Questions tagged [authentication]

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

Filter by
Sorted by
Tagged with
2 votes
2 answers
1k views

Should I return user data in an authentication endpoint using JWT?

I implement an auth endpoint which takes an email and password and returns a JWT token. Inside the JWT there is a payload containing the user ID. Does it matter from a REST/JWT standards perspective ...
user avatar
  • 161
2 votes
0 answers
413 views

How to retrieve login token from repository in network layer? Domain Driven Design - DDD

I am trying to come up with a design for an application I am working on. Here is a basic picture of what I am looking to do. Everything up to the Data Layer is totally fine but the Data Layer makes ...
user avatar
1 vote
1 answer
591 views

Token based authentication to multiple API servers

We have a Web server (which also does authentication and authorization) that manages, via an API, one or more servers that contain highly sensitive data. In the below architecture diagram, we manage ...
user avatar
0 votes
0 answers
54 views

Where to carry JWT Tokens in Requests

I have an AspNet application which I'm authenticating using a separate AspNet Core application. It returns a JWT token which is then carried in a Http Cookie. The AspNet application validates each ...
user avatar
0 votes
1 answer
233 views

What is the most common stateless way for authentication in microservices?

I'm trying to get into Microservices by creating a project, so far I've stumbled upon authentication mechanisms, in a monolithic architecture, the client (web app) would send a request with the user ...
user avatar
0 votes
1 answer
127 views

How to secure messaging-based communication with microservices

I'm comfortable with a lot of OpenID Connect and OAuth2 concepts in the context of HTTP-based communication between microservices. I'm currently leveraging Azure AD. In the HTTP-based scenario I would ...
user avatar
  • 1
1 vote
1 answer
380 views

Securing API with JWT and elevated access using MFA

At my company we have a central auth server running IdentityServer. There are a number of applications providing some API to client applications. API requests are authenticated with JWT tokens issued ...
user avatar
  • 119
1 vote
1 answer
185 views

How can I share authentication information between all the server?

I'm developing a web service that have following structure: Web Server: this is implemented with NextJS which do Server-Side Rendering and serve server-side rendered webpage data to Client. API ...
user avatar
  • 91
1 vote
0 answers
36 views

Building an app+backend with extraneous functionality for an existing web shop. How to handle authentication on the backend?

This is an architecture question as I've been asked by an existing web store to build a mobile app (they don't have a mobile app) that provides extra functionality to the store, a web admin panel to ...
user avatar
  • 19
3 votes
3 answers
427 views

When to derive user ID from authentication token vs. validate against?

I am using JSON web tokens, but this authentication token can be any token from which a unique user can be derived. I am designing a REST API that allows CRUD operations on resources owned by specific ...
user avatar
1 vote
1 answer
200 views

API / System Design [Flexible Authentication / Authorization]?

Background: We're a smaller shop that puts out a number of products that require authentication and authorization. We're currently using a 3rd party service to "spin up new auth APIs" for ...
user avatar
1 vote
1 answer
193 views

How to handle authentication & authorization inside microservices

Example Application I will try to explain my problem by using a familiar application. Lets'say I'm building a Discord / Slack / Microsoft Teams clone; and for simplicity’s sake, it will contain 2 ...
user avatar
  • 163
1 vote
0 answers
89 views

Reactjs + nodejs external authentication flow

I am developing a RESTful application with nodejs in the backend with express.js as middleware. I am also developing a client in Reactjs. I want to use an external authentication service (LDAP/AD/ADFS)...
user avatar
  • 111
1 vote
1 answer
366 views

HTTP(S) API authentication: why not many services require signing (HMAC)?

I am currently researching existing authentication/authorization solution that are used for REST APIs. More specifically I'm interested in backend-to-backend interactions but client-to-backend is ...
user avatar
1 vote
0 answers
68 views

Best Way To Store Password & JWT on Mobile

I have a Flutter and Angular application that previously used Firebase, but for various reasons I'm working on switching it over to my own RESTful API with ExpressJS. One topic I'm a little confused ...
user avatar
  • 127
2 votes
1 answer
447 views

Moving authentication outside the domain layer

In discussion about an architecture decision that we do consider wrong and how exactly to address it, some lack of understanding on the matter arose. In dealing with authentication and authorization, ...
user avatar
1 vote
2 answers
224 views

Authenticating requests from third party users to our APIs

We have a web app which has certain APIs. Users of our webapp will use these APIs when they login to our webapp (like how many records me as a user do I own, user specific, etc). We are creating ...
user avatar
  • 119
0 votes
3 answers
219 views

What is a recommended authentication architecture for a front GUI app that I want to control but that will be used by others to control their servers?

I have a front end (WEB GUI) app that I designed (Python for now + JavaScript in the future) that I use to access a controller, it uses REST APIs. I want to publish this app in the cloud so that ...
user avatar
  • 101
2 votes
0 answers
23 views

Design REST API for Mobile Apps with Unregister Users

I'd like to know some best practices on how to build rest API for a backend which shall communicate with a mobile app by anonymous users. This is the scenario with details: I'm building a demo library ...
user avatar
  • 29
1 vote
0 answers
71 views

How does Google Analytics prevent tampering?

I'm building a simplified web tracker as a side project. One of the things I'm unsure about these cloud-based trackers (like Google Analytics) is how they prevent abuse of their platform; in other ...
user avatar
  • 421
-3 votes
1 answer
56 views

Do I need MongoDB (or another type of database) to authenticate with Google?

I'm creating a web application using Node.js and Pug, and have recently been looking at adding external OAuth authentication to this site, using Express and Passport.js. I've found a lot of examples ...
user avatar
  • 113
1 vote
2 answers
136 views

Recommended strategy for maintaining a session when navigating from app to browser?

We have an SSO application that provides authentication for a native mobile application, as well as for a web application. There are some features that the web application has that the mobile ...
user avatar
1 vote
0 answers
22 views

Defining custom OIDC provider with delegating authentication to another OIDC provider and using own authorization database

I wanted to ask about your ideas on how to solve the problem that I have to solve in my application (App1). This is the classic Fronted + Backend (Angular + Java EE) application to which I am ...
user avatar
  • 111
0 votes
1 answer
1k views

Best way to store Session token on mobile App

Background Building a mobile App for product X which is currently hosted as a SaaS solution. The product X does not support OAuth currently, implements basic authentication and generates Session token ...
user avatar
  • 109
2 votes
0 answers
500 views

Biometric authentication with back-end verification service process

I am working on an application where I will be using Android and iOS biometric authentication. Coding the use of biometrics on the devices, including prompting and determining whether or not the user ...
user avatar
  • 121
-4 votes
1 answer
43 views

How would I authenticating a Software Plugin with Username/Password using REST?

I'm developing my first Python plugin for a 3D application. What I'm looking to do I would like users who've purchased a subscription to the plugin from my Wordpress/WooCommerce web site to log in ...
user avatar
3 votes
3 answers
210 views

How does authentication work for offline software?

I am wondering how software with premium modes, such as Spotify, can operate offline. If a user is not connected to the internet, then they cannot authenticate via a remote server, which has e.g. a ...
user avatar
1 vote
0 answers
88 views

Using Azure AD MSAL as only authentication solution for SPA

I have an Angular SPA and I spun up my own basic form-based authentication using a .net core web API and SQL server to store user accounts / hashed and salted credentials. This is obviously not an ...
user avatar
  • 111
2 votes
1 answer
320 views

Delegating authorization across multiple API's

I'm building a multi-tenant system that consists of one (SPA) client, calling multiple API's, all under my control. User authentication is done with OpenID Connect, I'm sending an ID and access token ...
user avatar
0 votes
0 answers
44 views

Proper way to use oauth with external auth server and an api

I have an api server that relies on an auth server (both owned by the same company). Once the client gets a grant from the auth server, it is no longer needed, because the only information I need from ...
user avatar
1 vote
0 answers
45 views

Handling 3rd party OAuth2 tokens

After some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd ...
user avatar
  • 111
2 votes
1 answer
162 views

Good/clean practice for building the auth part of an application

I'm starting on a greenfield project and haven't done or architected the sign-up/sign-in and auth part of the backend in a very long time, so my knowledge on the nowadays' good practices is very ...
user avatar
3 votes
1 answer
979 views

Why is it fine to use a user's ID in their JWT, as opposed to their email/username?

I'm wondering whether it is bad practice to keep a user's ID in a JWT. I'm planning on using the email in the sub, since it's already available to them, and I can use it to identify them, all the ...
user avatar
  • 169
2 votes
1 answer
192 views

Chaining openID token

I'm working in microservices environment, where each service authenticates using OpenID Connect to an authentication service (local IdP), based on Users I keep locally on my Database. Now, I want ...
user avatar
  • 79
0 votes
1 answer
3k views

Offline-Login Procedure in PWA

I have kind of a unique usecase: Phones that are used to connect to the app might be shared Connections are very unstable (sometimes no connection for half a day) Data should be accessible through ...
user avatar
1 vote
1 answer
149 views

Using Django Sessions when views are accessed by API

I'm making an app which is a Django backend and a React frontend (being developed by someone else). The plan currently is to fully decouple the two and have them communicate over API. However, I would ...
user avatar
  • 197
2 votes
3 answers
592 views

Securing API for third party use

We have a set of microservices and would like to expose endpoints from a subset of these for third parties to use. To this end, we will build an API Gateway that acts as the access control mechanism ...
user avatar
  • 165
0 votes
2 answers
337 views

Is it ok to use .Replace(" ", "+") when reading hashes in a querystring?

I am letting users change their password after a reset, by following a link containing hashes of the password and user name (e-mail address). The link can look like this: www.example.domain/login?...
user avatar
  • 131
0 votes
0 answers
71 views

Which authentication should be used for external users (not registered with the system)

I'm working with a project that uses ASP.NET Core 2.2. The main solution contains different projects, including APIs for a mobile application, APIs to integrate the system with third parties, a web ...
user avatar
  • 157
20 votes
9 answers
8k views

Is this scenario an exception to the rule of never storing passwords in plaintext?

I am making a full-stack web application for a professor. At his request, the passwords and usernames are generated programmatically, and they cannot be changed or reset by the students. (If you ...
user avatar
  • 359
3 votes
1 answer
47 views

Securing a voice assistant skill/app - any established patterns?

When creating new skills/apps for a voice assistant such as Google Home or Amazon Echo, are there any established patterns for providing an extra level of security for certain actions that go beyond ...
user avatar
  • 157
1 vote
1 answer
846 views

Authentication and Signup with Microservices

I am looking for the best practice to do authentication (login) and signup using microservices, given that microservices are not supposed to share the same data. At the moment I am thinking: Two ...
user avatar
  • 129
0 votes
0 answers
101 views

oauth2 + angular - Most elegant way to pass the JWT auth token

I have an angular application, which is querying an API as a client (written on Spring Boot 2.2.1 + Spring 5.2.1) that supports 3rd party authentication over OAuth2. The API has altogether 3 different ...
user avatar
2 votes
0 answers
33 views

How authorize web application and manage sessions

i am building a single page react app that uses redux as state manager and an express node js as backend server but i don't know what is the best way to authorize my users in the application! if it ...
user avatar
  • 129
1 vote
1 answer
340 views

Hashing from within the database or outside?

I am in the process of evolving architecture for an 'equity analysis system'. I will be using SQLServer as the database, but I am not going the .NET route and won't be using the built-in 'membership' ...
user avatar
4 votes
1 answer
277 views

Shared access tokens in a distributed system

I'm building a system that horizontally scales with many nodes. Any of these nodes could consume an API that's hosted on https://example.com/api. The authentication for this API is token based. My ...
user avatar
  • 149
2 votes
3 answers
286 views

PHP : authentication with a temporary link

in my system users register with their email address and receive a temporary link to log in. hostname/login/OYkwIJt6be1V5kMg10G The token must be generated from the email adress of user and valid ...
user avatar
  • 129
3 votes
2 answers
1k views

How to combine session-based authentication and stateless REST API

What is the proper way of combining session-based authentication with stateless, token-based authentication for a REST API? Use case: User logs-in in the standard, traditional, session-based way. ...
user avatar
0 votes
1 answer
88 views

Why should an authentication server and a gateway be two distinct components?

Why should I decouple an authentication server from a gateway in a micro services architecture ? A clear drawback is the additional network load needed to query the auth server in each request. ...
user avatar
2 votes
1 answer
70 views

Role based authentication/authorization security

I have my backend endpoint for registering and logging in the users delivered trough RestApi or GraphQL to be more specific. I want to implement role based system for my users. The admins and ...
user avatar

1
2
3 4 5
8