Questions tagged [authentication]
Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.
409
questions
0
votes
1
answer
46
views
Using Azure AD as an identity provider in Keycloak-based applications: how can I add missing user data to my client applications?
I'm currently using Azure AD as my identity provider and Keycloak as my intermediary/broker for my client applications. However, I need some user attributes (such as phone, email, picture, and ...
- 10.1k
1
vote
1
answer
93
views
Is my security pattern correct for authenticating principal users to my microservices?
We are trying to implement an authorization and authentication service for our product.
Now, we would have to cater to different kinds of IAM systems like SSO, LDAP and Basic Username+Password in ...
-1
votes
1
answer
37
views
What is the best way to authenticate a user over IVR?
I am trying to build an IVR system that requires some form of username & password/pin entry to access sensitive data. My naïve solution seemed obvious enough, until I realized that username/pass ...
- 68.7k
0
votes
1
answer
47
views
Including currect user/roles data within object state in .Net applications to control object behavior
I am building a .Net Core Blazor Server application. The application creates records of a Project class which move through a workflow with various phases of review and acceptance/rejection before ...
- 111
20
votes
2
answers
15k
views
REST API security: HMAC/key hashing vs JWT
I just read this article that is a few years old but describes a clever way of securing your REST APIs. Essentially:
Each client has a unique public/private key pair
Only the client and the server ...
- 101
0
votes
1
answer
40
views
How can a web application distinguish between sessions from trusted and non-trusted devices?
For compliance reasons, we want admins of a web app to work on it from devices (phones or computers) approved by IT. Or rather, they can work from other devices, but should get logged out quickly, so ...
- 130k
9
votes
1
answer
576
views
Facebook authentication with an Authoritative Server for a Flash Game
I'm working on a multiplatform game in Flash. This game utilizes Photon Server for authoritative physics and user statistics tracking. I'm looking to leverage Facebook authentication as an alternative ...
CommunityBot
- 1
2
votes
1
answer
224
views
Chaining openID token
I'm working in microservices environment, where each service authenticates using OpenID Connect to an authentication service (local IdP), based on Users I keep locally on my Database.
Now, I want ...
CommunityBot
- 1
1
vote
1
answer
540
views
Securing API with JWT and elevated access using MFA
At my company we have a central auth server running IdentityServer. There are a number of applications providing some API to client applications. API requests are authenticated with JWT tokens issued ...
CommunityBot
- 1
0
votes
0
answers
40
views
How can I secure the backend in a meaningful way when users log in via OAuth2 in the frontend?
I'm thinking about a rewrite of a existing application. This legacy application does not separate frontend and backend. It's a single application with server side rendering.
I want to rewrite it to a ...
- 1,308
2
votes
1
answer
217
views
Using Django Sessions when views are accessed by API
I'm making an app which is a Django backend and a React frontend (being developed by someone else). The plan currently is to fully decouple the two and have them communicate over API. However, I would ...
CommunityBot
- 1
0
votes
0
answers
25
views
API authentication for iOS applications
I am currently working on my own iOS application and am going to be using a locally developed API for fetching data. I wanted to outline my current account sign-in architecture and verify this is ...
- 17
0
votes
1
answer
155
views
Can I use a session cookie for API authentication?
I want to build a web application with a Single Page Application as the front end and an API as the back end. The front-end SPA will read and write data to the API.
The SPA and the API will be hosted ...
- 68.7k
6
votes
3
answers
1k
views
How do you handle JWT expiration for long running calls?
Currently we are debating over securing our multiple micro-services.
The major concern is that the JWT token provided to us will expire before the call is finished. (This is in the synchronous design)
...
- 11
0
votes
1
answer
399
views
Handling Authentication with both Web App and API
Not sure how to handle this. Our current app (.Net MVC) is accessed via companyname.appname.com, authentication is handled via forms (cookie) authentication.
Within the app there is a global search ...
CommunityBot
- 1
1
vote
1
answer
750
views
OAuthv2 access tokens and resource servers
In the OAuthv2 authorization grant, a “client app” authenticates itself against an “auth server”, and receives an “access token” for accessing resources living on a “resource server”.
My concerns:
...
CommunityBot
- 1
0
votes
2
answers
66
views
OAuth Client Credentials Security Concern
I have a scenario I am considering, and I don't quite find out what's the best solution with OAuth. Hopefully I can learn good things here.
We are company A and we specialize in managing secure text ...
- 130k
0
votes
0
answers
45
views
WebApp: How and where to handle an expired authorization with 'back to login'
SituationI have a Single page web app with REST API. When the user logs in, they receive an authorization token. The token which will expire after some time.
When the user tries to make a server ...
- 217
1
vote
0
answers
316
views
Authorization using Azure AD B2C access tokens in Python / Flask
TLDR:
I am trying to
validate a Azure AD B2C access token in my Flask web API
use scopes from that access token to authorize calling protected resources
use timely and secure solutions such as PKCE ...
- 121
0
votes
5
answers
164
views
Authentication for an app that only has one user
I'm going to write a blog app for myself, and though I've written authentication for multiple users. It seems heavy handed to use the same kind of architecture for one user.
The only alternatives to ...
- 97.7k
0
votes
0
answers
39
views
Auth0 Middleware Layer Abstraction
I am currently spearheading a project to rearchitect our authentication, and we've signed on with Auth0 as a vendor that will manage the authentication component (for the time being - authorization ...
- 101
0
votes
1
answer
142
views
Any way to forward an auth session from OAuth system to another system (with API key)?
Description
This is a long shot, but I'm in dire need of advice. If you know of a more appropriate forum for this type of question please share!
I'm working with a legacy OAuth system using email + ...
- 1
8
votes
1
answer
17k
views
RESTful API with session tokens.. ehh?
After looking at a lot of session/state debates with regard to REST and finding nothing concrete, I'm just going to cut to the chase and ask myself.
Developing a RESTful API as a backend for a mobile ...
- 72k
0
votes
0
answers
45
views
microservice separate data server auth server an website
I have an API server related to users and employees data with database.
There is another API server for users authentication.
The last one is website client UI with social providers to authenticate ...
3
votes
1
answer
1k
views
Refresh tokens by example using Angular and Spring Boot
I am designing out an app that would have an Angular frontend and Spring Boot (Java) backend.
I was considering (but not married to) the prospect of JWT-based authentication:
User logs in with ...
3
votes
1
answer
563
views
How to delegate the refresh token renewal in a SOA
So, we've got SOA on the backend (BE) and on the frontend (FE) we've got micro-frontends (the separate micro-frontends are loaded as components into the frontend app when needed, so internal process ...
- 1
3
votes
2
answers
389
views
Oauth 2.0 - MFA for REST APIs
We are looking at implementing Multi-factor authentication for our application, using Time-based one-time password (TOTP) algorithm.
What we want to achieve:
Users should have the option to enable ...
- 11.3k
1
vote
1
answer
2k
views
How to support anonymous user in web application?
I work for a publishing company that also provides content distribution to their users. In order to access a piece of content the user must be entitled to do so. Traditionally this authorization check ...
CommunityBot
- 1
-1
votes
1
answer
56
views
iOS application token auth best practices
I am looking into building an iOS application and using an internally built API to access data. My API has some authentication endpoints that takes in a username and password and, if the login is ...
- 11
0
votes
0
answers
72
views
What is the right way to update claims in identity-server 4 from Angular
I have a multitenant application where a user can belong to multiple tenants. I'm using Identity-Server 4 for the authentication.
I have two applications Angular and API. When a user is not ...
38
votes
1
answer
40k
views
Where to place an API key: a custom HTTP header VS the Authorization header with a custom scheme
I'm designing a REST API using authorization/authentication via an API Key.
I tried to figure out what is the best place for it and found out that many people suggest using a custom HTTP header such ...
- 13.3k
0
votes
0
answers
63
views
Preferred way to handle authentication in a microservice architecture
I have a dummy application that serves tickets separated in two apps and a database.
One app is the backend app, it knows only JSON and serves a port in a specific container locally. It handles ...
- 2,056
0
votes
0
answers
54
views
How to authenticate client and user
I could use some feedback on designing a solution for handling two OAuth flows in a single request.
I have an API that currently supports OAuth2.0 (for users).
It was requested that we should be able ...
- 3,117
0
votes
1
answer
114
views
Should an access token really be cryptographically signed?
In a web app I'm writing, a singed-in user is recognized by their cookie containing a session identifier. That session id has sixty-four bits of entropy, so I believe brute-force attacks are ...
- 130k
1
vote
1
answer
220
views
API / System Design [Flexible Authentication / Authorization]?
Background:
We're a smaller shop that puts out a number of products that require
authentication and authorization. We're currently using a 3rd party
service to "spin up new auth APIs" for ...
12
votes
3
answers
11k
views
Should access permissions and roles be included in payload of JWT?
Should information about the permissions and roles of the client be included in JWT?
Having such information in JWT token will be very helpful as everytime a valid token comes, it would be easier to ...
-1
votes
1
answer
248
views
Can I call a WCF endpoint from ASP.Net Web API?
I have a web api with controller methods that use rest http(post/get calls).
Clients consume this API with normal httpclient calls and I pass an http response back.
My use case is I have a legacy ...
CommunityBot
- 1
0
votes
2
answers
379
views
Is a refresh token an entity or value object?
I have a User entity, which may have a RefreshToken (for authentication).
Notes:
A refresh token doesn't have "identity", but is related to a single user - it is only valid for that user. In the db ...
- 72k
2
votes
2
answers
2k
views
How to have my callbacks authenticated in a REST app?
I'm developing a REST application and I allow my clients to authenticate in several ways (typically using Authorization: Token ... as in OAuth 2.0, but also there's session-based auth option for the ...
- 1
1
vote
0
answers
29
views
Whats the common "flow" for authentication using ADFS and OpenId Connect when building an API?
Im trying to "grasp" how a user should authenticate to our API.
Our API is setup to use OpenID Connect thats issued by an ADFS-server.
However.. as a "consumer" of our application, ...
- 223
0
votes
1
answer
1k
views
Best way to store Session token on mobile App
Background
Building a mobile App for product X which is currently hosted as a SaaS solution. The product X does not support OAuth currently, implements basic authentication and generates Session token ...
- 3,092
-1
votes
1
answer
70
views
Auth flow between two services
We have two applications, each of them separated with its own backend and frontend.
The first application is the user-facing one. They register on the site and as soon as they want to execute a ...
- 186
1
vote
2
answers
618
views
How to authenticate front end with backend in an anonymous user flow [closed]
I have an API that will be exposed on the internet publicly, the primary use of this API will be initially by a ReactJs front end but in the future we'd be looking to open this up to other clients ...
- 50.8k
0
votes
0
answers
371
views
Best practice architecture to implement Spotify Auth for a Flutter frontend app and Node.js backend?
I am currently building an application that uses the Spotify API to work with a user's playlists. My frontend is a Flutter app, which is connected to the backend, that is built with Node.js. Currently ...
- 72k
1
vote
2
answers
231
views
Design of a passwordless signup and signin
I am currently planning to create an application. So far I have always been using the traditional username/password approach. But I would like to get rid of passwords for user authentication. This ...
- 72k
0
votes
3
answers
225
views
What is a recommended authentication architecture for a front GUI app that I want to control but that will be used by others to control their servers?
I have a front end (WEB GUI) app that I designed (Python for now + JavaScript in the future) that I use to access a controller, it uses REST APIs.
I want to publish this app in the cloud so that ...
CommunityBot
- 1
0
votes
1
answer
943
views
How to share users between multiple web application?
Objective
I have to create way to use the same users to connect to multiple application, and i am thinking about how to do it and how to share the data between the applications.
Details
Each ...
- 13.3k
0
votes
1
answer
179
views
LDAP with Dovecot
I have a mail server setup with Postfix and Dovecot, and an application server setup with node.js. I have user credentials stored in my application server, and I want to use the same credentials for ...
CommunityBot
- 1
-1
votes
1
answer
405
views
Securing http communication between backend services [closed]
What is a good way to secure http communication between two backend services which are not hosted on the same network?
One way might be to have a shared secret in both services but I feel like that is ...
- 130k
0
votes
3
answers
414
views
What are the advantages of refresh token?
A good auth system contains access and refresh tokens. I know what access-tokens are for and I know what refresh tokens DO - but I don't understand their meaning.
For example:
If I authenticate myself ...
- 371