Skip to main content

Questions tagged [authentication]

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

Filter by
Sorted by
Tagged with
134 votes
7 answers
21k views

Are private, unguessable URLs equivalent to password-based authentication?

I want to expose a resource on the web. I want to protect this resource: to make sure it is only accessible to certain individuals. I could set up some kind of password-based authentication. For ...
GladstoneKeep's user avatar
99 votes
8 answers
67k views

Is browser fingerprinting a viable technique for identifying anonymous users?

Is browser fingerprinting a sufficient method for uniquely identifying anonymous users? What if you incorporate biometric data like mouse gestures or typing patterns? The other day I ran into the ...
SMrF's user avatar
  • 1,093
39 votes
1 answer
44k views

Where to place an API key: a custom HTTP header VS the Authorization header with a custom scheme

I'm designing a REST API using authorization/authentication via an API Key. I tried to figure out what is the best place for it and found out that many people suggest using a custom HTTP header such ...
RomanG's user avatar
  • 501
35 votes
2 answers
21k views

Cookie-based vs Session vs Token-based vs Claims-based authentications

I have read about authentications and become confusing about types classification. Let's start from Cookie-based authentication, If I understand it right, the key point is that all data, needed for ...
Set's user avatar
  • 459
34 votes
3 answers
16k views

JSON Web Token - why is the payload public?

I can't understand the reasoning for making the claims/payload of a JWT publicly visible after base64 decoding it. Why? It seems like it'd be much more useful to have it encrypted with the secret. ...
ineedhelp's user avatar
  • 451
25 votes
3 answers
20k views

Is it bad practice to store a user's email address in a JWT?

I'm using JWTs for user auth in a web application. I have a user db where each user's unique ID is their email address. To identify the subject of the JWT, I currently have a claim which stores the ...
Justin Borromeo's user avatar
24 votes
4 answers
7k views

How should I architect a RESTful webservice to use 3rd party (i.e. Google, Facebook, Twitter) for authentication?

For my job we have a nice RESTful webservice we've built out that we use to drive a couple websites we have. Basically the webservice lets you create and work with support tickets, and the website is ...
Ralph Callaway's user avatar
23 votes
2 answers
17k views

Share private SSH keys with Bash on Windows

I have Windows 10 with Git installed. This Git uses my C:/Users/MyName dir as the HOME directory and the /.ssh/ dir within, appropriately for sourcing my private SSH keys. I have just enabled and ...
Toby's user avatar
  • 595
21 votes
1 answer
23k views

Difference between 'aud' and 'iss' in jwt

I want to implement a more robust authentication service and jwt is a big part of what I want to do, and I understand how to write the code, but I'm having a little trouble understanding the ...
Adam McGurk's user avatar
21 votes
2 answers
19k views

Should I store my user claims in the JWT token?

I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure. I cannot makeup my mind as to whether ...
Astravagrant's user avatar
20 votes
9 answers
8k views

Is this scenario an exception to the rule of never storing passwords in plaintext?

I am making a full-stack web application for a professor. At his request, the passwords and usernames are generated programmatically, and they cannot be changed or reset by the students. (If you ...
James's user avatar
  • 359
20 votes
2 answers
17k views

REST API security: HMAC/key hashing vs JWT

I just read this article that is a few years old but describes a clever way of securing your REST APIs. Essentially: Each client has a unique public/private key pair Only the client and the server ...
smeeb's user avatar
  • 4,890
18 votes
9 answers
5k views

Authentication and authorisation for people with intellectual disabilities

Currently, I'm involved in a research project in which we are evaluating an existing web environment providing a safe online playground for children/adolescents with intellectual disabilities. Certain ...
KDW's user avatar
  • 349
18 votes
3 answers
32k views

Handling token renewal / session expiration in a RESTful API

I'm building a RESTful API that uses JWT tokens for user authentication (issued by a login endpoint and sent in all headers afterwards), and the tokens need to be refreshed after a fixed amount of ...
Óscar López's user avatar
18 votes
5 answers
10k views

Authorization and authentication system for microservices and consumers

We plan to refactor our company system into a micro-service based system. This micro-services will be used by our own internal company applications and by 3rd party partners if needed. One for booking,...
Robert's user avatar
  • 555
17 votes
2 answers
9k views

Should I specify the userId in the REST URL structure?

Basically, one feature of my app is to retrieve the logged user's friends. Actually, I hesitate between both kind of endpoints: GET /api/users/friends GET /api/users/:userId/friends Using 1, ...
Mik378's user avatar
  • 3,888
17 votes
1 answer
14k views

Authenticate native mobile app using a REST API

I'm starting a new project soon, which is targeting mobile application for all major mobile platforms (iOS, Android, Windows). It will be a client-server architecture. The app is both informational ...
supercell's user avatar
  • 1,527
17 votes
2 answers
13k views

How should an API use http basic authentication

When an API requires that a client authenticates to it, i've seen two different scenarios used and I am wondering which case I should use for my situation. Example 1. An API is offered by a company ...
Paul Sylling's user avatar
16 votes
3 answers
15k views

Web Authentication using PKI Certs

I understand PKI reasonably well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of ...
user93353's user avatar
  • 441
14 votes
7 answers
8k views

How to architect user authentication from client applications?

I've been developing an application which will support many users. The thing is I'm unable to figure out, how to authenticate the client/user. I'm building an app like http://quickblox.com/ where I'...
Alok Patel's user avatar
13 votes
2 answers
21k views

Best way to hide API key in source code

I need some ideas on how to protect a private API key in an application, specifically in a c# .NET application. Firstly, I understand that it is theoretically impossible to hide anything in the ...
Spencer's user avatar
  • 233
13 votes
5 answers
10k views

Best practices for web application Authentication/Security (Any Platform)

I got a question today from my manager asking me my thoughts on what is considered an acceptable design for authentication of a web form application, especially in regards to the nature of many ...
maple_shaft's user avatar
  • 26.5k
13 votes
1 answer
8k views

Caching authenticated requests for all users

I am working on a web app that must deal with very large impulses of simultaneous users, who need to be authorized, to request identical content. In its current state, it's totally crippling to even a ...
iamyojimbo's user avatar
13 votes
1 answer
5k views

Microservice Architecture - using Auth Server as a User Resource server

I'm designing an application based on microservices architecture. In this application I will need Auth microservice. Also I will need to store some extra User information such as, perhaps, multiple ...
Andrey Yaskulsky's user avatar
12 votes
4 answers
898 views

Am I Over-Engineering If I Consider User's Intentional Wrongdoing?

Is it over-engineering if I add protection against a user's intentional wrongdoing (to put it mildly), if the harm the user can incur is not related to my code? To clarify, I'm exposing a simple JSON ...
Sunny's user avatar
  • 515
12 votes
2 answers
13k views

cookie vs. session vs jwt

I am reading up on authentication/authorization in web applications. Could anybody confirm/correct my current knowledge? Cookies: in their early version, a text file with a unique client Id an all ...
user3629892's user avatar
12 votes
3 answers
12k views

Should access permissions and roles be included in payload of JWT?

Should information about the permissions and roles of the client be included in JWT? Having such information in JWT token will be very helpful as everytime a valid token comes, it would be easier to ...
Anshul Sahni's user avatar
11 votes
7 answers
6k views

Will Authentication over HTTPS Slow My Application?

I am building a web application and RESTful web service. I have been reading various articles about the best way to authenticate the requests to the web service. The best option for me seems to be ...
GWed's user avatar
  • 3,135
11 votes
2 answers
5k views

Designing authentication for REST API

I'm working up an API for a REST service that I'm going to both be producing and consuming. I've spent the past few days trying to figure out how to handle authentication nicely, and think I've ...
Matt Sieker's user avatar
11 votes
2 answers
1k views

Should an SPA use OIDC's Implicit flow or Auth Code flow?

We are developing a new Angular SPA which leverages Keycloak for its SSO abilities using OpenID Connect (OIDC). The app is currently designed to use the Implicit flow to retrieve short-lived access ...
Eric B.'s user avatar
  • 1,249
11 votes
1 answer
683 views

Facebook authentication with an Authoritative Server for a Flash Game

I'm working on a multiplatform game in Flash. This game utilizes Photon Server for authoritative physics and user statistics tracking. I'm looking to leverage Facebook authentication as an alternative ...
Kody Manharth's user avatar
10 votes
2 answers
19k views

Custom use of Authorization header in a REST API

I'm building a REST api where clients are authenticated using client certificates. A client in this case is not an individual user, but some sort of a presentation layer. Users are authenticated using ...
Matsen75's user avatar
  • 217
10 votes
2 answers
6k views

Auth options for distributed systems

I am in the process of designing 3 components that will work in symphony with one another: A RESTful web service which requires BasicAuth over HTTPS on all calls, and which is what actually does all ...
smeeb's user avatar
  • 4,890
9 votes
3 answers
3k views

What is the best policy for allowing clients to change email?

We are developing a web application with a fairly standard registration process which requires a client/user to verify their email address before they are allowed to use the site. The site also ...
Steve Konves's user avatar
9 votes
2 answers
3k views

Enterprise patterns for JWT authentication for REST-based application?

The JWT specification describes only the payload and how it is sent, but leaves authentication protocol open, which allows the flexibility, but quite unfortunately, flexibility can lead to ...
user avatar
8 votes
3 answers
13k views

Authentication and authorization - front-end vs back-end dilemma

I'm working on centralized authentication and authorization API system and got stuck in front-end vs back-end dilemma. Front-end person is telling that should to have only one request to that API to ...
JackTheKnife's user avatar
8 votes
1 answer
18k views

RESTful API with session tokens.. ehh?

After looking at a lot of session/state debates with regard to REST and finding nothing concrete, I'm just going to cut to the chase and ask myself. Developing a RESTful API as a backend for a mobile ...
Zoon's user avatar
  • 191
8 votes
2 answers
278 views

Implementation of single authentication point

I am building a series of web apps connected to a single point of authentication. Basically, a user tries to access a site, if not authenticated they are redirected to the central auth system's login ...
Rocket04's user avatar
  • 1,076
8 votes
1 answer
4k views

Token-based authentication using access and refresh tokens

I am implementing a token-based authentication system for a REST API using a short-lived access token and a long-lived refresh token. This is an abstract overview of the relevant API endpoints (HTTPS ...
null's user avatar
  • 181
8 votes
2 answers
1k views

Is this solution RESTful and secure?

Our product registers new players on our service, and we've chosen to host it on Azure (we're using .NET) and we wanted it to be stateless (for scalability) and relatively secure. Since this is the ...
Ron's user avatar
  • 183
8 votes
3 answers
388 views

Authentication via tokens

I'm relatively new to jwt.io and authentication and I'm using JWT.io in following manner. Server Side Once user logs in, I generate a token with userid embedded inside and pass it back to the user ...
user2727195's user avatar
7 votes
4 answers
110k views

Can one determine the creation date of an email account?

Is it possible to determine the creation date of the mail account for the address supplied within the authentication process flow; Or at least determine that the mail account was/was not created the ...
Nonso's user avatar
  • 109
7 votes
1 answer
3k views

is "ASP.NET Membership" still a good choice for ASP.NET MVC authentication nowdays?

The last time I used asp.net 4 years ago, the "ASP.Net Membership provider" was the best way to do user authentication in an ASP.Net application. Nowadays, is using the "ASP.Net Membership provider" ...
Daniel Santos's user avatar
7 votes
2 answers
2k views

Multiple SSH keys for different organizations [closed]

I can see that GitHub allows you to have multiple mail account and associate every organization you are part of with a different address. Can this be done also for SSH keys? What I would like to do ...
Dacav's user avatar
  • 175
7 votes
2 answers
6k views

What is the correct way to implement Auth/ACL in MVC?

I am looking into making a correctly laid out MVC Auth/ACL system. I think I want the authentication of a user (and the session handling) to be separate from the ACL system. (I don't know why but this ...
WiseStrawberry's user avatar
7 votes
3 answers
4k views

Authentication setup advice for web app and its backend API

I am fairly new to web development, and I am learning to build web applications. I am facing a problem figuring out how to set up authentication mechanisms for a multi-user application. Let me provide ...
Big Monday's user avatar
7 votes
1 answer
1k views

Is this a correct JWT authentication implementation?

I've created a Flask RESTful API which requires an email / password and Facebook login flow. This will probably need to be extended in the future to support more social logins. I've chosen to ...
Remco Haszing's user avatar
6 votes
1 answer
1k views

Should user and service-to-service authentications be separate?

Say I have a system with 5 microservices behind a gateway, and a user signs in through an IDP (OAuth) A user U passes the access token in a request, and the call first reaches the gateway before it ...
Jerald Baker's user avatar
6 votes
2 answers
6k views

Security in Authentication in single page apps

What's the most secure method of performing authentication in a single paged apps? I'm not talking about any specific client-side or server-side frameworks, but just general guidelines or best ...
Daniel's user avatar
  • 1,896
6 votes
3 answers
2k views

How do you handle JWT expiration for long running calls?

Currently we are debating over securing our multiple micro-services. The major concern is that the JWT token provided to us will expire before the call is finished. (This is in the synchronous design) ...
Joe Kennedy's user avatar

1
2 3 4 5
9