Questions tagged [authentication]

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

74 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
9 votes
1 answer
533 views

Facebook authentication with an Authoritative Server for a Flash Game

I'm working on a multiplatform game in Flash. This game utilizes Photon Server for authoritative physics and user statistics tracking. I'm looking to leverage Facebook authentication as an alternative ...
user avatar
5 votes
0 answers
143 views

Is it possible to use a reverse proxy authentication in a native mobile app

We have a few backend services that our frontend SPAs fetch data from. Right now, the SPAs use JS libraries to authenticate with the Auth server (Azure AD) which returns a JWT which is validated by my ...
user avatar
4 votes
0 answers
164 views

Is it possible to use an SPA as the UI for an OAuth 2.0 authorization server?

Using SPAs as the UI in front of an API has become standard practice, with OAuth 2.0 / OIDC being the common authz mechanism for this. This approach generally entails the SPA receiving its access via ...
user avatar
  • 1,215
4 votes
0 answers
166 views

How to authenticate third-party callbacks that don't support authentication

I'm working on a project that integrates with a third-party service via API, and the third-party uses callbacks to update us on the status of the operations being performed. These callbacks can be hit ...
user avatar
4 votes
0 answers
165 views

Client Browser, Node Server, Web API auth structure

I have a web API that accepts Authorization headers to allow access. It responds with the requested data in addition to setting a session cookie. Subsequent requests can be made with no auth headers ...
user avatar
4 votes
0 answers
111 views

Architecting an account system for oauth that bridges a new and legacy system

So this question is specific to implementing auth in our system but I'm looking for high-level (just the architecture) solution or advice on which direction to head towards. Overview (TL;DR) Our ...
user avatar
4 votes
0 answers
353 views

Global Accounts in Multi-Tenant Authorization System

Our system is fundamentally a multi-tenant setup, where each client maintains a separate database with its own data and users. The authentication system on login issues an authentication token which ...
user avatar
  • 473
4 votes
0 answers
834 views

Oauth 2 store access token vs verifying on each call

Let's say my Server is both Authorization Server and Resource server My Client (for example mobile app) can authenticate in 2 matters: via Resource Owner Password Credentials Grant via ...
user avatar
  • 227
4 votes
0 answers
98 views

Adding new service to authenticated website

So I've created an API that I want to leverage to add some functionality to an existing web app. My current website authenticates users using SAML. What I'm looking to do is instead of moving the code ...
user avatar
3 votes
0 answers
229 views

Architecture and Security in a Web/Native app while generating PDFs

I am trying to make a system where a user can view/download his statements (say salary slips). The user will have ability to download PDF versions of these statements and can also save them to Google ...
user avatar
3 votes
0 answers
1k views

DDD problem with aggregate design (users, authentication)

We're having a bounded context dealing with payments. I'm trying to model case, where Merchant can create another merchant and inherit some of its properties in this case: users that are needed for ...
user avatar
  • 217
3 votes
0 answers
1k views

Single sign-on flow using ASP.NET MVC + Active Directory

I'm looking into creating a single-sign-on portal built in ASP.NET MVC. This single sign on portal should give users the option to sign in with their individual account (which should be verified ...
user avatar
3 votes
0 answers
103 views

How do I authenticate users from facebook/twitter?

I need to build a site for a mobile app that allows users to sign in with facebook/twitter or sign up as a new user (traditional username/password). No matter which method the user chooses, they ...
user avatar
  • 319
2 votes
0 answers
413 views

How to retrieve login token from repository in network layer? Domain Driven Design - DDD

I am trying to come up with a design for an application I am working on. Here is a basic picture of what I am looking to do. Everything up to the Data Layer is totally fine but the Data Layer makes ...
user avatar
2 votes
0 answers
23 views

Design REST API for Mobile Apps with Unregister Users

I'd like to know some best practices on how to build rest API for a backend which shall communicate with a mobile app by anonymous users. This is the scenario with details: I'm building a demo library ...
user avatar
  • 29
2 votes
0 answers
500 views

Biometric authentication with back-end verification service process

I am working on an application where I will be using Android and iOS biometric authentication. Coding the use of biometrics on the devices, including prompting and determining whether or not the user ...
user avatar
  • 121
2 votes
1 answer
192 views

Chaining openID token

I'm working in microservices environment, where each service authenticates using OpenID Connect to an authentication service (local IdP), based on Users I keep locally on my Database. Now, I want ...
user avatar
  • 79
2 votes
0 answers
33 views

How authorize web application and manage sessions

i am building a single page react app that uses redux as state manager and an express node js as backend server but i don't know what is the best way to authorize my users in the application! if it ...
user avatar
  • 129
2 votes
0 answers
33 views

Architecting OAuth2 Flow With an API and Static JS Client

I'm building a very security conscious application. (All applications should be security conscious, but this one may contain a lot of red data). Assuming that I will use a Vue/React JavaScript Single ...
user avatar
2 votes
0 answers
34 views

OAuth2 - client_credentials

I am in the process of building out a private REST API. This API is intended for machine to machine communication. In short someone else's server will kick off a job via CRON that pulls information ...
user avatar
  • 121
1 vote
0 answers
61 views

What is the benefit of performing authn/authz at the API gateway instead of at the service?

I want to know is if we should perform authentication at the API gateway, at the individual service, or both. Let's frame this question and descussion in the context of new development. Specifically, ...
user avatar
  • 239
1 vote
1 answer
380 views

Securing API with JWT and elevated access using MFA

At my company we have a central auth server running IdentityServer. There are a number of applications providing some API to client applications. API requests are authenticated with JWT tokens issued ...
user avatar
  • 119
1 vote
0 answers
36 views

Building an app+backend with extraneous functionality for an existing web shop. How to handle authentication on the backend?

This is an architecture question as I've been asked by an existing web store to build a mobile app (they don't have a mobile app) that provides extra functionality to the store, a web admin panel to ...
user avatar
  • 19
1 vote
0 answers
89 views

Reactjs + nodejs external authentication flow

I am developing a RESTful application with nodejs in the backend with express.js as middleware. I am also developing a client in Reactjs. I want to use an external authentication service (LDAP/AD/ADFS)...
user avatar
  • 111
1 vote
0 answers
68 views

Best Way To Store Password & JWT on Mobile

I have a Flutter and Angular application that previously used Firebase, but for various reasons I'm working on switching it over to my own RESTful API with ExpressJS. One topic I'm a little confused ...
user avatar
  • 127
1 vote
0 answers
71 views

How does Google Analytics prevent tampering?

I'm building a simplified web tracker as a side project. One of the things I'm unsure about these cloud-based trackers (like Google Analytics) is how they prevent abuse of their platform; in other ...
user avatar
  • 421
1 vote
0 answers
22 views

Defining custom OIDC provider with delegating authentication to another OIDC provider and using own authorization database

I wanted to ask about your ideas on how to solve the problem that I have to solve in my application (App1). This is the classic Fronted + Backend (Angular + Java EE) application to which I am ...
user avatar
  • 111
1 vote
0 answers
88 views

Using Azure AD MSAL as only authentication solution for SPA

I have an Angular SPA and I spun up my own basic form-based authentication using a .net core web API and SQL server to store user accounts / hashed and salted credentials. This is obviously not an ...
user avatar
  • 111
1 vote
0 answers
45 views

Handling 3rd party OAuth2 tokens

After some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd ...
user avatar
  • 111
1 vote
1 answer
149 views

Using Django Sessions when views are accessed by API

I'm making an app which is a Django backend and a React frontend (being developed by someone else). The plan currently is to fully decouple the two and have them communicate over API. However, I would ...
user avatar
  • 197
1 vote
0 answers
81 views

Grant type/flow to use for multitenant application

Let's image we have a multitenant(organization) application having a separate database per tenant(organization). The core of the application is a REST api service protected by an authorization ...
user avatar
  • 11
1 vote
0 answers
392 views

ACL entity and microservices database relations

I would like to build a microservices architecture to handle the following scenario: I have a building. The building has some kinds of devices. And the devices can be used by the users. In the system, ...
user avatar
1 vote
0 answers
74 views

How to solve circular dependency scenario while executing http calls which require authentication?

I am working on a project which requires me to execute standard HTTP calls with session tokens. I am building a custom HTTP client, with a custom authenticator, something like this: Client client = ...
user avatar
1 vote
0 answers
82 views

Single Sign On implementation for CMS

This is a general question seeking guidance for the best practice(s) on implementing a Single Sign On (SSO) across many various installations of the same application. The hypothetical example I would ...
user avatar
  • 19
1 vote
0 answers
57 views

Client synchronization of authentication tokens in parallel connections

In my app server's authentication implementation, an authentication token is generated for every user that has logged in. According to some highly recommended security tips (Implementing Secure User ...
user avatar
  • 111
1 vote
0 answers
275 views

User registration web service

I'm planning on making a web app that'll use MySQL as the database, Java/Grails as the backend and JavaScript/VueJS as the frontend and then they'll communicate using only RESTful JSON APIs (that way ...
user avatar
1 vote
0 answers
151 views

'HMAC style' design example for a shared secret

I'm looking to secure an API based on a shared key and a given username and datetime. The API gives access to trusted third parties and does not require the input from a user in order to access their ...
user avatar
  • 151
1 vote
1 answer
736 views

OAuthv2 access tokens and resource servers

In the OAuthv2 authorization grant, a “client app” authenticates itself against an “auth server”, and receives an “access token” for accessing resources living on a “resource server”. My concerns: ...
user avatar
  • 4,680
1 vote
0 answers
351 views

Validating time-limited HMACs

I'm exploring using HMAC style secret-key authentication with timestamp expiry, but am struggling to get my head around how you validate the timestamp portion. On the client side you would do: ...
user avatar
  • 111
1 vote
0 answers
138 views

How to evaluate Secure Authorization for server to client

I have a customer that wants me to build a web portal (Asp.net 4.0) that will communicate with a desktop client, tablet and/or smart phone (e.g. iOS and/or Android). I was thinking of using oAuth 2....
user avatar
  • 235
1 vote
1 answer
2k views

How to support anonymous user in web application?

I work for a publishing company that also provides content distribution to their users. In order to access a piece of content the user must be entitled to do so. Traditionally this authorization check ...
user avatar
  • 27
1 vote
1 answer
943 views

Multiple app authentication, universal user login, best practice

Please see the below diagram. There are two apps that each have a different set of functions, User A is a user of App1 and User B is a user of App2. They should not be able to log in directly to the ...
user avatar
0 votes
0 answers
31 views

What is the right way to update claims in identity-server 4 from Angular

I have a multitenant application where a user can belong to multiple tenants. I'm using Identity-Server 4 for the authentication. I have two applications Angular and API. When a user is not ...
user avatar
  • 109
0 votes
0 answers
26 views

Preferred way to handle authentication in a microservice architecture

I have a dummy application that serves tickets separated in two apps and a database. One app is the backend app, it knows only JSON and serves a port in a specific container locally. It handles ...
user avatar
  • 2,021
0 votes
0 answers
48 views

How to authenticate client and user

I could use some feedback on designing a solution for handling two OAuth flows in a single request. I have an API that currently supports OAuth2.0 (for users). It was requested that we should be able ...
user avatar
0 votes
0 answers
16 views

Whats the common "flow" for authentication using ADFS and OpenId Connect when building an API?

Im trying to "grasp" how a user should authenticate to our API. Our API is setup to use OpenID Connect thats issued by an ADFS-server. However.. as a "consumer" of our application, ...
user avatar
  • 203
0 votes
0 answers
172 views

Best practice architecture to implement Spotify Auth for a Flutter frontend app and Node.js backend?

I am currently building an application that uses the Spotify API to work with a user's playlists. My frontend is a Flutter app, which is connected to the backend, that is built with Node.js. Currently ...
user avatar
0 votes
0 answers
33 views

How do I use OAuth2 for user management and authentication in my application?

I'm building an application where I want to be able to create and authenticate users using Discord and OAuth2. The reasons are: The application can be considered a "companion" app to a ...
user avatar
  • 101
0 votes
0 answers
45 views

Multitenet architecture with AWS cognito

I want to build a multi-tenant application with AWS Cognito. One user can belong to many tenants and they can have different roles in each tenant. Each tenant will have resources like S3 buckets and ...
user avatar
  • 101
0 votes
0 answers
27 views

Securing an API in production with Spring Security

At work I have to develop an API that queries data from a Hbase Cluster. They asked me to implement basic authentication in order to secure this API. The use case is very simple. For the moment we ...
user avatar