Questions tagged [authentication]
Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.
416
questions
134
votes
7
answers
20k
views
Are private, unguessable URLs equivalent to password-based authentication?
I want to expose a resource on the web. I want to protect this resource: to make sure it is only accessible to certain individuals.
I could set up some kind of password-based authentication. For ...
- 2,629
99
votes
8
answers
66k
views
Is browser fingerprinting a viable technique for identifying anonymous users?
Is browser fingerprinting a sufficient method for uniquely identifying anonymous users? What if you incorporate biometric data like mouse gestures or typing patterns?
The other day I ran into the ...
- 1,093
38
votes
1
answer
41k
views
Where to place an API key: a custom HTTP header VS the Authorization header with a custom scheme
I'm designing a REST API using authorization/authentication via an API Key.
I tried to figure out what is the best place for it and found out that many people suggest using a custom HTTP header such ...
- 491
34
votes
2
answers
20k
views
Cookie-based vs Session vs Token-based vs Claims-based authentications
I have read about authentications and become confusing about types classification.
Let's start from Cookie-based authentication, If I understand it right, the key point is that all data, needed for ...
- 449
34
votes
3
answers
16k
views
JSON Web Token - why is the payload public?
I can't understand the reasoning for making the claims/payload of a JWT publicly visible after base64 decoding it.
Why?
It seems like it'd be much more useful to have it encrypted with the secret.
...
- 451
24
votes
4
answers
7k
views
How should I architect a RESTful webservice to use 3rd party (i.e. Google, Facebook, Twitter) for authentication?
For my job we have a nice RESTful webservice we've built out that we use to drive a couple websites we have. Basically the webservice lets you create and work with support tickets, and the website is ...
- 373
23
votes
3
answers
17k
views
Is it bad practice to store a user's email address in a JWT?
I'm using JWTs for user auth in a web application. I have a user db where each user's unique ID is their email address. To identify the subject of the JWT, I currently have a claim which stores the ...
- 401
23
votes
2
answers
17k
views
Share private SSH keys with Bash on Windows
I have Windows 10 with Git installed. This Git uses my C:/Users/MyName dir as the HOME directory and the /.ssh/ dir within, appropriately for sourcing my private SSH keys.
I have just enabled and ...
- 595
21
votes
2
answers
18k
views
Should I store my user claims in the JWT token?
I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure.
I cannot makeup my mind as to whether ...
- 313
20
votes
9
answers
8k
views
Is this scenario an exception to the rule of never storing passwords in plaintext?
I am making a full-stack web application for a professor. At his request, the passwords and usernames are generated programmatically, and they cannot be changed or reset by the students. (If you ...
- 359
20
votes
1
answer
20k
views
Difference between 'aud' and 'iss' in jwt
I want to implement a more robust authentication service and jwt is a big part of what I want to do, and I understand how to write the code, but I'm having a little trouble understanding the ...
- 381
20
votes
2
answers
16k
views
REST API security: HMAC/key hashing vs JWT
I just read this article that is a few years old but describes a clever way of securing your REST APIs. Essentially:
Each client has a unique public/private key pair
Only the client and the server ...
- 4,830
18
votes
9
answers
5k
views
Authentication and authorisation for people with intellectual disabilities
Currently, I'm involved in a research project in which we are evaluating an existing web environment providing a safe online playground for children/adolescents with intellectual disabilities. Certain ...
- 349
18
votes
3
answers
30k
views
Handling token renewal / session expiration in a RESTful API
I'm building a RESTful API that uses JWT tokens for user authentication (issued by a login endpoint and sent in all headers afterwards), and the tokens need to be refreshed after a fixed amount of ...
- 345
17
votes
5
answers
10k
views
Authorization and authentication system for microservices and consumers
We plan to refactor our company system into a micro-service based system. This micro-services will be used by our own internal company applications and by 3rd party partners if needed. One for booking,...
- 545
17
votes
2
answers
13k
views
How should an API use http basic authentication
When an API requires that a client authenticates to it, i've seen two different scenarios used and I am wondering which case I should use for my situation.
Example 1. An API is offered by a company ...
- 331
16
votes
2
answers
8k
views
Should I specify the userId in the REST URL structure?
Basically, one feature of my app is to retrieve the logged user's friends.
Actually, I hesitate between both kind of endpoints:
GET /api/users/friends
GET /api/users/:userId/friends
Using 1, ...
- 3,858
16
votes
1
answer
14k
views
Authenticate native mobile app using a REST API
I'm starting a new project soon, which is targeting mobile application for all major mobile platforms (iOS, Android, Windows). It will be a client-server architecture.
The app is both informational ...
- 1,497
16
votes
3
answers
15k
views
Web Authentication using PKI Certs
I understand PKI reasonably well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of ...
- 441
14
votes
7
answers
8k
views
How to architect user authentication from client applications?
I've been developing an application which will support many users. The thing is I'm unable to figure out, how to authenticate the client/user.
I'm building an app like http://quickblox.com/ where I'...
- 193
13
votes
2
answers
20k
views
Best way to hide API key in source code
I need some ideas on how to protect a private API key in an application, specifically in a c# .NET application.
Firstly, I understand that it is theoretically impossible to hide anything in the ...
- 233
13
votes
5
answers
10k
views
Best practices for web application Authentication/Security (Any Platform)
I got a question today from my manager asking me my thoughts on what is considered an acceptable design for authentication of a web form application, especially in regards to the nature of many ...
- 26.4k
12
votes
4
answers
888
views
Am I Over-Engineering If I Consider User's Intentional Wrongdoing?
Is it over-engineering if I add protection against a user's intentional wrongdoing (to put it mildly), if the harm the user can incur is not related to my code?
To clarify, I'm exposing a simple JSON ...
- 515
12
votes
2
answers
13k
views
cookie vs. session vs jwt
I am reading up on authentication/authorization in web applications. Could anybody confirm/correct my current knowledge?
Cookies: in their early version, a text file with a unique client Id an all ...
- 231
12
votes
1
answer
8k
views
Caching authenticated requests for all users
I am working on a web app that must deal with very large impulses of simultaneous users, who need to be authorized, to request identical content. In its current state, it's totally crippling to even a ...
- 223
12
votes
3
answers
11k
views
Should access permissions and roles be included in payload of JWT?
Should information about the permissions and roles of the client be included in JWT?
Having such information in JWT token will be very helpful as everytime a valid token comes, it would be easier to ...
- 365
12
votes
1
answer
4k
views
Microservice Architecture - using Auth Server as a User Resource server
I'm designing an application based on microservices architecture,
In this application I will need Auth microservice,
Also I will need to store some extra User information such as, perhaps, multiple ...
- 231
11
votes
7
answers
6k
views
Will Authentication over HTTPS Slow My Application?
I am building a web application and RESTful web service.
I have been reading various articles about the best way to authenticate the requests to the web service.
The best option for me seems to be ...
- 3,085
11
votes
2
answers
18k
views
Custom use of Authorization header in a REST API
I'm building a REST api where clients are authenticated using client certificates. A client in this case is not an individual user, but some sort of a presentation layer. Users are authenticated using ...
- 227
11
votes
2
answers
5k
views
Designing authentication for REST API
I'm working up an API for a REST service that I'm going to both be producing and consuming. I've spent the past few days trying to figure out how to handle authentication nicely, and think I've ...
- 211
11
votes
2
answers
1k
views
Should an SPA use OIDC's Implicit flow or Auth Code flow?
We are developing a new Angular SPA which leverages Keycloak for its SSO abilities using OpenID Connect (OIDC). The app is currently designed to use the Implicit flow to retrieve short-lived access ...
- 1,229
10
votes
2
answers
6k
views
Auth options for distributed systems
I am in the process of designing 3 components that will work in symphony with one another:
A RESTful web service which requires BasicAuth over HTTPS on all calls, and which is what actually does all ...
- 4,830
9
votes
3
answers
3k
views
What is the best policy for allowing clients to change email?
We are developing a web application with a fairly standard registration process which requires a client/user to verify their email address before they are allowed to use the site. The site also ...
- 223
9
votes
2
answers
3k
views
Enterprise patterns for JWT authentication for REST-based application?
The JWT specification describes only the payload and how it is sent, but leaves authentication protocol open, which allows the flexibility, but quite unfortunately, flexibility can lead to ...
user253752
9
votes
1
answer
610
views
Facebook authentication with an Authoritative Server for a Flash Game
I'm working on a multiplatform game in Flash. This game utilizes Photon Server for authoritative physics and user statistics tracking. I'm looking to leverage Facebook authentication as an alternative ...
- 264
8
votes
3
answers
13k
views
Authentication and authorization - front-end vs back-end dilemma
I'm working on centralized authentication and authorization API system and got stuck in front-end vs back-end dilemma.
Front-end person is telling that should to have only one request to that API to ...
- 329
8
votes
1
answer
18k
views
RESTful API with session tokens.. ehh?
After looking at a lot of session/state debates with regard to REST and finding nothing concrete, I'm just going to cut to the chase and ask myself.
Developing a RESTful API as a backend for a mobile ...
- 191
8
votes
2
answers
265
views
Implementation of single authentication point
I am building a series of web apps connected to a single point of authentication. Basically, a user tries to access a site, if not authenticated they are redirected to the central auth system's login ...
- 1,066
8
votes
1
answer
4k
views
Token-based authentication using access and refresh tokens
I am implementing a token-based authentication system for a REST API using a short-lived access token and a long-lived refresh token. This is an abstract overview of the relevant API endpoints (HTTPS ...
- 181
8
votes
2
answers
997
views
Is this solution RESTful and secure?
Our product registers new players on our service, and we've chosen to host it on Azure (we're using .NET) and we wanted it to be stateless (for scalability) and relatively secure.
Since this is the ...
- 183
8
votes
3
answers
384
views
Authentication via tokens
I'm relatively new to jwt.io and authentication and I'm using JWT.io in following manner.
Server Side
Once user logs in, I generate a token with userid embedded inside and pass it back to the user ...
- 241
7
votes
4
answers
106k
views
Can one determine the creation date of an email account?
Is it possible to determine the creation date of the mail account for the address supplied within the authentication process flow; Or at least determine that the mail account was/was not created the ...
- 109
7
votes
1
answer
3k
views
is "ASP.NET Membership" still a good choice for ASP.NET MVC authentication nowdays?
The last time I used asp.net 4 years ago, the "ASP.Net Membership provider" was the best way to do user authentication in an ASP.Net application.
Nowadays, is using the "ASP.Net Membership provider" ...
- 405
7
votes
2
answers
6k
views
What is the correct way to implement Auth/ACL in MVC?
I am looking into making a correctly laid out MVC Auth/ACL system. I think I want the authentication of a user (and the session handling) to be separate from the ACL system. (I don't know why but this ...
- 171
7
votes
1
answer
2k
views
Multiple SSH keys for different organizations
I can see that GitHub allows you to have multiple mail account and associate every organization you are part of with a different address.
Can this be done also for SSH keys?
What I would like to do ...
- 175
7
votes
2
answers
3k
views
Authentication setup advice for web app and its backend API
I am fairly new to web development, and I am learning to build web applications. I am facing a problem figuring out how to set up authentication mechanisms for a multi-user application. Let me provide ...
- 179
7
votes
1
answer
1k
views
Is this a correct JWT authentication implementation?
I've created a Flask RESTful API which requires an email / password and Facebook login flow. This will probably need to be extended in the future to support more social logins.
I've chosen to ...
- 1,409
6
votes
2
answers
6k
views
Security in Authentication in single page apps
What's the most secure method of performing authentication in a single paged apps? I'm not talking about any specific client-side or server-side frameworks, but just general guidelines or best ...
- 1,896
6
votes
3
answers
1k
views
How do you handle JWT expiration for long running calls?
Currently we are debating over securing our multiple micro-services.
The major concern is that the JWT token provided to us will expire before the call is finished. (This is in the synchronous design)
...
- 69
6
votes
3
answers
568
views
Multi platform password storage with retrieval for applications with authorization?
I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use.
Are ...
- 373