Questions tagged [authentication]

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

Filter by
Sorted by
Tagged with
0 votes
1 answer
44 views

Authorization business logic on claims or on app database?

Context: I have an API (using DDD) with an entity lets call it "Content" that only can be update by certain users. For example Content with Id = 1, can only be modified by User Id = 1, ...
7 votes
2 answers
2k views

Multiple SSH keys for different organizations [closed]

I can see that GitHub allows you to have multiple mail account and associate every organization you are part of with a different address. Can this be done also for SSH keys? What I would like to do ...
10 votes
1 answer
648 views

Facebook authentication with an Authoritative Server for a Flash Game

I'm working on a multiplatform game in Flash. This game utilizes Photon Server for authoritative physics and user statistics tracking. I'm looking to leverage Facebook authentication as an alternative ...
2 votes
1 answer
263 views

Chaining openID token

I'm working in microservices environment, where each service authenticates using OpenID Connect to an authentication service (local IdP), based on Users I keep locally on my Database. Now, I want ...
1 vote
1 answer
907 views

Securing API with JWT and elevated access using MFA

At my company we have a central auth server running IdentityServer. There are a number of applications providing some API to client applications. API requests are authenticated with JWT tokens issued ...
13 votes
1 answer
5k views

Microservice Architecture - using Auth Server as a User Resource server

I'm designing an application based on microservices architecture. In this application I will need Auth microservice. Also I will need to store some extra User information such as, perhaps, multiple ...
2 votes
1 answer
274 views

Using Django Sessions when views are accessed by API

I'm making an app which is a Django backend and a React frontend (being developed by someone else). The plan currently is to fully decouple the two and have them communicate over API. However, I would ...
1 vote
2 answers
504 views

Handling Authentication with both Web App and API

Not sure how to handle this. Our current app (.Net MVC) is accessed via companyname.appname.com, authentication is handled via forms (cookie) authentication. Within the app there is a global search ...
0 votes
0 answers
30 views

Passing JWTs securely back to the mobile app frontend after signing in with Google OAuth2

I have a server(API) written in Flask and a client(mobile app) written in React Native. The application allows for logging in with either email/password OR with Google. The Google authentication flow ...
0 votes
1 answer
28 views

Is using an Azure Function to forward a message to my App Service the best idea for handling a Twilio Web Hook?

I have an Azure App Service running a .NET (Core) API for an inhouse application, which I'm integrating with Twilio to handle Whatsapp communication. To handle the web hook responsible for receiving a ...
2 votes
1 answer
55 views

Azure Managed Identity and Zero Trust

Azure Managed Identity provides a mean to only allow explicitly defined users/apps to access a given resource. For instance I can setup that no-one can access my database except the Managed Identities ...
1 vote
1 answer
777 views

OAuthv2 access tokens and resource servers

In the OAuthv2 authorization grant, a “client app” authenticates itself against an “auth server”, and receives an “access token” for accessing resources living on a “resource server”. My concerns: ...
1 vote
2 answers
224 views

How to best obfuscate a built-in key in an application?

We're building an application that needs to log into a website using built-in credentials. It's not optimal to say the least, but we're stuck with "knowing" the username and password ...
2 votes
1 answer
139 views

web-dev: how to restrict access to costly backend API to authenticated clients only

I've created a small prototype browser plugin and am now thinking about making it accessible to the public. This brings up an important question about gatekeeping API access and the right way to ...
0 votes
0 answers
51 views

Securely Handling Session Keys in Excel for API Authentication

I'm working on an Excel tool that needs to synchronize with a CRM via its API. The CRM's API authentication process involves logging in with a username and password, after which a session key is ...
0 votes
0 answers
45 views

How to handle roles and scopes using oauth2 auth flow

I'm using python and fastapi with oauth2 flow (just for clarification as the question isn't language specific). I'm confused on how to implement scopes in an efficient and secure way. I was thinking ...
1 vote
1 answer
67 views

Persistant Browser Display Settings for Users

I have a question about what's the best approach to handle persistent data for web apps. I have a web app that is authenticating through an auth service. once authenticated it makes requests to the ...
1 vote
0 answers
37 views

How to merge SQL Server database authentication with firebase authentication?

I have Firebase connected to my web app and users can authenticate using the 'microsoft' provider. The provider only allows authenticating with the active directory tenant that I specified in my ...
0 votes
0 answers
30 views

Per Request Authorization using Facebook Login

Stack: ASP.NET Core + Razor + SQLite TLDR: How do I rely solely on Facebook Login for authorization? I am building an app with sole integration to Facebook for my Facebook group. Essentially it is a &...
0 votes
0 answers
85 views

JWT Cookie and API Gateway

Background I have an authentication microservice that handles the user authentication and returns 2 JWT cookies (access_token and refresh_token). I want to incorporate an API gateway that does the JWS ...
-1 votes
1 answer
101 views

How are first-time users signup requests authenticated?

I have a web service. When a user makes a request, traefik first redirects it to my users micro service, to pass through an authentication function. The token (or username+password, on first request) ...
5 votes
3 answers
951 views

Group set of commands as atomic transactions (C++)

We're designing the architecture of an embedded device (esp32). One of the tasks is that the device should connect to the internet and use a preprovisioned redeem code to register itself with our web ...
18 votes
9 answers
5k views

Authentication and authorisation for people with intellectual disabilities

Currently, I'm involved in a research project in which we are evaluating an existing web environment providing a safe online playground for children/adolescents with intellectual disabilities. Certain ...
1 vote
0 answers
118 views

OpenID Connect and User Management Best Practices

Currently my company has 2 applications that use Identity Server for SSO. Not every client we have uses both applications but some do. The part I'm uneasy about is that both apps have a user ...
8 votes
3 answers
13k views

Authentication and authorization - front-end vs back-end dilemma

I'm working on centralized authentication and authorization API system and got stuck in front-end vs back-end dilemma. Front-end person is telling that should to have only one request to that API to ...
0 votes
0 answers
209 views

Client or API Gateway to perform authentication on backend?

An system called X wants to consume APIs from the backend called Y. There's a definition from the Systems Architecture Team that states that every request from the X to Y must go through the corporate'...
0 votes
1 answer
192 views

Using Azure AD as an identity provider in Keycloak-based applications: how can I add missing user data to my client applications?

I'm currently using Azure AD as my identity provider and Keycloak as my intermediary/broker for my client applications. However, I need some user attributes (such as phone, email, picture, and ...
1 vote
1 answer
100 views

Is my security pattern correct for authenticating principal users to my microservices?

We are trying to implement an authorization and authentication service for our product. Now, we would have to cater to different kinds of IAM systems like SSO, LDAP and Basic Username+Password in ...
-1 votes
1 answer
68 views

What is the best way to authenticate a user over IVR?

I am trying to build an IVR system that requires some form of username & password/pin entry to access sensitive data. My naïve solution seemed obvious enough, until I realized that username/pass ...
0 votes
1 answer
60 views

Including currect user/roles data within object state in .Net applications to control object behavior

I am building a .Net Core Blazor Server application. The application creates records of a Project class which move through a workflow with various phases of review and acceptance/rejection before ...
19 votes
2 answers
16k views

REST API security: HMAC/key hashing vs JWT

I just read this article that is a few years old but describes a clever way of securing your REST APIs. Essentially: Each client has a unique public/private key pair Only the client and the server ...
0 votes
1 answer
63 views

How can a web application distinguish between sessions from trusted and non-trusted devices?

For compliance reasons, we want admins of a web app to work on it from devices (phones or computers) approved by IT. Or rather, they can work from other devices, but should get logged out quickly, so ...
0 votes
0 answers
152 views

How can I secure the backend in a meaningful way when users log in via OAuth2 in the frontend?

I'm thinking about a rewrite of a existing application. This legacy application does not separate frontend and backend. It's a single application with server side rendering. I want to rewrite it to a ...
0 votes
0 answers
45 views

API authentication for iOS applications

I am currently working on my own iOS application and am going to be using a locally developed API for fetching data. I wanted to outline my current account sign-in architecture and verify this is ...
0 votes
1 answer
734 views

Can I use a session cookie for API authentication?

I want to build a web application with a Single Page Application as the front end and an API as the back end. The front-end SPA will read and write data to the API. The SPA and the API will be hosted ...
6 votes
3 answers
2k views

How do you handle JWT expiration for long running calls?

Currently we are debating over securing our multiple micro-services. The major concern is that the JWT token provided to us will expire before the call is finished. (This is in the synchronous design) ...
0 votes
2 answers
75 views

OAuth Client Credentials Security Concern

I have a scenario I am considering, and I don't quite find out what's the best solution with OAuth. Hopefully I can learn good things here. We are company A and we specialize in managing secure text ...
0 votes
0 answers
99 views

WebApp: How and where to handle an expired authorization with 'back to login'

SituationI have a Single page web app with REST API. When the user logs in, they receive an authorization token. The token which will expire after some time. When the user tries to make a server ...
1 vote
0 answers
810 views

Authorization using Azure AD B2C access tokens in Python / Flask

TLDR: I am trying to validate a Azure AD B2C access token in my Flask web API use scopes from that access token to authorize calling protected resources use timely and secure solutions such as PKCE ...
0 votes
5 answers
404 views

Authentication for an app that only has one user

I'm going to write a blog app for myself, and though I've written authentication for multiple users. It seems heavy handed to use the same kind of architecture for one user. The only alternatives to ...
0 votes
1 answer
342 views

Any way to forward an auth session from OAuth system to another system (with API key)?

Description This is a long shot, but I'm in dire need of advice. If you know of a more appropriate forum for this type of question please share! I'm working with a legacy OAuth system using email + ...
8 votes
1 answer
18k views

RESTful API with session tokens.. ehh?

After looking at a lot of session/state debates with regard to REST and finding nothing concrete, I'm just going to cut to the chase and ask myself. Developing a RESTful API as a backend for a mobile ...
2 votes
1 answer
1k views

Refresh tokens by example using Angular and Spring Boot

I am designing out an app that would have an Angular frontend and Spring Boot (Java) backend. I was considering (but not married to) the prospect of JWT-based authentication: User logs in with ...
3 votes
1 answer
627 views

How to delegate the refresh token renewal in a SOA

So, we've got SOA on the backend (BE) and on the frontend (FE) we've got micro-frontends (the separate micro-frontends are loaded as components into the frontend app when needed, so internal process ...
3 votes
2 answers
1k views

Oauth 2.0 - MFA for REST APIs

We are looking at implementing Multi-factor authentication for our application, using Time-based one-time password (TOTP) algorithm. What we want to achieve: Users should have the option to enable ...
1 vote
0 answers
2k views

How to support anonymous user in web application?

I work for a publishing company that also provides content distribution to their users. In order to access a piece of content the user must be entitled to do so. Traditionally this authorization check ...
-1 votes
1 answer
167 views

iOS application token auth best practices

I am looking into building an iOS application and using an internally built API to access data. My API has some authentication endpoints that takes in a username and password and, if the login is ...
0 votes
0 answers
180 views

What is the right way to update claims in identity-server 4 from Angular

I have a multitenant application where a user can belong to multiple tenants. I'm using Identity-Server 4 for the authentication. I have two applications Angular and API. When a user is not ...
39 votes
1 answer
42k views

Where to place an API key: a custom HTTP header VS the Authorization header with a custom scheme

I'm designing a REST API using authorization/authentication via an API Key. I tried to figure out what is the best place for it and found out that many people suggest using a custom HTTP header such ...
0 votes
0 answers
70 views

How to authenticate client and user

I could use some feedback on designing a solution for handling two OAuth flows in a single request. I have an API that currently supports OAuth2.0 (for users). It was requested that we should be able ...

1
2 3 4 5
9