Questions tagged [authentication]

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

75 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
10 votes
1 answer
649 views

Facebook authentication with an Authoritative Server for a Flash Game

I'm working on a multiplatform game in Flash. This game utilizes Photon Server for authoritative physics and user statistics tracking. I'm looking to leverage Facebook authentication as an alternative ...
Kody Manharth's user avatar
6 votes
0 answers
243 views

Is it possible to use a reverse proxy authentication in a native mobile app

We have a few backend services that our frontend SPAs fetch data from. Right now, the SPAs use JS libraries to authenticate with the Auth server (Azure AD) which returns a JWT which is validated by my ...
Sayak Mukhopadhyay's user avatar
4 votes
0 answers
228 views

How to authenticate third-party callbacks that don't support authentication

I'm working on a project that integrates with a third-party service via API, and the third-party uses callbacks to update us on the status of the operations being performed. These callbacks can be hit ...
Omar Rida's user avatar
4 votes
0 answers
165 views

Client Browser, Node Server, Web API auth structure

I have a web API that accepts Authorization headers to allow access. It responds with the requested data in addition to setting a session cookie. Subsequent requests can be made with no auth headers ...
thedarklord47's user avatar
4 votes
0 answers
114 views

Architecting an account system for oauth that bridges a new and legacy system

So this question is specific to implementing auth in our system but I'm looking for high-level (just the architecture) solution or advice on which direction to head towards. Overview (TL;DR) Our ...
Matt Foxx Duncan's user avatar
4 votes
0 answers
362 views

Global Accounts in Multi-Tenant Authorization System

Our system is fundamentally a multi-tenant setup, where each client maintains a separate database with its own data and users. The authentication system on login issues an authentication token which ...
moberemk's user avatar
  • 473
4 votes
0 answers
836 views

Oauth 2 store access token vs verifying on each call

Let's say my Server is both Authorization Server and Resource server My Client (for example mobile app) can authenticate in 2 matters: via Resource Owner Password Credentials Grant via ...
royB's user avatar
  • 227
4 votes
0 answers
98 views

Adding new service to authenticated website

So I've created an API that I want to leverage to add some functionality to an existing web app. My current website authenticates users using SAML. What I'm looking to do is instead of moving the code ...
ThrowsException's user avatar
3 votes
0 answers
251 views

Architecture and Security in a Web/Native app while generating PDFs

I am trying to make a system where a user can view/download his statements (say salary slips). The user will have ability to download PDF versions of these statements and can also save them to Google ...
fullstackdev's user avatar
3 votes
0 answers
1k views

DDD problem with aggregate design (users, authentication)

We're having a bounded context dealing with payments. I'm trying to model case, where Merchant can create another merchant and inherit some of its properties in this case: users that are needed for ...
Slimer's user avatar
  • 217
3 votes
0 answers
1k views

Single sign-on flow using ASP.NET MVC + Active Directory

I'm looking into creating a single-sign-on portal built in ASP.NET MVC. This single sign on portal should give users the option to sign in with their individual account (which should be verified ...
Steven Thewissen's user avatar
3 votes
0 answers
103 views

How do I authenticate users from facebook/twitter?

I need to build a site for a mobile app that allows users to sign in with facebook/twitter or sign up as a new user (traditional username/password). No matter which method the user chooses, they ...
resting's user avatar
  • 319
2 votes
0 answers
585 views

How to retrieve login token from repository in network layer? Domain Driven Design - DDD

I am trying to come up with a design for an application I am working on. Here is a basic picture of what I am looking to do. Everything up to the Data Layer is totally fine but the Data Layer makes ...
Muhand Jumah's user avatar
2 votes
0 answers
27 views

Design REST API for Mobile Apps with Unregister Users

I'd like to know some best practices on how to build rest API for a backend which shall communicate with a mobile app by anonymous users. This is the scenario with details: I'm building a demo library ...
Aulin's user avatar
  • 29
2 votes
0 answers
937 views

Biometric authentication with back-end verification service process

I am working on an application where I will be using Android and iOS biometric authentication. Coding the use of biometrics on the devices, including prompting and determining whether or not the user ...
el n00b's user avatar
  • 121
2 votes
0 answers
211 views

Using Azure AD MSAL as only authentication solution for SPA

I have an Angular SPA and I spun up my own basic form-based authentication using a .net core web API and SQL server to store user accounts / hashed and salted credentials. This is obviously not an ...
CAlex's user avatar
  • 121
2 votes
1 answer
278 views

Using Django Sessions when views are accessed by API

I'm making an app which is a Django backend and a React frontend (being developed by someone else). The plan currently is to fully decouple the two and have them communicate over API. However, I would ...
Neil's user avatar
  • 219
2 votes
0 answers
43 views

How authorize web application and manage sessions

i am building a single page react app that uses redux as state manager and an express node js as backend server but i don't know what is the best way to authorize my users in the application! if it ...
amin msh's user avatar
  • 129
2 votes
0 answers
42 views

Architecting OAuth2 Flow With an API and Static JS Client

I'm building a very security conscious application. (All applications should be security conscious, but this one may contain a lot of red data). Assuming that I will use a Vue/React JavaScript Single ...
user974407's user avatar
2 votes
0 answers
34 views

OAuth2 - client_credentials

I am in the process of building out a private REST API. This API is intended for machine to machine communication. In short someone else's server will kick off a job via CRON that pulls information ...
Freddy's user avatar
  • 121
1 vote
0 answers
44 views

How to merge SQL Server database authentication with firebase authentication?

I have Firebase connected to my web app and users can authenticate using the 'microsoft' provider. The provider only allows authenticating with the active directory tenant that I specified in my ...
Clay Casper's user avatar
1 vote
0 answers
130 views

OpenID Connect and User Management Best Practices

Currently my company has 2 applications that use Identity Server for SSO. Not every client we have uses both applications but some do. The part I'm uneasy about is that both apps have a user ...
Brad Firesheets's user avatar
1 vote
0 answers
882 views

Authorization using Azure AD B2C access tokens in Python / Flask

TLDR: I am trying to validate a Azure AD B2C access token in my Flask web API use scopes from that access token to authorize calling protected resources use timely and secure solutions such as PKCE ...
linus's user avatar
  • 121
1 vote
0 answers
164 views

What is the benefit of performing authn/authz at the API gateway instead of at the service?

I want to know is if we should perform authentication at the API gateway, at the individual service, or both. Let's frame this question and descussion in the context of new development. Specifically, ...
Mike G's user avatar
  • 239
1 vote
0 answers
337 views

Providing guest users with full accounts vs only sessions (a.k.a. guest checkout)

I'm working on a web application with JWT authentication (with token stored in cookie) and an SQL database. Upon loading, the frontend makes a request to the backend to determine whether the user is ...
Kris's user avatar
  • 111
1 vote
0 answers
287 views

How to authenticate an API in a headless web-app?

For learning purposes, I'm trying to build an Expense Tracker web-app from scratch. I'm in the process of designing it before coding it. I decided to attempt to make it a Headless Web-app: The main ...
Sir Code-A-Lot's user avatar
1 vote
1 answer
975 views

Securing API with JWT and elevated access using MFA

At my company we have a central auth server running IdentityServer. There are a number of applications providing some API to client applications. API requests are authenticated with JWT tokens issued ...
abdusco's user avatar
  • 119
1 vote
0 answers
44 views

Building an app+backend with extraneous functionality for an existing web shop. How to handle authentication on the backend?

This is an architecture question as I've been asked by an existing web store to build a mobile app (they don't have a mobile app) that provides extra functionality to the store, a web admin panel to ...
BobRoy's user avatar
  • 19
1 vote
0 answers
108 views

Reactjs + nodejs external authentication flow

I am developing a RESTful application with nodejs in the backend with express.js as middleware. I am also developing a client in Reactjs. I want to use an external authentication service (LDAP/AD/ADFS)...
cervyvin's user avatar
  • 111
1 vote
0 answers
164 views

Best Way To Store Password & JWT on Mobile

I have a Flutter and Angular application that previously used Firebase, but for various reasons I'm working on switching it over to my own RESTful API with ExpressJS. One topic I'm a little confused ...
Gabe's user avatar
  • 127
1 vote
0 answers
130 views

How does Google Analytics prevent tampering?

I'm building a simplified web tracker as a side project. One of the things I'm unsure about these cloud-based trackers (like Google Analytics) is how they prevent abuse of their platform; in other ...
Leo Brito's user avatar
  • 421
1 vote
0 answers
48 views

Defining custom OIDC provider with delegating authentication to another OIDC provider and using own authorization database

I wanted to ask about your ideas on how to solve the problem that I have to solve in my application (App1). This is the classic Fronted + Backend (Angular + Java EE) application to which I am ...
PeterB's user avatar
  • 111
1 vote
0 answers
67 views

Handling 3rd party OAuth2 tokens

After some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd ...
johannesp's user avatar
  • 111
1 vote
0 answers
98 views

Grant type/flow to use for multitenant application

Let's image we have a multitenant(organization) application having a separate database per tenant(organization). The core of the application is a REST api service protected by an authorization ...
Ivaylo's user avatar
  • 111
1 vote
0 answers
438 views

ACL entity and microservices database relations

I would like to build a microservices architecture to handle the following scenario: I have a building. The building has some kinds of devices. And the devices can be used by the users. In the system, ...
michalk93's user avatar
1 vote
0 answers
2k views

How to support anonymous user in web application?

I work for a publishing company that also provides content distribution to their users. In order to access a piece of content the user must be entitled to do so. Traditionally this authorization check ...
Leandro's user avatar
  • 27
1 vote
2 answers
505 views

Handling Authentication with both Web App and API

Not sure how to handle this. Our current app (.Net MVC) is accessed via companyname.appname.com, authentication is handled via forms (cookie) authentication. Within the app there is a global search ...
Gaz's user avatar
  • 159
1 vote
0 answers
80 views

How to solve circular dependency scenario while executing http calls which require authentication?

I am working on a project which requires me to execute standard HTTP calls with session tokens. I am building a custom HTTP client, with a custom authenticator, something like this: Client client = ...
lazyloader's user avatar
1 vote
0 answers
87 views

Single Sign On implementation for CMS

This is a general question seeking guidance for the best practice(s) on implementing a Single Sign On (SSO) across many various installations of the same application. The hypothetical example I would ...
sudoyum's user avatar
  • 19
1 vote
0 answers
97 views

Client synchronization of authentication tokens in parallel connections

In my app server's authentication implementation, an authentication token is generated for every user that has logged in. According to some highly recommended security tips (Implementing Secure User ...
Shreck Ye's user avatar
  • 111
1 vote
0 answers
280 views

User registration web service

I'm planning on making a web app that'll use MySQL as the database, Java/Grails as the backend and JavaScript/VueJS as the frontend and then they'll communicate using only RESTful JSON APIs (that way ...
SeriousLee's user avatar
1 vote
0 answers
155 views

'HMAC style' design example for a shared secret

I'm looking to secure an API based on a shared key and a given username and datetime. The API gives access to trusted third parties and does not require the input from a user in order to access their ...
Rebecca's user avatar
  • 151
1 vote
0 answers
473 views

Validating time-limited HMACs

I'm exploring using HMAC style secret-key authentication with timestamp expiry, but am struggling to get my head around how you validate the timestamp portion. On the client side you would do: ...
kez's user avatar
  • 111
1 vote
0 answers
138 views

How to evaluate Secure Authorization for server to client

I have a customer that wants me to build a web portal (Asp.net 4.0) that will communicate with a desktop client, tablet and/or smart phone (e.g. iOS and/or Android). I was thinking of using oAuth 2....
PhillyNJ's user avatar
  • 235
1 vote
1 answer
1k views

Multiple app authentication, universal user login, best practice

Please see the below diagram. There are two apps that each have a different set of functions, User A is a user of App1 and User B is a user of App2. They should not be able to log in directly to the ...
user3323052's user avatar
0 votes
0 answers
29 views

Designing a restful API for a desktop application to facilitate communication with other APIs

Just for some context, I am a CS student in my second-year who is working on a C++ desktop application (using the Qt framework) made by an engineering professor. The application is an educational tool ...
Johnny's user avatar
  • 1
0 votes
0 answers
31 views

Passing JWTs securely back to the mobile app frontend after signing in with Google OAuth2

I have a server(API) written in Flask and a client(mobile app) written in React Native. The application allows for logging in with either email/password OR with Google. The Google authentication flow ...
Cristian Gira's user avatar
0 votes
0 answers
59 views

Securely Handling Session Keys in Excel for API Authentication

I'm working on an Excel tool that needs to synchronize with a CRM via its API. The CRM's API authentication process involves logging in with a username and password, after which a session key is ...
Alon Cohen's user avatar
0 votes
0 answers
47 views

How to handle roles and scopes using oauth2 auth flow

I'm using python and fastapi with oauth2 flow (just for clarification as the question isn't language specific). I'm confused on how to implement scopes in an efficient and secure way. I was thinking ...
Gabriel Macus's user avatar
0 votes
0 answers
30 views

Per Request Authorization using Facebook Login

Stack: ASP.NET Core + Razor + SQLite TLDR: How do I rely solely on Facebook Login for authorization? I am building an app with sole integration to Facebook for my Facebook group. Essentially it is a &...
Zathura's user avatar