Questions tagged [authentication]

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

Filter by
Sorted by
Tagged with
-5 votes
1 answer
316 views

Upload fingerprint from android/ios to cloud

I am working on a project to use fingerprint to authenticate the user. I don't want the authentication to be device specific. Hence want to upload the user fingerprint to cloud. I do understand that ...
user avatar
1 vote
0 answers
81 views

Grant type/flow to use for multitenant application

Let's image we have a multitenant(organization) application having a separate database per tenant(organization). The core of the application is a REST api service protected by an authorization ...
user avatar
  • 11
2 votes
4 answers
4k views

Is there a way to store a secret API key to my backend, which the frontend can safely ask for?

I'm using the google maps API, which has a secret key that I need to use on the client side. I was thinking of some alternatives to store it safely. One of them is storing it in my flask database. ...
user avatar
9 votes
2 answers
11k views

Authentication and authorization - front-end vs back-end dilemma

I'm working on centralized authentication and authorization API system and got stuck in front-end vs back-end dilemma. Front-end person is telling that should to have only one request to that API to ...
user avatar
2 votes
0 answers
33 views

Architecting OAuth2 Flow With an API and Static JS Client

I'm building a very security conscious application. (All applications should be security conscious, but this one may contain a lot of red data). Assuming that I will use a Vue/React JavaScript Single ...
user avatar
0 votes
0 answers
34 views

Methods for storing data pre-registration in a web app

I have a web app - it's more complicated than a todo list but for simplicity sake let us assume it is a todo list. The user has the choice to sign up and create an account thus allowing them to store ...
user avatar
  • 109
3 votes
0 answers
152 views

Are session with cookie for authentication are dead? [closed]

I have an unpleasant discussion with a colleague who said using session in Java Web Application to validate authenticated users with cookies from Web browser after users logged in is problematic (...
user avatar
4 votes
1 answer
163 views

Delaying sensitive database operations until additional authentication conditions are met

I have a REST API where authorised users sometimes need to make changes to data about their company. For the most important information (e.g. IBAN details might fall under this category), we need to ...
user avatar
  • 51
3 votes
0 answers
230 views

Architecture and Security in a Web/Native app while generating PDFs

I am trying to make a system where a user can view/download his statements (say salary slips). The user will have ability to download PDF versions of these statements and can also save them to Google ...
user avatar
0 votes
1 answer
62 views

Authentication, Sign In mobile

I am new to mobile development. As i understand the best way to authenticate/give authorization to a user is using OAuth2.0 with the social providers as Facebook, Google ect ... When we enter the ...
user avatar
  • 3
0 votes
1 answer
262 views

Adding authentication and filtering in the service layer

I am currently developing a simple web-based application that consists of various layers: Model Layer Performs simple CRUD operations and provides access to the databes. Implements functions such as ...
user avatar
0 votes
1 answer
77 views

Designing Rest API endpoint for viewing bearer access token

We have several endpoints which were authenticated using a bearer access-token. There was another endpoint which will renew/generate a new bearer access-token on passing valid secret_id and client_id. ...
user avatar
1 vote
1 answer
73 views

Api limit access to subscribers only

I have a vanilla php api(on a vds) and I want to make data coming from that api available to a few clients that are using a python app that's also written by me. That python app is running on my ...
user avatar
  • 19
7 votes
2 answers
3k views

Authentication setup advice for web app and its backend API

I am fairly new to web development, and I am learning to build web applications. I am facing a problem figuring out how to set up authentication mechanisms for a multi-user application. Let me provide ...
user avatar
1 vote
2 answers
5k views

How to keep user logged in when using OpenID Connect & Cookies in dotnet core?

I'm working on an OpenID Connect Hybrid flow, basically the response type in my case is: code id_token Problem: I can't seem to persist the session of the user when logged in using the id_token. I ...
user avatar
  • 79
3 votes
1 answer
403 views

How to handle API token(s) that expires after time

I'm currently building a facade that's supposed to be in front of a system we are currently using. This system has its own API, but we have decided to simplfy things, and therefore the facade. ...
user avatar
  • 203
0 votes
0 answers
30 views

Recommendation for user synchronization between organization and external website

We are building a small social media platform for collaboration among a group of similar (but disparate) organizations. Each organization will have a small group of users who will be able to post ...
user avatar
  • 101
-4 votes
1 answer
122 views

Is it bad to leave Azure secrets keys as plaintext in my source code if I don't release the code, only the exe? [closed]

Specifically worried that someone might be able to extract the API key in a way I am unaware of and make calls to my own Cognitive Services subscription outside of the context of my program.
user avatar
  • 11
0 votes
2 answers
311 views

Is creating a leaderboard web API that can't be fudged possible?

Let's say you have a game, and players of your game can get scores. You also want to be able to post these scores to a server using calls to a web API. Obviously, you want to be able to tell who sent ...
user avatar
4 votes
0 answers
166 views

How to authenticate third-party callbacks that don't support authentication

I'm working on a project that integrates with a third-party service via API, and the third-party uses callbacks to update us on the status of the operations being performed. These callbacks can be hit ...
user avatar
1 vote
2 answers
659 views

Handling refresh token revocation

I've been implementing an authentication flow for an app that I've been making that uses JWTs. When a user is initially logged in or when they register (which immediately logs them in), I provide an ...
user avatar
0 votes
2 answers
291 views

Is a refresh token an entity or value object?

I have a User entity, which may have a RefreshToken (for authentication). Notes: A refresh token doesn't have "identity", but is related to a single user - it is only valid for that user. In the db ...
user avatar
  • 181
1 vote
0 answers
392 views

ACL entity and microservices database relations

I would like to build a microservices architecture to handle the following scenario: I have a building. The building has some kinds of devices. And the devices can be used by the users. In the system, ...
user avatar
0 votes
1 answer
137 views

Authorization & Profiles considerations for ASP.NET MVC Customer Portal

there's an up and running self-serve customer portal built that I'm trying to make a bit better when it comes to displaying proper items for different client types and auto-logging users. Here are a ...
user avatar
3 votes
1 answer
1k views

REST API Authentication: Cookie vs Web Storage

Note: This question might sound like a duplicate, but all other similar questions did not take into account (mobile apps, iot's, web, 3rd party usage). Specifically, in dealing with the clients ...
user avatar
0 votes
0 answers
32 views

Authentication, bussiness logic and several entities in asp.net core

I'm working on an asp.net core application, using Identity as authentication/authorization management. Depending on the role the user can do "some thing", this is the normal way of authorization. But ...
user avatar
  • 128
1 vote
1 answer
2k views

How to support anonymous user in web application?

I work for a publishing company that also provides content distribution to their users. In order to access a piece of content the user must be entitled to do so. Traditionally this authorization check ...
user avatar
  • 27
2 votes
0 answers
34 views

OAuth2 - client_credentials

I am in the process of building out a private REST API. This API is intended for machine to machine communication. In short someone else's server will kick off a job via CRON that pulls information ...
user avatar
  • 121
4 votes
3 answers
961 views

Authorization and Audit on models in MVC architecture

What are the best practices to extend Authorization to the Model layer if in a monolith MVC application (i.e rails) you have other entry-points than just the Controller? I.e background jobs, or the ...
user avatar
  • 222
0 votes
1 answer
379 views

Handling Authentication with both Web App and API

Not sure how to handle this. Our current app (.Net MVC) is accessed via companyname.appname.com, authentication is handled via forms (cookie) authentication. Within the app there is a global search ...
user avatar
  • 149
1 vote
1 answer
108 views

Implementation of Android Fingerprint technology [closed]

I'm currently doing a web based system for multiple organizations, so on my login form, there's 3 simple field: Company code, such as CNN (this is implemented so we can have same username, as long as ...
user avatar
3 votes
4 answers
707 views

Is a cookie hash that matches with file hash safe?

I've made a simple login form. It's made very generic to be used for any project. Now I wonder if the security is good enough and if my approach is safe. On success When successfully logged in I do ...
user avatar
1 vote
1 answer
737 views

User registration across multiple services [closed]

I have multiple web services that need to be integrated into one solution. One frontend would provide access to features from all services. Each of the services has its own native authentication, and ...
user avatar
  • 19
3 votes
1 answer
139 views

How to authenticate devices across organisation boundaries without a third party CA

I'm currently working on a protocol which passes automated instructions between separate organisations. I'm looking for a way to delegate authentication of devices to which ever organisation a device ...
user avatar
1 vote
0 answers
74 views

How to solve circular dependency scenario while executing http calls which require authentication?

I am working on a project which requires me to execute standard HTTP calls with session tokens. I am building a custom HTTP client, with a custom authenticator, something like this: Client client = ...
user avatar
0 votes
0 answers
126 views

Microservice auth layer vs each service authorizing requests?

I approached our architect with a solution in which all of our microservices verify the auth of the user invoking the call. Basically, what I've been doing for years, on different projects. He ...
user avatar
0 votes
1 answer
101 views

API User identification

I'm designing an API, and I need to authenticate each request with a user. The simplest way to do that is to provide an API key to each user on their "My account" page, that they could regenerate at ...
user avatar
0 votes
0 answers
140 views

Authenticated ASP.NET Core MVC site consuming web API

I have an ASP.NET Core 2.2 MVC site, that uses Facebook as an identity provider. Users can click the login button, they are redirected to Facebook to enter their credentials, and are then redirected ...
user avatar
  • 333
1 vote
1 answer
943 views

Multiple app authentication, universal user login, best practice

Please see the below diagram. There are two apps that each have a different set of functions, User A is a user of App1 and User B is a user of App2. They should not be able to log in directly to the ...
user avatar
1 vote
0 answers
82 views

Single Sign On implementation for CMS

This is a general question seeking guidance for the best practice(s) on implementing a Single Sign On (SSO) across many various installations of the same application. The hypothetical example I would ...
user avatar
  • 19
-5 votes
2 answers
77 views

Authenticate Git Pulls on a Compromised Machine [closed]

I may have a tough one for you. I have a machine in the wild that is and will probably continue to be compromised. The machine is owned by a user who will be unable to keep it secure. I must have ...
user avatar
5 votes
2 answers
1k views

So I am creating a user registration system with oauth login to four services. How do I handle username selection?

My registration system normally asks for 4 things: The user's full name, their email, their preferred username, and a password. I want to add four oauth2 registration services to make it easier and ...
user avatar
  • 167
0 votes
1 answer
198 views

How to protect while loosely coupling a db server that is shared by 2 different services

Background information I have a database that will be used by two different web applications. Solution A (user driven web application) resides on the public internet and will write / update / delete ...
user avatar
  • 479
1 vote
2 answers
1k views

When using Redux/Redux-Saga - should JWTs be set in the action creators/sagas?

Almost every blog post I've encountered around generic auth handling using JWTs in a React/Redux/Saga application does the same thing, which is to store the JWT in local storage, in the action/saga. ...
user avatar
  • 2,463
0 votes
1 answer
105 views

How you can deal with making invalid a list of JWTs?

I design a new Rest API for a personal project and I am trying to implement the authentication and authorization mechanism as a separate project, so I ended up with a couple of problems which I am ...
user avatar
  • 345
2 votes
2 answers
581 views

Security Issues with RESTful Authentication & Session Management

I'm trying to implement authentication and session management for a microservice. In order to do the process RESTfully, I understand that I'll need to use some kind of token-based authentication to ...
user avatar
  • 131
1 vote
0 answers
57 views

Client synchronization of authentication tokens in parallel connections

In my app server's authentication implementation, an authentication token is generated for every user that has logged in. According to some highly recommended security tips (Implementing Secure User ...
user avatar
  • 111
2 votes
1 answer
756 views

Onion Architecture, Project Architecting and Authentication

I am learning ASP.NET MVC & Web API and trying to implement Onion Architecture with Repository Pattern for one of my Test projects as part of my learning. I have developed single MVC Projects ...
user avatar
1 vote
1 answer
235 views

Help with definition of broad user types

I am trying to define the boundary between two broad types of users. The first are those who make use of corporate systems (accounting, ERP, CRM, etc.) and this also includes B2B users, for example ...
user avatar
  • 129
0 votes
2 answers
89 views

Managing sign-on in mobile applications

I'm programming a mobile app which makes use of REST services. Some of the services are for logged users, so I have a login endpoint which lets me enter my credentials and get a JWT token for ...
user avatar
  • 201

1 2
3
4 5
8