Questions tagged [authentication]

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
31 views

API architecture and best-practices for multiple use cases

I have some questions regarding architecture for our API setup at work. We're in the process of creating a new API, but we're not sure what's the best approach for our requirements. The API needs to ...
0 votes
1 answer
379 views

Handling Authentication with both Web App and API

Not sure how to handle this. Our current app (.Net MVC) is accessed via companyname.appname.com, authentication is handled via forms (cookie) authentication. Within the app there is a global search ...
2 votes
1 answer
868 views

Refresh tokens by example using Angular and Spring Boot

I am designing out an app that would have an Angular frontend and Spring Boot (Java) backend. I was considering (but not married to) the prospect of JWT-based authentication: User logs in with ...
3 votes
1 answer
509 views

How to delegate the refresh token renewal in a SOA

So, we've got SOA on the backend (BE) and on the frontend (FE) we've got micro-frontends (the separate micro-frontends are loaded as components into the frontend app when needed, so internal process ...
1 vote
1 answer
736 views

OAuthv2 access tokens and resource servers

In the OAuthv2 authorization grant, a “client app” authenticates itself against an “auth server”, and receives an “access token” for accessing resources living on a “resource server”. My concerns: ...
2 votes
2 answers
93 views

Oauth 2.0 - MFA for REST APIs

We are looking at implementing Multi-factor authentication for our application, using Time-based one-time password (TOTP) algorithm. What we want to achieve: Users should have the option to enable ...
1 vote
1 answer
2k views

How to support anonymous user in web application?

I work for a publishing company that also provides content distribution to their users. In order to access a piece of content the user must be entitled to do so. Traditionally this authorization check ...
-1 votes
1 answer
23 views

iOS application token auth best practices

I am looking into building an iOS application and using an internally built API to access data. My API has some authentication endpoints that takes in a username and password and, if the login is ...
0 votes
0 answers
32 views

What is the right way to update claims in identity-server 4 from Angular

I have a multitenant application where a user can belong to multiple tenants. I'm using Identity-Server 4 for the authentication. I have two applications Angular and API. When a user is not ...
9 votes
1 answer
533 views

Facebook authentication with an Authoritative Server for a Flash Game

I'm working on a multiplatform game in Flash. This game utilizes Photon Server for authoritative physics and user statistics tracking. I'm looking to leverage Facebook authentication as an alternative ...
2 votes
1 answer
192 views

Chaining openID token

I'm working in microservices environment, where each service authenticates using OpenID Connect to an authentication service (local IdP), based on Users I keep locally on my Database. Now, I want ...
38 votes
1 answer
39k views

Where to place an API key: a custom HTTP header VS the Authorization header with a custom scheme

I'm designing a REST API using authorization/authentication via an API Key. I tried to figure out what is the best place for it and found out that many people suggest using a custom HTTP header such ...
1 vote
1 answer
385 views

Securing API with JWT and elevated access using MFA

At my company we have a central auth server running IdentityServer. There are a number of applications providing some API to client applications. API requests are authenticated with JWT tokens issued ...
1 vote
1 answer
149 views

Using Django Sessions when views are accessed by API

I'm making an app which is a Django backend and a React frontend (being developed by someone else). The plan currently is to fully decouple the two and have them communicate over API. However, I would ...
0 votes
0 answers
26 views

Preferred way to handle authentication in a microservice architecture

I have a dummy application that serves tickets separated in two apps and a database. One app is the backend app, it knows only JSON and serves a port in a specific container locally. It handles ...
0 votes
0 answers
48 views

How to authenticate client and user

I could use some feedback on designing a solution for handling two OAuth flows in a single request. I have an API that currently supports OAuth2.0 (for users). It was requested that we should be able ...
0 votes
1 answer
90 views

Should an access token really be cryptographically signed?

In a web app I'm writing, a singed-in user is recognized by their cookie containing a session identifier. That session id has sixty-four bits of entropy, so I believe brute-force attacks are ...
1 vote
1 answer
200 views

API / System Design [Flexible Authentication / Authorization]?

Background: We're a smaller shop that puts out a number of products that require authentication and authorization. We're currently using a 3rd party service to "spin up new auth APIs" for ...
12 votes
3 answers
10k views

Should access permissions and roles be included in payload of JWT?

Should information about the permissions and roles of the client be included in JWT? Having such information in JWT token will be very helpful as everytime a valid token comes, it would be easier to ...
-1 votes
1 answer
158 views

Can I call a WCF endpoint from ASP.Net Web API?

I have a web api with controller methods that use rest http(post/get calls). Clients consume this API with normal httpclient calls and I pass an http response back. My use case is I have a legacy ...
0 votes
2 answers
291 views

Is a refresh token an entity or value object?

I have a User entity, which may have a RefreshToken (for authentication). Notes: A refresh token doesn't have "identity", but is related to a single user - it is only valid for that user. In the db ...
2 votes
2 answers
1k views

How to have my callbacks authenticated in a REST app?

I'm developing a REST application and I allow my clients to authenticate in several ways (typically using Authorization: Token ... as in OAuth 2.0, but also there's session-based auth option for the ...
0 votes
0 answers
17 views

Whats the common "flow" for authentication using ADFS and OpenId Connect when building an API?

Im trying to "grasp" how a user should authenticate to our API. Our API is setup to use OpenID Connect thats issued by an ADFS-server. However.. as a "consumer" of our application, ...
0 votes
1 answer
1k views

Best way to store Session token on mobile App

Background Building a mobile App for product X which is currently hosted as a SaaS solution. The product X does not support OAuth currently, implements basic authentication and generates Session token ...
-1 votes
1 answer
59 views

Auth flow between two services

We have two applications, each of them separated with its own backend and frontend. The first application is the user-facing one. They register on the site and as soon as they want to execute a ...
1 vote
2 answers
175 views

How to authenticate front end with backend in an anonymous user flow [closed]

I have an API that will be exposed on the internet publicly, the primary use of this API will be initially by a ReactJs front end but in the future we'd be looking to open this up to other clients ...
0 votes
0 answers
176 views

Best practice architecture to implement Spotify Auth for a Flutter frontend app and Node.js backend?

I am currently building an application that uses the Spotify API to work with a user's playlists. My frontend is a Flutter app, which is connected to the backend, that is built with Node.js. Currently ...
1 vote
2 answers
150 views

Design of a passwordless signup and signin

I am currently planning to create an application. So far I have always been using the traditional username/password approach. But I would like to get rid of passwords for user authentication. This ...
0 votes
0 answers
33 views

How do I use OAuth2 for user management and authentication in my application?

I'm building an application where I want to be able to create and authenticate users using Discord and OAuth2. The reasons are: The application can be considered a "companion" app to a ...
0 votes
0 answers
46 views

Multitenet architecture with AWS cognito

I want to build a multi-tenant application with AWS Cognito. One user can belong to many tenants and they can have different roles in each tenant. Each tenant will have resources like S3 buckets and ...
0 votes
3 answers
219 views

What is a recommended authentication architecture for a front GUI app that I want to control but that will be used by others to control their servers?

I have a front end (WEB GUI) app that I designed (Python for now + JavaScript in the future) that I use to access a controller, it uses REST APIs. I want to publish this app in the cloud so that ...
0 votes
1 answer
427 views

How to share users between multiple web application?

Objective I have to create way to use the same users to connect to multiple application, and i am thinking about how to do it and how to share the data between the applications. Details Each ...
0 votes
1 answer
175 views

LDAP with Dovecot

I have a mail server setup with Postfix and Dovecot, and an application server setup with node.js. I have user credentials stored in my application server, and I want to use the same credentials for ...
0 votes
0 answers
27 views

Securing an API in production with Spring Security

At work I have to develop an API that queries data from a Hbase Cluster. They asked me to implement basic authentication in order to secure this API. The use case is very simple. For the moment we ...
-1 votes
1 answer
214 views

Securing http communication between backend services [closed]

What is a good way to secure http communication between two backend services which are not hosted on the same network? One way might be to have a shared secret in both services but I feel like that is ...
0 votes
3 answers
260 views

What are the advantages of refresh token?

A good auth system contains access and refresh tokens. I know what access-tokens are for and I know what refresh tokens DO - but I don't understand their meaning. For example: If I authenticate myself ...
0 votes
1 answer
83 views

Understanding the JWT and refresh token approach

I've read a few articles which cover the set up for refresh tokens and JWT tokens Is there a best practice in how/when to get the next JWT token. In my head, there are a few different approaches. I ...
0 votes
1 answer
51 views

How to model users in multiple workspaces

In Slack and other apps, a user's email can be tied to multiple workspaces. What’s the best approach to architecting that? Do you list workspace IDs on the user record, or do you maintain a list of ...
-2 votes
1 answer
42 views

Should I wrap Azure AD B2C for authentication?

I want to implement an authentication system. The purpose of the system is to centralize account management and handle the complexity of account security. Internally, I don't want to implement the ...
-1 votes
2 answers
94 views

How to keep authentication in user context in reactive programming?

I want to execute everything in a user context. Meaning that if the request comes from one user then the service has a token of only this user and can't execute anything for another user. Now the ...
1 vote
0 answers
61 views

What is the benefit of performing authn/authz at the API gateway instead of at the service?

I want to know is if we should perform authentication at the API gateway, at the individual service, or both. Let's frame this question and descussion in the context of new development. Specifically, ...
0 votes
0 answers
16 views

Consume Identity enabled WebApi in an MVC Project

I have an MVC project with no authentication. The project uses webapi as a backend to retreive and send information through the controllers. Now we need to add authentication to the webapi project as ...
2 votes
2 answers
250 views

Understanding passwordless sign up for mobile apps

How does phone number based authentication work, and what are its best practices? I've noticed there are apps with streamlined sign-up/log-in processes where only a phone number is required, simply ...
0 votes
1 answer
160 views

Enriching JWT after OpenID Connect flow

I am struggling to find a good solution for authorization of users after they were properly authenticated through an oidc flow. Let's assume the following setup: An angular SPA is interacting with ...
3 votes
1 answer
403 views

How to handle API token(s) that expires after time

I'm currently building a facade that's supposed to be in front of a system we are currently using. This system has its own API, but we have decided to simplfy things, and therefore the facade. ...
1 vote
1 answer
133 views

When do I reset Two Factor Authentication secret keys?

I have built a simple authentication system for my web application that makes use of the open-source time-based OTP algorithm (RFC 6238). The key for each user is generated when the user is registered ...
0 votes
1 answer
77 views

How can I improve my method of authenticating library students

I'm in the process of designing a library system. There's one application for the librarian to manage books, manage users, etc. But, we also need to ensure that subscriptions are paid on time in this ...
1 vote
3 answers
530 views

Offline user authentication

One of our customers had a pen test performed on our application this week and let's just say it didn't go well. The main issue they have is that user authentication takes place on the client, rather ...
1 vote
1 answer
101 views

Mobile authentication approaches, JWTs and refresh tokens

Context I'm developing togther with my dev team a mobile app in a client-server architecture, since there will be a webclient too, allowing some users (admins) to perform certain operations from the ...
3 votes
1 answer
176 views

Should user and service-to-service authentications be separate?

Say I have a system with 5 microservices behind a gateway, and a user signs in through an IDP (OAuth) A user U passes the access token in a request, and the call first reaches the gateway before it ...

1
2 3 4 5
8