Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authentication]

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

-2
votes
1answer
34 views

Authentication Mechanism for Third Part Apps

I have an WebAPI application which is consumed in our native apps. The implemented auth grant type is 'password'. It is working fine. Currently we are creating a native library instead of native apps ...
-4
votes
1answer
96 views

Is it bad to leave Azure secrets keys as plaintext in my source code if I don't release the code, only the exe? [on hold]

Specifically worried that someone might be able to extract the API key in a way I am unaware of and make calls to my own Cognitive Services subscription outside of the context of my program.
0
votes
0answers
20 views

How to display linked third party sign in methods

I am writing an app. Like Google suggests, the user should be to be able to link multiple sign in methods to their account. In order to do that, the ideas of "identities" and "accounts" are separated ...
0
votes
2answers
101 views

Is creating a leaderboard web API that can't be fudged possible?

Let's say you have a game, and players of your game can get scores. You also want to be able to post these scores to a server using calls to a web API. Obviously, you want to be able to tell who sent ...
1
vote
0answers
31 views

How to authenticate third-party callbacks that don't support authentication

I'm working on a project that integrates with a third-party service via API, and the third-party uses callbacks to update us on the status of the operations being performed. These callbacks can be hit ...
0
votes
2answers
51 views

Handling refresh token revocation

I've been implementing an authentication flow for an app that I've been making that uses JWTs. When a user is initially logged in or when they register (which immediately logs them in), I provide an ...
0
votes
1answer
59 views

Is a refresh token an entity or value object?

I have a User entity, which may have a RefreshToken (for authentication). Notes: A refresh token doesn't have "identity", but is related to a single user - it is only valid for that user. In the db ...
0
votes
0answers
23 views

ACL entity and microservices database relations

I would like to build a microservices architecture to handle the following scenario: I have a building. The building has some kinds of devices. And the devices can be used by the users. In the system, ...
0
votes
1answer
36 views

Authorization & Profiles considerations for ASP.NET MVC Customer Portal

there's an up and running self-serve customer portal built that I'm trying to make a bit better when it comes to displaying proper items for different client types and auto-logging users. Here are a ...
3
votes
1answer
172 views

REST API Authentication: Cookie vs Web Storage

Note: This question might sound like a duplicate, but all other similar questions did not take into account (mobile apps, iot's, web, 3rd party usage). Specifically, in dealing with the clients ...
0
votes
0answers
23 views

Authentication, bussiness logic and several entities in asp.net core

I'm working on an asp.net core application, using Identity as authentication/authorization management. Depending on the role the user can do "some thing", this is the normal way of authorization. But ...
1
vote
0answers
133 views

How to support anonymous user in web application?

I work for a publishing company that also provides content distribution to their users. In order to access a piece of content the user must be entitled to do so. Traditionally this authorization check ...
1
vote
0answers
26 views

OAuth2 - client_credentials

I am in the process of building out a private REST API. This API is intended for machine to machine communication. In short someone else's server will kick off a job via CRON that pulls information ...
4
votes
3answers
412 views

Authorization and Audit on models in MVC architecture

What are the best practices to extend Authorization to the Model layer if in a monolith MVC application (i.e rails) you have other entry-points than just the Controller? I.e background jobs, or the ...
1
vote
0answers
72 views

Is there any flaw in my API-to-API authentication concept I missed? [closed]

I've been thinking lately about how all of the authentication methods used in API to API communications (RESTful API's) are mostly methods that have been designed to be human oriented first (tokens\...
0
votes
1answer
82 views

Handling Authentication with both Web App and API

Not sure how to handle this. Our current app (.Net MVC) is accessed via companyname.appname.com, authentication is handled via forms (cookie) authentication. Within the app there is a global search ...
1
vote
1answer
77 views

Implementation of Android Fingerprint technology [closed]

I'm currently doing a web based system for multiple organizations, so on my login form, there's 3 simple field: Company code, such as CNN (this is implemented so we can have same username, as long as ...
3
votes
4answers
238 views

Is a cookie hash that matches with file hash safe?

I've made a simple login form. It's made very generic to be used for any project. Now I wonder if the security is good enough and if my approach is safe. On success When successfully logged in I do ...
1
vote
1answer
67 views

User registration across multiple services [closed]

I have multiple web services that need to be integrated into one solution. One frontend would provide access to features from all services. Each of the services has its own native authentication, and ...
3
votes
1answer
124 views

How to authenticate devices across organisation boundaries without a third party CA

I'm currently working on a protocol which passes automated instructions between separate organisations. I'm looking for a way to delegate authentication of devices to which ever organisation a device ...
1
vote
0answers
56 views

How to solve circular dependency scenario while executing http calls which require authentication?

I am working on a project which requires me to execute standard HTTP calls with session tokens. I am building a custom HTTP client, with a custom authenticator, something like this: Client client = ...
0
votes
0answers
43 views

Microservice auth layer vs each service authorizing requests?

I approached our architect with a solution in which all of our microservices verify the auth of the user invoking the call. Basically, what I've been doing for years, on different projects. He ...
0
votes
0answers
37 views

First time connection with gRPC and mutual authentication

When making a gRPC connection, the client can optionally provide credentials so that they may also be authenticated. In the case of a new client, how can a set of keys and certificates be established?...
0
votes
1answer
85 views

API User identification

I'm designing an API, and I need to authenticate each request with a user. The simplest way to do that is to provide an API key to each user on their "My account" page, that they could regenerate at ...
0
votes
0answers
25 views

How to provide an extension point for library that should authenticate asynchronously using WebClient?

I'm trying to design a library (nuget package) that would read data from a REST API and deserialize it to DTO objects. The API requires authentication which is usually done with Microsoft's ADAL ...
0
votes
0answers
62 views

Authenticated ASP.NET Core MVC site consuming web API

I have an ASP.NET Core 2.2 MVC site, that uses Facebook as an identity provider. Users can click the login button, they are redirected to Facebook to enter their credentials, and are then redirected ...
1
vote
1answer
44 views

Multiple app authentication, universal user login, best practice

Please see the below diagram. There are two apps that each have a different set of functions, User A is a user of App1 and User B is a user of App2. They should not be able to log in directly to the ...
1
vote
0answers
42 views

Single Sign On implementation for CMS

This is a general question seeking guidance for the best practice(s) on implementing a Single Sign On (SSO) across many various installations of the same application. The hypothetical example I would ...
-5
votes
2answers
65 views

Authenticate Git Pulls on a Compromised Machine [closed]

I may have a tough one for you. I have a machine in the wild that is and will probably continue to be compromised. The machine is owned by a user who will be unable to keep it secure. I must have ...
0
votes
0answers
16 views

Keep sync Authentication Server user profile with App Server best practices

I have two servers first one is Authentication Server that handles refresh token, AccessToken and external login. On external login, I create user and store profile information like first name and ...
3
votes
2answers
93 views

So I am creating a user registration system with oauth login to four services. How do I handle username selection?

My registration system normally asks for 4 things: The user's full name, their email, their preferred username, and a password. I want to add four oauth2 registration services to make it easier and ...
0
votes
1answer
112 views

How to protect while loosely coupling a db server that is shared by 2 different services

Background information I have a database that will be used by two different web applications. Solution A (user driven web application) resides on the public internet and will write / update / delete ...
1
vote
2answers
242 views

When using Redux/Redux-Saga - should JWTs be set in the action creators/sagas?

Almost every blog post I've encountered around generic auth handling using JWTs in a React/Redux/Saga application does the same thing, which is to store the JWT in local storage, in the action/saga. ...
0
votes
1answer
58 views

How you can deal with making invalid a list of JWTs?

I design a new Rest API for a personal project and I am trying to implement the authentication and authorization mechanism as a separate project, so I ended up with a couple of problems which I am ...
1
vote
2answers
233 views

Security Issues with RESTful Authentication & Session Management

I'm trying to implement authentication and session management for a microservice. In order to do the process RESTfully, I understand that I'll need to use some kind of token-based authentication to ...
1
vote
0answers
23 views

Client synchronization of authentication tokens in parallel connections

In my app server's authentication implementation, an authentication token is generated for every user that has logged in. According to some highly recommended security tips (Implementing Secure User ...
1
vote
1answer
170 views

Onion Architecture, Project Architecting and Authentication

I am learning ASP.NET MVC & Web API and trying to implement Onion Architecture with Repository Pattern for one of my Test projects as part of my learning. I have developed single MVC Projects ...
1
vote
1answer
67 views

Help with definition of broad user types

I am trying to define the boundary between two broad types of users. The first are those who make use of corporate systems (accounting, ERP, CRM, etc.) and this also includes B2B users, for example ...
0
votes
2answers
78 views

Managing sign-on in mobile applications

I'm programming a mobile app which makes use of REST services. Some of the services are for logged users, so I have a login endpoint which lets me enter my credentials and get a JWT token for ...
5
votes
1answer
256 views

How can I obtain a CA certificate for my application if I do not own a business/company?

I have developed an application which I intend to sell. I set up a website with information and download links, advertising, payments, everything is ready to go - except the digital signature. I want ...
0
votes
2answers
875 views

Microservice authentication between services

Is there a way to ensure that serviceA is called only by serviceB(or a set of whitelisted services)? All the services are independent and do not go through a service gateway as they are completely ...
4
votes
0answers
281 views

Should an SPA use OIDC's Implicit flow or Auth Code flow?

We are developing a new Angular SPA which leverages Keycloak for its SSO abilities using OpenID Connect (OIDC). The app is currently designed to use the Implicit flow to retrieve short-lived access ...
-1
votes
2answers
101 views

How would you design the abstraction/class(es)/component(s) of a third-party service/api used in your application?

Lets say you were designing a Twitter client for people with people could see tweets and post tweets? How would you design the twitter api abstraction? Many of the api wrappers I've seen feature an ...
-2
votes
1answer
48 views

Should API also authenticate users from front end app?

I am building an API using Laravel and am looking at using Laravel/Passport for authentication - but I am struggling with a design decision. The API will be consumed by multiple other applications / ...
0
votes
1answer
61 views

Is changing the domain according to the user privilege on specific fields considered as anti-pattern?

Is changing the domain according to the user privilege on specific fields considered as anti-pattern? My case: I have Schedule Entity (aggregate root) like this: public class Schedule : Entity<...
-2
votes
1answer
107 views

How to migrate an existing ASP.NET MVC site to ASP.NET MVC Core - specifically on authorization

I am in the process of upgrading an existing website to ASP.NET Core 2.1. The goal is simplification and ease of maintenance. Existing site is using: EF and .NET 4.6.2 A [Users] table in SQL Server ...
0
votes
2answers
140 views

API Design - User Management

I work for an ecommerce site and we are looking to expose much of our core functionality via a set of APIs. We plan on re-writing some of our own public facing websites (e.g. the main shop website) to ...
1
vote
1answer
54 views

Should I separate the REST sessions from the sessions in the rest of the application?

Assuming I have resources I restrict access to with a username + password login in my web application and in my REST API. Should I keep different sessions for both meaning that a login via the web UI ...
1
vote
2answers
1k views

Stateful authentication in REST API using tokens

I have recently started on a project involving a REST API. The API requires authentication with requirements for administrators to be able to view logged in users and to be able to revoke specific ...
0
votes
1answer
68 views

LDAP with Dovecot

I have a mail server setup with Postfix and Dovecot, and an application server setup with node.js. I have user credentials stored in my application server, and I want to use the same credentials for ...