Questions tagged [authentication]

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

Filter by
Sorted by
Tagged with
-3
votes
0answers
55 views

How can I design my Spring program so that when a user logs in I can tell if they are a Staff member, student or faculty member?

A little more detail. Like I said I'm building this University Management System and it will have user authentication. It will also user authorization for some parts of the web layer, for example only ...
0
votes
1answer
35 views

API / System Design [Flexible Authentication / Authorization]?

Background: We're a smaller shop that puts out a number of products that require authentication and authorization. We're currently using a 3rd party service to "spin up new auth APIs" for ...
0
votes
1answer
60 views

How to handle authentication & authorization inside microservices

Example Application I will try to explain my problem by using a familiar application. Lets'say I'm building a Discord / Slack / Microsoft Teams clone; and for simplicity’s sake, it will contain 2 ...
0
votes
0answers
14 views

Reactjs + nodejs external authentication flow

I am developing a RESTful application with nodejs in the backend with express.js as middleware. I am also developing a client in Reactjs. I want to use an external authentication service (LDAP/AD/ADFS)...
1
vote
1answer
61 views

HTTP(S) API authentication: why not many services require signing (HMAC)?

I am currently researching existing authentication/authorization solution that are used for REST APIs. More specifically I'm interested in backend-to-backend interactions but client-to-backend is ...
1
vote
0answers
35 views

Best Way To Store Password & JWT on Mobile

I have a Flutter and Angular application that previously used Firebase, but for various reasons I'm working on switching it over to my own RESTful API with ExpressJS. One topic I'm a little confused ...
0
votes
1answer
57 views

Moving authentication outside the domain layer

In discussion about an architecture decision that we do consider wrong and how exactly to address it, some lack of understanding on the matter arose. In dealing with authentication and authorization, ...
1
vote
2answers
65 views

Authenticating requests from third party users to our APIs

We have a web app which has certain APIs. Users of our webapp will use these APIs when they login to our webapp (like how many records me as a user do I own, user specific, etc). We are creating ...
0
votes
3answers
116 views

What is a recommended authentication architecture for a front GUI app that I want to control but that will be used by others to control their servers?

I have a front end (WEB GUI) app that I designed (Python for now + JavaScript in the future) that I use to access a controller, it uses REST APIs. I want to publish this app in the cloud so that ...
1
vote
0answers
18 views

Design REST API for Mobile Apps with Unregister Users

I'd like to know some best practices on how to build rest API for a backend which shall communicate with a mobile app by anonymous users. This is the scenario with details: I'm building a demo library ...
1
vote
0answers
37 views

How does Google Analytics prevent tampering?

I'm building a simplified web tracker as a side project. One of the things I'm unsure about these cloud-based trackers (like Google Analytics) is how they prevent abuse of their platform; in other ...
-3
votes
1answer
39 views

Do I need MongoDB (or another type of database) to authenticate with Google?

I'm creating a web application using Node.js and Pug, and have recently been looking at adding external OAuth authentication to this site, using Express and Passport.js. I've found a lot of examples ...
1
vote
2answers
64 views

Recommended strategy for maintaining a session when navigating from app to browser?

We have an SSO application that provides authentication for a native mobile application, as well as for a web application. There are some features that the web application has that the mobile ...
0
votes
0answers
24 views

Can IdentityServer or an alternative be used to bring together multiple authentication sources?

We're quite lucky in being able to rearchitect an existing system so that we can learn from existing practices. One of the issues that we want to address first is setting up a flexible, but rational, ...
1
vote
0answers
15 views

Defining custom OIDC provider with delegating authentication to another OIDC provider and using own authorization database

I wanted to ask about your ideas on how to solve the problem that I have to solve in my application (App1). This is the classic Fronted + Backend (Angular + Java EE) application to which I am ...
0
votes
1answer
53 views

Best way to store Session token on mobile App

Backgroud Building a mobile App for product X which is currently hosted as a SaaS solution. The product X does not support OAuth currently, implements basic authentication and generates Session token ...
0
votes
0answers
13 views

Third Party Token Grants via Firestore

PSA: I am new to Authentication/security. I'm building a web app which allows client side get requests to the Spotify Api. From my understanding, I have a public and private key used to access the ...
2
votes
0answers
36 views

Biometric authentication with back-end verification service process

I am working on an application where I will be using Android and iOS biometric authentication. Coding the use of biometrics on the devices, including prompting and determining whether or not the user ...
-4
votes
1answer
31 views

How would I authenticating a Software Plugin with Username/Password using REST?

I'm developing my first Python plugin for a 3D application. What I'm looking to do I would like users who've purchased a subscription to the plugin from my Wordpress/WooCommerce web site to log in ...
3
votes
3answers
138 views

How does authentication work for offline software?

I am wondering how software with premium modes, such as Spotify, can operate offline. If a user is not connected to the internet, then they cannot authenticate via a remote server, which has e.g. a ...
0
votes
0answers
24 views

Broker Temporary Credentials for IoT Usage

I've several devices that need to send and receive data from a message broker, in my case RabbitMQ but is not so relevant for the discussion, and I need -as you can imagine- to provide connectivity in ...
1
vote
0answers
53 views

Using Azure AD MSAL as only authentication solution for SPA

I have an Angular SPA and I spun up my own basic form-based authentication using a .net core web API and SQL server to store user accounts / hashed and salted credentials. This is obviously not an ...
0
votes
0answers
12 views

Programmatic Application login into Jhipster Application

Let's say you have created a monolithic jhipster application with JWT authentication and where typically the login is by a user registering themselves and activating through email: Let's say that ...
2
votes
1answer
67 views

Delegating authorization across multiple API's

I'm building a multi-tenant system that consists of one (SPA) client, calling multiple API's, all under my control. User authentication is done with OpenID Connect, I'm sending an ID and access token ...
0
votes
0answers
27 views

Proper way to use oauth with external auth server and an api

I have an api server that relies on an auth server (both owned by the same company). Once the client gets a grant from the auth server, it is no longer needed, because the only information I need from ...
1
vote
0answers
22 views

Handling 3rd party OAuth2 tokens

After some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd ...
0
votes
0answers
33 views

Certificate Management in Multiple Microservice Spring Boot Servers

Let's assume we have multiple microservice Spring Boot (2.x) applications (Spring MVC with Maven build management) where they are accessed by clients. All of the microservices expose REST APIs, and ...
2
votes
1answer
108 views

Good/clean practice for building the auth part of an application

I'm starting on a greenfield project and haven't done or architected the sign-up/sign-in and auth part of the backend in a very long time, so my knowledge on the nowadays' good practices is very ...
2
votes
1answer
150 views

Why is it fine to use a user's ID in their JWT, as opposed to their email/username?

I'm wondering whether it is bad practice to keep a user's ID in a JWT. I'm planning on using the email in the sub, since it's already available to them, and I can use it to identify them, all the ...
2
votes
1answer
113 views

Chaining openID token

I'm working in microservices environment, where each service authenticates using OpenID Connect to an authentication service (local IdP), based on Users I keep locally on my Database. Now, I want ...
0
votes
1answer
576 views

Offline-Login Procedure in PWA

I have kind of a unique usecase: Phones that are used to connect to the app might be shared Connections are very unstable (sometimes no connection for half a day) Data should be accessible through ...
1
vote
1answer
54 views

Using Django Sessions when views are accessed by API

I'm making an app which is a Django backend and a React frontend (being developed by someone else). The plan currently is to fully decouple the two and have them communicate over API. However, I would ...
2
votes
3answers
136 views

Securing API for third party use

We have a set of microservices and would like to expose endpoints from a subset of these for third parties to use. To this end, we will build an API Gateway that acts as the access control mechanism ...
0
votes
2answers
132 views

Is it ok to use .Replace(“ ”, “+”) when reading hashes in a querystring?

I am letting users change their password after a reset, by following a link containing hashes of the password and user name (e-mail address). The link can look like this: www.example.domain/login?...
0
votes
0answers
52 views

Which authentication should be used for external users (not registered with the system)

I'm working with a project that uses ASP.NET Core 2.2. The main solution contains different projects, including APIs for a mobile application, APIs to integrate the system with third parties, a web ...
21
votes
9answers
8k views

Is this scenario an exception to the rule of never storing passwords in plaintext?

I am making a full-stack web application for a professor. At his request, the passwords and usernames are generated programmatically, and they cannot be changed or reset by the students. (If you ...
3
votes
1answer
39 views

Securing a voice assistant skill/app - any established patterns?

When creating new skills/apps for a voice assistant such as Google Home or Amazon Echo, are there any established patterns for providing an extra level of security for certain actions that go beyond ...
0
votes
1answer
202 views

Authentication and Signup with Microservices

I am looking for the best practice to do authentication (login) and signup using microservices, given that microservices are not supposed to share the same data. At the moment I am thinking: Two ...
0
votes
0answers
52 views

oauth2 + angular - Most elegant way to pass the JWT auth token

I have an angular application, which is querying an API as a client (written on Spring Boot 2.2.1 + Spring 5.2.1) that supports 3rd party authentication over OAuth2. The API has altogether 3 different ...
2
votes
0answers
25 views

How authorize web application and manage sessions

i am building a single page react app that uses redux as state manager and an express node js as backend server but i don't know what is the best way to authorize my users in the application! if it ...
1
vote
1answer
108 views

Hashing from within the database or outside?

I am in the process of evolving architecture for an 'equity analysis system'. I will be using SQLServer as the database, but I am not going the .NET route and won't be using the built-in 'membership' ...
4
votes
1answer
93 views

Shared access tokens in a distributed system

I'm building a system that horizontally scales with many nodes. Any of these nodes could consume an API that's hosted on https://example.com/api. The authentication for this API is token based. My ...
2
votes
3answers
91 views

PHP : authentication with a temporary link

in my system users register with their email address and receive a temporary link to log in. hostname/login/OYkwIJt6be1V5kMg10G The token must be generated from the email adress of user and valid ...
0
votes
0answers
165 views

Granular application security in a multitenant application that utilizes a centralized identity server

We are currently rewriting many of our internal desktop applications and converting them over to white-labeled, multi-tenant web applications. As part of the transition, we've setup a centralized ...
2
votes
2answers
128 views

How to combine session-based authentication and stateless REST API

What is the proper way of combining session-based authentication with stateless, token-based authentication for a REST API? Use case: User logs-in in the standard, traditional, session-based way. ...
0
votes
1answer
84 views

Why should an authentication server and a gateway be two distinct components?

Why should I decouple an authentication server from a gateway in a micro services architecture ? A clear drawback is the additional network load needed to query the auth server in each request. ...
2
votes
1answer
60 views

Role based authentication/authorization security

I have my backend endpoint for registering and logging in the users delivered trough RestApi or GraphQL to be more specific. I want to implement role based system for my users. The admins and ...
-5
votes
1answer
132 views

Upload fingerprint from android/ios to cloud

I am working on a project to use fingerprint to authenticate the user. I don't want the authentication to be device specific. Hence want to upload the user fingerprint to cloud. I do understand that ...
1
vote
0answers
56 views

Grant type/flow to use for multitenant application

Let's image we have a multitenant(organization) application having a separate database per tenant(organization). The core of the application is a REST api service protected by an authorization ...
0
votes
0answers
17 views

Using both jwt tokens & api lifetime tokes in Laravel app

Previously I had some experience using JWT tokens when making SPA. The workflow is: User enters email & password, gets JWT token, the token is stored in local storage and is passed in each ...

1
2 3 4 5
7