Skip to main content

Questions tagged [authentication]

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

Filter by
Sorted by
Tagged with
2 votes
3 answers
166 views

Race condition when issuing a refresh token: worth addressing or not?

I'm quite new to the world of access and refresh tokens, so bear with me. Client uses its refresh token to get a new access token. The server invalidates the just used refresh token and contextually ...
Fabio A.'s user avatar
  • 125
-1 votes
0 answers
47 views

Single sign on across subdomains, questions about a design

Problem Statement: I am developing a single sign on solution for a midsize organization (<3000 employees) so that they can use it in their future internal software systems. The internal software ...
PedroAsking's user avatar
0 votes
1 answer
29 views

Best way to approach connection between game server to client connection with Django web server as middleman

I have a web game design question. I am trying to build a multiplayer web game with non intensive graphics (ex tic tac toe, chess). I am trying to figure out how to take already authenticated users in ...
Mr. Octodood's user avatar
1 vote
1 answer
194 views

Necessity of one-time codes in 2FA

Why is it that some services, when they conduct 2FA ask you to rewrite a code from an app, even if that app is part of that service's infrastructure? For example, when I log in via the web to ...
Karaal's user avatar
  • 21
3 votes
2 answers
452 views

How does "remember this computer" work?

Website multifactor authentication prompts will often include a "remember this computer" checkbox. How does this work? In order to be secure, it needs to be more than just a cookie, as a ...
Mud's user avatar
  • 476
0 votes
1 answer
62 views

Designing a restful API for a desktop application to facilitate communication with other APIs

Just for some context, I am a CS student in my second-year who is working on a C++ desktop application (using the Qt framework) made by an engineering professor. The application is an educational tool ...
Johnny's user avatar
  • 1
0 votes
1 answer
85 views

Authorization business logic on claims or on app database?

Context: I have an API (using DDD) with an entity lets call it "Content" that only can be update by certain users. For example Content with Id = 1, can only be modified by User Id = 1, ...
Danielbahe's user avatar
0 votes
0 answers
34 views

Passing JWTs securely back to the mobile app frontend after signing in with Google OAuth2

I have a server(API) written in Flask and a client(mobile app) written in React Native. The application allows for logging in with either email/password OR with Google. The Google authentication flow ...
Cristian Gira's user avatar
0 votes
1 answer
32 views

Is using an Azure Function to forward a message to my App Service the best idea for handling a Twilio Web Hook?

I have an Azure App Service running a .NET (Core) API for an inhouse application, which I'm integrating with Twilio to handle Whatsapp communication. To handle the web hook responsible for receiving a ...
jarodsmk's user avatar
  • 141
2 votes
1 answer
62 views

Azure Managed Identity and Zero Trust

Azure Managed Identity provides a mean to only allow explicitly defined users/apps to access a given resource. For instance I can setup that no-one can access my database except the Managed Identities ...
Jakob Busk Sørensen's user avatar
1 vote
2 answers
240 views

How to best obfuscate a built-in key in an application?

We're building an application that needs to log into a website using built-in credentials. It's not optimal to say the least, but we're stuck with "knowing" the username and password ...
glades's user avatar
  • 419
0 votes
0 answers
61 views

Securely Handling Session Keys in Excel for API Authentication

I'm working on an Excel tool that needs to synchronize with a CRM via its API. The CRM's API authentication process involves logging in with a username and password, after which a session key is ...
Alon Cohen's user avatar
0 votes
0 answers
55 views

How to handle roles and scopes using oauth2 auth flow

I'm using python and fastapi with oauth2 flow (just for clarification as the question isn't language specific). I'm confused on how to implement scopes in an efficient and secure way. I was thinking ...
Gabriel Macus's user avatar
1 vote
0 answers
47 views

How to merge SQL Server database authentication with firebase authentication?

I have Firebase connected to my web app and users can authenticate using the 'microsoft' provider. The provider only allows authenticating with the active directory tenant that I specified in my ...
Clay Casper's user avatar
1 vote
1 answer
70 views

Persistant Browser Display Settings for Users

I have a question about what's the best approach to handle persistent data for web apps. I have a web app that is authenticating through an auth service. once authenticated it makes requests to the ...
BigL's user avatar
  • 13
2 votes
1 answer
146 views

web-dev: how to restrict access to costly backend API to authenticated clients only

I've created a small prototype browser plugin and am now thinking about making it accessible to the public. This brings up an important question about gatekeeping API access and the right way to ...
lhk's user avatar
  • 446
0 votes
0 answers
31 views

Per Request Authorization using Facebook Login

Stack: ASP.NET Core + Razor + SQLite TLDR: How do I rely solely on Facebook Login for authorization? I am building an app with sole integration to Facebook for my Facebook group. Essentially it is a &...
Zathura's user avatar
0 votes
0 answers
103 views

JWT Cookie and API Gateway

Background I have an authentication microservice that handles the user authentication and returns 2 JWT cookies (access_token and refresh_token). I want to incorporate an API gateway that does the JWS ...
Neil's user avatar
  • 9
-1 votes
1 answer
103 views

How are first-time users signup requests authenticated?

I have a web service. When a user makes a request, traefik first redirects it to my users micro service, to pass through an authentication function. The token (or username+password, on first request) ...
Juan Perez's user avatar
1 vote
0 answers
139 views

OpenID Connect and User Management Best Practices

Currently my company has 2 applications that use Identity Server for SSO. Not every client we have uses both applications but some do. The part I'm uneasy about is that both apps have a user ...
Brad Firesheets's user avatar
18 votes
9 answers
5k views

Authentication and authorisation for people with intellectual disabilities

Currently, I'm involved in a research project in which we are evaluating an existing web environment providing a safe online playground for children/adolescents with intellectual disabilities. Certain ...
KDW's user avatar
  • 349
5 votes
3 answers
963 views

Group set of commands as atomic transactions (C++)

We're designing the architecture of an embedded device (esp32). One of the tasks is that the device should connect to the internet and use a preprovisioned redeem code to register itself with our web ...
glades's user avatar
  • 419
1 vote
1 answer
101 views

Is my security pattern correct for authenticating principal users to my microservices?

We are trying to implement an authorization and authentication service for our product. Now, we would have to cater to different kinds of IAM systems like SSO, LDAP and Basic Username+Password in ...
Anirban Das's user avatar
-1 votes
1 answer
92 views

What is the best way to authenticate a user over IVR?

I am trying to build an IVR system that requires some form of username & password/pin entry to access sensitive data. My naïve solution seemed obvious enough, until I realized that username/pass ...
Noob Saibot's user avatar
0 votes
1 answer
288 views

Using Azure AD as an identity provider in Keycloak-based applications: how can I add missing user data to my client applications?

I'm currently using Azure AD as my identity provider and Keycloak as my intermediary/broker for my client applications. However, I need some user attributes (such as phone, email, picture, and ...
linus's user avatar
  • 121
0 votes
1 answer
64 views

Including currect user/roles data within object state in .Net applications to control object behavior

I am building a .Net Core Blazor Server application. The application creates records of a Project class which move through a workflow with various phases of review and acceptance/rejection before ...
aterbo's user avatar
  • 111
0 votes
1 answer
85 views

How can a web application distinguish between sessions from trusted and non-trusted devices?

For compliance reasons, we want admins of a web app to work on it from devices (phones or computers) approved by IT. Or rather, they can work from other devices, but should get logged out quickly, so ...
Alexey Romanov's user avatar
0 votes
0 answers
216 views

How can I secure the backend in a meaningful way when users log in via OAuth2 in the frontend?

I'm thinking about a rewrite of a existing application. This legacy application does not separate frontend and backend. It's a single application with server side rendering. I want to rewrite it to a ...
samjaf's user avatar
  • 121
0 votes
0 answers
48 views

API authentication for iOS applications

I am currently working on my own iOS application and am going to be using a locally developed API for fetching data. I wanted to outline my current account sign-in architecture and verify this is ...
Trenton's user avatar
  • 17
0 votes
1 answer
956 views

Can I use a session cookie for API authentication?

I want to build a web application with a Single Page Application as the front end and an API as the back end. The front-end SPA will read and write data to the API. The SPA and the API will be hosted ...
Damien Monni's user avatar
0 votes
0 answers
103 views

WebApp: How and where to handle an expired authorization with 'back to login'

SituationI have a Single page web app with REST API. When the user logs in, they receive an authorization token. The token which will expire after some time. When the user tries to make a server ...
DarkTrick's user avatar
  • 207
0 votes
2 answers
83 views

OAuth Client Credentials Security Concern

I have a scenario I am considering, and I don't quite find out what's the best solution with OAuth. Hopefully I can learn good things here. We are company A and we specialize in managing secure text ...
diegosasw's user avatar
  • 387
1 vote
0 answers
976 views

Authorization using Azure AD B2C access tokens in Python / Flask

TLDR: I am trying to validate a Azure AD B2C access token in my Flask web API use scopes from that access token to authorize calling protected resources use timely and secure solutions such as PKCE ...
linus's user avatar
  • 121
0 votes
5 answers
532 views

Authentication for an app that only has one user

I'm going to write a blog app for myself, and though I've written authentication for multiple users. It seems heavy handed to use the same kind of architecture for one user. The only alternatives to ...
bonum_cete's user avatar
0 votes
1 answer
410 views

Any way to forward an auth session from OAuth system to another system (with API key)?

Description This is a long shot, but I'm in dire need of advice. If you know of a more appropriate forum for this type of question please share! I'm working with a legacy OAuth system using email + ...
cjhines's user avatar
3 votes
2 answers
2k views

Oauth 2.0 - MFA for REST APIs

We are looking at implementing Multi-factor authentication for our application, using Time-based one-time password (TOTP) algorithm. What we want to achieve: Users should have the option to enable ...
user1583803's user avatar
-1 votes
1 answer
198 views

iOS application token auth best practices

I am looking into building an iOS application and using an internally built API to access data. My API has some authentication endpoints that takes in a username and password and, if the login is ...
Trenton's user avatar
  • 17
0 votes
0 answers
193 views

What is the right way to update claims in identity-server 4 from Angular

I have a multitenant application where a user can belong to multiple tenants. I'm using Identity-Server 4 for the authentication. I have two applications Angular and API. When a user is not ...
Replay's user avatar
  • 109
0 votes
1 answer
182 views

Should an access token really be cryptographically signed?

In a web app I'm writing, a singed-in user is recognized by their cookie containing a session identifier. That session id has sixty-four bits of entropy, so I believe brute-force attacks are ...
Schmo's user avatar
  • 113
0 votes
0 answers
72 views

How to authenticate client and user

I could use some feedback on designing a solution for handling two OAuth flows in a single request. I have an API that currently supports OAuth2.0 (for users). It was requested that we should be able ...
Martin Nielsen's user avatar
-1 votes
1 answer
105 views

Auth flow between two services

We have two applications, each of them separated with its own backend and frontend. The first application is the user-facing one. They register on the site and as soon as they want to execute a ...
Matias's user avatar
  • 31
2 votes
2 answers
1k views

How to authenticate front end with backend in an anonymous user flow [closed]

I have an API that will be exposed on the internet publicly, the primary use of this API will be initially by a ReactJs front end but in the future we'd be looking to open this up to other clients ...
A. Murray's user avatar
  • 181
0 votes
0 answers
602 views

Best practice architecture to implement Spotify Auth for a Flutter frontend app and Node.js backend?

I am currently building an application that uses the Spotify API to work with a user's playlists. My frontend is a Flutter app, which is connected to the backend, that is built with Node.js. Currently ...
mic-ray's user avatar
0 votes
2 answers
406 views

Design of a passwordless signup and signin

I am currently planning to create an application. So far I have always been using the traditional username/password approach. But I would like to get rid of passwords for user authentication. This ...
Razmooo's user avatar
  • 133
0 votes
1 answer
2k views

How to share users between multiple web application?

Objective I have to create way to use the same users to connect to multiple application, and i am thinking about how to do it and how to share the data between the applications. Details Each ...
Gregory Boutte's user avatar
-1 votes
1 answer
638 views

Securing http communication between backend services [closed]

What is a good way to secure http communication between two backend services which are not hosted on the same network? One way might be to have a shared secret in both services but I feel like that is ...
mismaah's user avatar
  • 129
0 votes
1 answer
552 views

Understanding the JWT and refresh token approach

I've read a few articles which cover the set up for refresh tokens and JWT tokens Is there a best practice in how/when to get the next JWT token. In my head, there are a few different approaches. I ...
MyDaftQuestions's user avatar
0 votes
1 answer
133 views

How to model users in multiple workspaces

In Slack and other apps, a user's email can be tied to multiple workspaces. What’s the best approach to architecting that? Do you list workspace IDs on the user record, or do you maintain a list of ...
Nth.gol's user avatar
  • 125
-2 votes
1 answer
75 views

Should I wrap Azure AD B2C for authentication?

I want to implement an authentication system. The purpose of the system is to centralize account management and handle the complexity of account security. Internally, I don't want to implement the ...
Hans's user avatar
  • 1
-1 votes
2 answers
215 views

How to keep authentication in user context in reactive programming?

I want to execute everything in a user context. Meaning that if the request comes from one user then the service has a token of only this user and can't execute anything for another user. Now the ...
user980828's user avatar

1
2 3 4 5
9