Questions tagged [authentication]

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

Filter by
Sorted by
Tagged with
132 votes
7 answers
20k views

Are private, unguessable URLs equivalent to password-based authentication?

I want to expose a resource on the web. I want to protect this resource: to make sure it is only accessible to certain individuals. I could set up some kind of password-based authentication. For ...
user avatar
99 votes
8 answers
66k views

Is browser fingerprinting a viable technique for identifying anonymous users?

Is browser fingerprinting a sufficient method for uniquely identifying anonymous users? What if you incorporate biometric data like mouse gestures or typing patterns? The other day I ran into the ...
user avatar
  • 1,093
38 votes
1 answer
39k views

Where to place an API key: a custom HTTP header VS the Authorization header with a custom scheme

I'm designing a REST API using authorization/authentication via an API Key. I tried to figure out what is the best place for it and found out that many people suggest using a custom HTTP header such ...
user avatar
  • 491
34 votes
2 answers
18k views

Cookie-based vs Session vs Token-based vs Claims-based authentications

I have read about authentications and become confusing about types classification. Let's start from Cookie-based authentication, If I understand it right, the key point is that all data, needed for ...
user avatar
  • 449
34 votes
3 answers
15k views

JSON Web Token - why is the payload public?

I can't understand the reasoning for making the claims/payload of a JWT publicly visible after base64 decoding it. Why? It seems like it'd be much more useful to have it encrypted with the secret. ...
user avatar
  • 451
24 votes
4 answers
7k views

How should I architect a RESTful webservice to use 3rd party (i.e. Google, Facebook, Twitter) for authentication?

For my job we have a nice RESTful webservice we've built out that we use to drive a couple websites we have. Basically the webservice lets you create and work with support tickets, and the website is ...
user avatar
23 votes
2 answers
16k views

Share private SSH keys with Bash on Windows

I have Windows 10 with Git installed. This Git uses my C:/Users/MyName dir as the HOME directory and the /.ssh/ dir within, appropriately for sourcing my private SSH keys. I have just enabled and ...
user avatar
  • 595
22 votes
3 answers
13k views

Is it bad practice to store a user's email address in a JWT?

I'm using JWTs for user auth in a web application. I have a user db where each user's unique ID is their email address. To identify the subject of the JWT, I currently have a claim which stores the ...
user avatar
21 votes
2 answers
17k views

Should I store my user claims in the JWT token?

I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure. I cannot makeup my mind as to whether ...
user avatar
20 votes
9 answers
8k views

Is this scenario an exception to the rule of never storing passwords in plaintext?

I am making a full-stack web application for a professor. At his request, the passwords and usernames are generated programmatically, and they cannot be changed or reset by the students. (If you ...
user avatar
  • 359
20 votes
1 answer
17k views

Difference between 'aud' and 'iss' in jwt

I want to implement a more robust authentication service and jwt is a big part of what I want to do, and I understand how to write the code, but I'm having a little trouble understanding the ...
user avatar
19 votes
1 answer
14k views

REST API security: HMAC/key hashing vs JWT

I just read this article that is a few years old but describes a clever way of securing your REST APIs. Essentially: Each client has a unique public/private key pair Only the client and the server ...
user avatar
  • 4,680
18 votes
3 answers
29k views

Handling token renewal / session expiration in a RESTful API

I'm building a RESTful API that uses JWT tokens for user authentication (issued by a login endpoint and sent in all headers afterwards), and the tokens need to be refreshed after a fixed amount of ...
user avatar
17 votes
5 answers
9k views

Authorization and authentication system for microservices and consumers

We plan to refactor our company system into a micro-service based system. This micro-services will be used by our own internal company applications and by 3rd party partners if needed. One for booking,...
user avatar
  • 525
17 votes
2 answers
13k views

How should an API use http basic authentication

When an API requires that a client authenticates to it, i've seen two different scenarios used and I am wondering which case I should use for my situation. Example 1. An API is offered by a company ...
user avatar
16 votes
1 answer
14k views

Authenticate native mobile app using a REST API

I'm starting a new project soon, which is targeting mobile application for all major mobile platforms (iOS, Android, Windows). It will be a client-server architecture. The app is both informational ...
user avatar
  • 1,477
16 votes
3 answers
14k views

Web Authentication using PKI Certs

I understand PKI reasonably well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of ...
user avatar
  • 441
15 votes
2 answers
7k views

Should I specify the userId in the REST URL structure?

Basically, one feature of my app is to retrieve the logged user's friends. Actually, I hesitate between both kind of endpoints: GET /api/users/friends GET /api/users/:userId/friends Using 1, ...
user avatar
  • 3,768
14 votes
7 answers
8k views

How to architect user authentication from client applications?

I've been developing an application which will support many users. The thing is I'm unable to figure out, how to authenticate the client/user. I'm building an app like http://quickblox.com/ where I'...
user avatar
13 votes
5 answers
10k views

Best practices for web application Authentication/Security (Any Platform)

I got a question today from my manager asking me my thoughts on what is considered an acceptable design for authentication of a web form application, especially in regards to the nature of many ...
user avatar
  • 26.3k
12 votes
4 answers
873 views

Am I Over-Engineering If I Consider User's Intentional Wrongdoing?

Is it over-engineering if I add protection against a user's intentional wrongdoing (to put it mildly), if the harm the user can incur is not related to my code? To clarify, I'm exposing a simple JSON ...
user avatar
  • 515
12 votes
2 answers
12k views

cookie vs. session vs jwt

I am reading up on authentication/authorization in web applications. Could anybody confirm/correct my current knowledge? Cookies: in their early version, a text file with a unique client Id an all ...
user avatar
12 votes
2 answers
19k views

Best way to hide API key in source code

I need some ideas on how to protect a private API key in an application, specifically in a c# .NET application. Firstly, I understand that it is theoretically impossible to hide anything in the ...
user avatar
  • 223
12 votes
1 answer
7k views

Caching authenticated requests for all users

I am working on a web app that must deal with very large impulses of simultaneous users, who need to be authorized, to request identical content. In its current state, it's totally crippling to even a ...
user avatar
12 votes
3 answers
10k views

Should access permissions and roles be included in payload of JWT?

Should information about the permissions and roles of the client be included in JWT? Having such information in JWT token will be very helpful as everytime a valid token comes, it would be easier to ...
user avatar
12 votes
1 answer
4k views

Microservice Architecture - using Auth Server as a User Resource server

I'm designing an application based on microservices architecture, In this application I will need Auth microservice, Also I will need to store some extra User information such as, perhaps, multiple ...
user avatar
11 votes
7 answers
5k views

Will Authentication over HTTPS Slow My Application?

I am building a web application and RESTful web service. I have been reading various articles about the best way to authenticate the requests to the web service. The best option for me seems to be ...
user avatar
  • 2,885
11 votes
2 answers
18k views

Custom use of Authorization header in a REST API

I'm building a REST api where clients are authenticated using client certificates. A client in this case is not an individual user, but some sort of a presentation layer. Users are authenticated using ...
user avatar
  • 227
11 votes
2 answers
5k views

Designing authentication for REST API

I'm working up an API for a REST service that I'm going to both be producing and consuming. I've spent the past few days trying to figure out how to handle authentication nicely, and think I've ...
user avatar
11 votes
2 answers
1k views

Should an SPA use OIDC's Implicit flow or Auth Code flow?

We are developing a new Angular SPA which leverages Keycloak for its SSO abilities using OpenID Connect (OIDC). The app is currently designed to use the Implicit flow to retrieve short-lived access ...
user avatar
  • 1,219
10 votes
2 answers
6k views

Auth options for distributed systems

I am in the process of designing 3 components that will work in symphony with one another: A RESTful web service which requires BasicAuth over HTTPS on all calls, and which is what actually does all ...
user avatar
  • 4,680
9 votes
3 answers
2k views

What is the best policy for allowing clients to change email?

We are developing a web application with a fairly standard registration process which requires a client/user to verify their email address before they are allowed to use the site. The site also ...
user avatar
9 votes
2 answers
11k views

Authentication and authorization - front-end vs back-end dilemma

I'm working on centralized authentication and authorization API system and got stuck in front-end vs back-end dilemma. Front-end person is telling that should to have only one request to that API to ...
user avatar
9 votes
2 answers
2k views

Enterprise patterns for JWT authentication for REST-based application?

The JWT specification describes only the payload and how it is sent, but leaves authentication protocol open, which allows the flexibility, but quite unfortunately, flexibility can lead to ...
user avatar
9 votes
1 answer
533 views

Facebook authentication with an Authoritative Server for a Flash Game

I'm working on a multiplatform game in Flash. This game utilizes Photon Server for authoritative physics and user statistics tracking. I'm looking to leverage Facebook authentication as an alternative ...
user avatar
8 votes
2 answers
254 views

Implementation of single authentication point

I am building a series of web apps connected to a single point of authentication. Basically, a user tries to access a site, if not authenticated they are redirected to the central auth system's login ...
user avatar
  • 946
8 votes
1 answer
4k views

Token-based authentication using access and refresh tokens

I am implementing a token-based authentication system for a REST API using a short-lived access token and a long-lived refresh token. This is an abstract overview of the relevant API endpoints (HTTPS ...
user avatar
  • 181
8 votes
2 answers
978 views

Is this solution RESTful and secure?

Our product registers new players on our service, and we've chosen to host it on Azure (we're using .NET) and we wanted it to be stateless (for scalability) and relatively secure. Since this is the ...
user avatar
  • 183
8 votes
3 answers
384 views

Authentication via tokens

I'm relatively new to jwt.io and authentication and I'm using JWT.io in following manner. Server Side Once user logs in, I generate a token with userid embedded inside and pass it back to the user ...
user avatar
7 votes
1 answer
3k views

is "ASP.NET Membership" still a good choice for ASP.NET MVC authentication nowdays?

The last time I used asp.net 4 years ago, the "ASP.Net Membership provider" was the best way to do user authentication in an ASP.Net application. Nowadays, is using the "ASP.Net Membership provider" ...
user avatar
7 votes
2 answers
6k views

What is the correct way to implement Auth/ACL in MVC?

I am looking into making a correctly laid out MVC Auth/ACL system. I think I want the authentication of a user (and the session handling) to be separate from the ACL system. (I don't know why but this ...
user avatar
7 votes
2 answers
16k views

RESTful API with session tokens.. ehh?

After looking at a lot of session/state debates with regard to REST and finding nothing concrete, I'm just going to cut to the chase and ask myself. Developing a RESTful API as a backend for a mobile ...
user avatar
  • 181
7 votes
1 answer
2k views

Multiple SSH keys for different organizations

I can see that GitHub allows you to have multiple mail account and associate every organization you are part of with a different address. Can this be done also for SSH keys? What I would like to do ...
user avatar
  • 175
7 votes
2 answers
3k views

Authentication setup advice for web app and its backend API

I am fairly new to web development, and I am learning to build web applications. I am facing a problem figuring out how to set up authentication mechanisms for a multi-user application. Let me provide ...
user avatar
7 votes
1 answer
1k views

Is this a correct JWT authentication implementation?

I've created a Flask RESTful API which requires an email / password and Facebook login flow. This will probably need to be extended in the future to support more social logins. I've chosen to ...
user avatar
6 votes
4 answers
101k views

Can one determine the creation date of an email account?

Is it possible to determine the creation date of the mail account for the address supplied within the authentication process flow; Or at least determine that the mail account was/was not created the ...
user avatar
  • 99
6 votes
2 answers
6k views

Security in Authentication in single page apps

What's the most secure method of performing authentication in a single paged apps? I'm not talking about any specific client-side or server-side frameworks, but just general guidelines or best ...
user avatar
  • 1,886
6 votes
3 answers
451 views

Multi platform password storage with retrieval for applications with authorization?

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use. Are ...
user avatar
6 votes
1 answer
5k views

How do you get the usernames/passwords onto a STUN or TURN server for long-term credential authentication?

The STUN and TURN specifications allow for client authentication using usernames and passwords, and call this authentication via long-term credentials. In fact, TURN requires that clients authenticate ...
user avatar
  • 123
6 votes
2 answers
2k views

Client side authentication through signatures instead of passwords

I want to save some user-generated data with some signature of the user that generated it (let's say that the user has to fill some forms with some data and I want him to sign the written data). The ...
user avatar
  • 161

1
2 3 4 5
8