Questions tagged [authentication]
Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.
74
questions with no upvoted or accepted answers
9
votes
1
answer
577
views
Facebook authentication with an Authoritative Server for a Flash Game
I'm working on a multiplatform game in Flash. This game utilizes Photon Server for authoritative physics and user statistics tracking. I'm looking to leverage Facebook authentication as an alternative ...
- 264
5
votes
0
answers
182
views
Is it possible to use a reverse proxy authentication in a native mobile app
We have a few backend services that our frontend SPAs fetch data from. Right now, the SPAs use JS libraries to authenticate with the Auth server (Azure AD) which returns a JWT which is validated by my ...
4
votes
0
answers
202
views
How to authenticate third-party callbacks that don't support authentication
I'm working on a project that integrates with a third-party service via API, and the third-party uses callbacks to update us on the status of the operations being performed. These callbacks can be hit ...
- 49
4
votes
0
answers
165
views
Client Browser, Node Server, Web API auth structure
I have a web API that accepts Authorization headers to allow access. It responds with the requested data in addition to setting a session cookie. Subsequent requests can be made with no auth headers ...
- 141
4
votes
0
answers
112
views
Architecting an account system for oauth that bridges a new and legacy system
So this question is specific to implementing auth in our system but I'm looking for high-level (just the architecture) solution or advice on which direction to head towards.
Overview (TL;DR)
Our ...
- 203
4
votes
0
answers
357
views
Global Accounts in Multi-Tenant Authorization System
Our system is fundamentally a multi-tenant setup, where each client maintains a separate database with its own data and users. The authentication system on login issues an authentication token which ...
- 473
4
votes
0
answers
835
views
Oauth 2 store access token vs verifying on each call
Let's say my Server is both Authorization Server and Resource server
My Client (for example mobile app) can authenticate in 2 matters:
via Resource Owner Password Credentials Grant
via ...
- 227
4
votes
0
answers
98
views
Adding new service to authenticated website
So I've created an API that I want to leverage to add some functionality to an existing web app. My current website authenticates users using SAML. What I'm looking to do is instead of moving the code ...
- 183
3
votes
0
answers
240
views
Architecture and Security in a Web/Native app while generating PDFs
I am trying to make a system where a user can view/download his statements (say salary slips). The user will have ability to download PDF versions of these statements and can also save them to Google ...
- 39
3
votes
0
answers
1k
views
DDD problem with aggregate design (users, authentication)
We're having a bounded context dealing with payments.
I'm trying to model case, where Merchant can create another merchant and inherit some of its properties in this case: users that are needed for ...
- 217
3
votes
0
answers
1k
views
Single sign-on flow using ASP.NET MVC + Active Directory
I'm looking into creating a single-sign-on portal built in ASP.NET MVC. This single sign on portal should give users the option to sign in with their individual account (which should be verified ...
- 271
3
votes
0
answers
103
views
How do I authenticate users from facebook/twitter?
I need to build a site for a mobile app that allows users to sign in with facebook/twitter or sign up as a new user (traditional username/password).
No matter which method the user chooses, they ...
- 319
2
votes
0
answers
506
views
How to retrieve login token from repository in network layer? Domain Driven Design - DDD
I am trying to come up with a design for an application I am working on.
Here is a basic picture of what I am looking to do. Everything up to the Data Layer is totally fine but the Data Layer makes ...
- 129
2
votes
0
answers
25
views
Design REST API for Mobile Apps with Unregister Users
I'd like to know some best practices on how to build rest API for a backend which shall communicate with a mobile app by anonymous users.
This is the scenario with details:
I'm building a demo library ...
- 29
2
votes
0
answers
685
views
Biometric authentication with back-end verification service process
I am working on an application where I will be using Android and iOS biometric authentication.
Coding the use of biometrics on the devices, including prompting and determining whether or not the user ...
- 121
2
votes
1
answer
224
views
Chaining openID token
I'm working in microservices environment, where each service authenticates using OpenID Connect to an authentication service (local IdP), based on Users I keep locally on my Database.
Now, I want ...
- 79
2
votes
1
answer
217
views
Using Django Sessions when views are accessed by API
I'm making an app which is a Django backend and a React frontend (being developed by someone else). The plan currently is to fully decouple the two and have them communicate over API. However, I would ...
- 209
2
votes
0
answers
37
views
How authorize web application and manage sessions
i am building a single page react app that uses redux as state manager and an express node js as backend server but i don't know what is the best way to authorize my users in the application!
if it ...
- 129
2
votes
0
answers
36
views
Architecting OAuth2 Flow With an API and Static JS Client
I'm building a very security conscious application. (All applications should be security conscious, but this one may contain a lot of red data).
Assuming that I will use a Vue/React JavaScript Single ...
- 211
2
votes
0
answers
34
views
OAuth2 - client_credentials
I am in the process of building out a private REST API. This API is intended for machine to machine communication. In short someone else's server will kick off a job via CRON that pulls information ...
- 121
1
vote
0
answers
322
views
Authorization using Azure AD B2C access tokens in Python / Flask
TLDR:
I am trying to
validate a Azure AD B2C access token in my Flask web API
use scopes from that access token to authorize calling protected resources
use timely and secure solutions such as PKCE ...
- 121
1
vote
0
answers
85
views
What is the benefit of performing authn/authz at the API gateway instead of at the service?
I want to know is if we should perform authentication at the API gateway, at the individual service, or both.
Let's frame this question and descussion in the context of new development. Specifically, ...
- 239
1
vote
0
answers
193
views
Providing guest users with full accounts vs only sessions (a.k.a. guest checkout)
I'm working on a web application with JWT authentication (with token stored in cookie) and an SQL database. Upon loading, the frontend makes a request to the backend to determine whether the user is ...
- 111
1
vote
0
answers
166
views
How to authenticate an API in a headless web-app?
For learning purposes, I'm trying to build an Expense Tracker web-app from scratch. I'm in the process of designing it before coding it. I decided to attempt to make it a Headless Web-app: The main ...
- 59
1
vote
1
answer
542
views
Securing API with JWT and elevated access using MFA
At my company we have a central auth server running IdentityServer. There are a number of applications providing some API to client applications. API requests are authenticated with JWT tokens issued ...
- 119
1
vote
0
answers
40
views
Building an app+backend with extraneous functionality for an existing web shop. How to handle authentication on the backend?
This is an architecture question as I've been asked by an existing web store to build a
mobile app (they don't have a mobile app) that provides extra functionality to the store,
a web admin panel to ...
- 19
1
vote
0
answers
91
views
Reactjs + nodejs external authentication flow
I am developing a RESTful application with nodejs in the backend with express.js as middleware. I am also developing a client in Reactjs.
I want to use an external authentication service (LDAP/AD/ADFS)...
- 111
1
vote
0
answers
76
views
Best Way To Store Password & JWT on Mobile
I have a Flutter and Angular application that previously used Firebase, but for various reasons I'm working on switching it over to my own RESTful API with ExpressJS. One topic I'm a little confused ...
- 127
1
vote
0
answers
95
views
How does Google Analytics prevent tampering?
I'm building a simplified web tracker as a side project.
One of the things I'm unsure about these cloud-based trackers (like Google Analytics) is how they prevent abuse of their platform; in other ...
- 421
1
vote
0
answers
27
views
Defining custom OIDC provider with delegating authentication to another OIDC provider and using own authorization database
I wanted to ask about your ideas on how to solve the problem that I have to solve in my application (App1). This is the classic Fronted + Backend (Angular + Java EE) application to which I am ...
- 111
1
vote
0
answers
122
views
Using Azure AD MSAL as only authentication solution for SPA
I have an Angular SPA and I spun up my own basic form-based authentication using a .net core web API and SQL server to store user accounts / hashed and salted credentials. This is obviously not an ...
- 111
1
vote
0
answers
53
views
Handling 3rd party OAuth2 tokens
After some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd ...
- 111
1
vote
0
answers
90
views
Grant type/flow to use for multitenant application
Let's image we have a multitenant(organization) application having a separate database per tenant(organization).
The core of the application is a REST api service protected by an authorization ...
- 111
1
vote
0
answers
417
views
ACL entity and microservices database relations
I would like to build a microservices architecture to handle the following scenario:
I have a building. The building has some kinds of devices. And the devices can be used by the users. In the system, ...
- 11
1
vote
0
answers
77
views
How to solve circular dependency scenario while executing http calls which require authentication?
I am working on a project which requires me to execute standard HTTP calls with session tokens. I am building a custom HTTP client, with a custom authenticator, something like this:
Client client = ...
- 29
1
vote
0
answers
84
views
Single Sign On implementation for CMS
This is a general question seeking guidance for the best practice(s) on implementing a Single Sign On (SSO) across many various installations of the same application.
The hypothetical example I would ...
- 19
1
vote
0
answers
73
views
Client synchronization of authentication tokens in parallel connections
In my app server's authentication implementation, an authentication token is generated for every user that has logged in. According to some highly recommended security tips (Implementing Secure User ...
- 111
1
vote
0
answers
278
views
User registration web service
I'm planning on making a web app that'll use MySQL as the database, Java/Grails as the backend and JavaScript/VueJS as the frontend and then they'll communicate using only RESTful JSON APIs (that way ...
- 119
1
vote
0
answers
151
views
'HMAC style' design example for a shared secret
I'm looking to secure an API based on a shared key and a given username and datetime. The API gives access to trusted third parties and does not require the input from a user in order to access their ...
- 151
1
vote
1
answer
754
views
OAuthv2 access tokens and resource servers
In the OAuthv2 authorization grant, a “client app” authenticates itself against an “auth server”, and receives an “access token” for accessing resources living on a “resource server”.
My concerns:
...
- 4,790
1
vote
0
answers
423
views
Validating time-limited HMACs
I'm exploring using HMAC style secret-key authentication with timestamp expiry, but am struggling to get my head around how you validate the timestamp portion.
On the client side you would do:
...
- 111
1
vote
0
answers
138
views
How to evaluate Secure Authorization for server to client
I have a customer that wants me to build a web portal (Asp.net 4.0) that will communicate with a desktop client, tablet and/or smart phone (e.g. iOS and/or Android).
I was thinking of using oAuth 2....
- 235
1
vote
1
answer
2k
views
How to support anonymous user in web application?
I work for a publishing company that also provides content distribution to their users. In order to access a piece of content the user must be entitled to do so. Traditionally this authorization check ...
- 27
1
vote
1
answer
1k
views
Multiple app authentication, universal user login, best practice
Please see the below diagram.
There are two apps that each have a different set of functions, User A is a user of App1 and User B is a user of App2. They should not be able to log in directly to the ...
- 11
0
votes
0
answers
40
views
How can I secure the backend in a meaningful way when users log in via OAuth2 in the frontend?
I'm thinking about a rewrite of a existing application. This legacy application does not separate frontend and backend. It's a single application with server side rendering.
I want to rewrite it to a ...
- 121
0
votes
0
answers
25
views
API authentication for iOS applications
I am currently working on my own iOS application and am going to be using a locally developed API for fetching data. I wanted to outline my current account sign-in architecture and verify this is ...
- 17
0
votes
0
answers
46
views
WebApp: How and where to handle an expired authorization with 'back to login'
SituationI have a Single page web app with REST API. When the user logs in, they receive an authorization token. The token which will expire after some time.
When the user tries to make a server ...
- 207
0
votes
0
answers
39
views
Auth0 Middleware Layer Abstraction
I am currently spearheading a project to rearchitect our authentication, and we've signed on with Auth0 as a vendor that will manage the authentication component (for the time being - authorization ...
- 101
0
votes
0
answers
46
views
microservice separate data server auth server an website
I have an API server related to users and employees data with database.
There is another API server for users authentication.
The last one is website client UI with social providers to authenticate ...
0
votes
0
answers
75
views
What is the right way to update claims in identity-server 4 from Angular
I have a multitenant application where a user can belong to multiple tenants. I'm using Identity-Server 4 for the authentication.
I have two applications Angular and API. When a user is not ...
- 109