backend.
I was considering (but not married to) the prospect of JWT-based authentication:
User logs in with ...
