Questions tagged [authentication]

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

Filter by
Sorted by
Tagged with
5 votes
1 answer
265 views

How can I obtain a CA certificate for my application if I do not own a business/company?

I have developed an application which I intend to sell. I set up a website with information and download links, advertising, payments, everything is ready to go - except the digital signature. I want ...
user avatar
1 vote
4 answers
2k views

Microservice authentication between services

Is there a way to ensure that serviceA is called only by serviceB(or a set of whitelisted services)? All the services are independent and do not go through a service gateway as they are completely ...
user avatar
  • 103
11 votes
2 answers
1k views

Should an SPA use OIDC's Implicit flow or Auth Code flow?

We are developing a new Angular SPA which leverages Keycloak for its SSO abilities using OpenID Connect (OIDC). The app is currently designed to use the Implicit flow to retrieve short-lived access ...
user avatar
  • 1,219
-1 votes
2 answers
144 views

How would you design the abstraction/class(es)/component(s) of a third-party service/api used in your application?

Lets say you were designing a Twitter client for people with people could see tweets and post tweets? How would you design the twitter api abstraction? Many of the api wrappers I've seen feature an ...
user avatar
-2 votes
1 answer
53 views

Should API also authenticate users from front end app?

I am building an API using Laravel and am looking at using Laravel/Passport for authentication - but I am struggling with a design decision. The API will be consumed by multiple other applications / ...
user avatar
  • 59
0 votes
1 answer
66 views

Is changing the domain according to the user privilege on specific fields considered as anti-pattern?

Is changing the domain according to the user privilege on specific fields considered as anti-pattern? My case: I have Schedule Entity (aggregate root) like this: public class Schedule : Entity<...
user avatar
-2 votes
1 answer
114 views

How to migrate an existing ASP.NET MVC site to ASP.NET MVC Core - specifically on authorization

I am in the process of upgrading an existing website to ASP.NET Core 2.1. The goal is simplification and ease of maintenance. Existing site is using: EF and .NET 4.6.2 A [Users] table in SQL Server ...
user avatar
  • 109
0 votes
2 answers
401 views

API Design - User Management

I work for an ecommerce site and we are looking to expose much of our core functionality via a set of APIs. We plan on re-writing some of our own public facing websites (e.g. the main shop website) to ...
user avatar
1 vote
1 answer
67 views

Should I separate the REST sessions from the sessions in the rest of the application?

Assuming I have resources I restrict access to with a username + password login in my web application and in my REST API. Should I keep different sessions for both meaning that a login via the web UI ...
user avatar
3 votes
2 answers
3k views

Stateful authentication in REST API using tokens

I have recently started on a project involving a REST API. The API requires authentication with requirements for administrators to be able to view logged in users and to be able to revoke specific ...
user avatar
0 votes
1 answer
175 views

LDAP with Dovecot

I have a mail server setup with Postfix and Dovecot, and an application server setup with node.js. I have user credentials stored in my application server, and I want to use the same credentials for ...
user avatar
  • 419
0 votes
1 answer
102 views

What is Federated , Certified Authentication?

I was completing an infosec report and came across this. Does the APP support end-user authentication? Federated, Certified, other? I wanted to have some clarification on the terms. From what I ...
user avatar
1 vote
2 answers
1k views

How should I manage user session in CLI application?

I'm developing a CLI based application. It has a "login" command to perform authentication: $ myapp login $ Type username: hector $ Type password: ***** $ Login success! Internally, myapp login ...
user avatar
  • 717
12 votes
3 answers
10k views

Should access permissions and roles be included in payload of JWT?

Should information about the permissions and roles of the client be included in JWT? Having such information in JWT token will be very helpful as everytime a valid token comes, it would be easier to ...
user avatar
2 votes
1 answer
105 views

Is it a good idea to reload the page every few failed login attempt?

I was reading about bruteforce login attack and one of the solution to prevent users from trying too many passwords in short amount of time is to add exponential delay for every failed login. But ...
user avatar
1 vote
1 answer
804 views

API design for multi-tenant web app - how to identify users from another system?

I have a multi-tenant web application that allows authenticated users to make changes to their application instance - making comments as an example. I'd like to build an API that allows a user of any ...
user avatar
1 vote
2 answers
447 views

token authentication security best practice

So I'm trying a few token based authentication in Laravel, each user have token they can use to access certain database. But there is something I still don't understand from these tutorial. The ...
user avatar
4 votes
3 answers
2k views

Token based vs session based authentication in back-end

I'm trying to build an application by creating an RESTful API(Koa.js) to communicate with clients(Web with React and Mobile with Ionic). But I'm facing issues when dealing with authentication. So my ...
user avatar
1 vote
2 answers
8k views

Ways to authenticate and redirect with decoupled front-end web application

I have a coupled web application (frontend and api backend served from the same application). It's worked well for our needs but I've been curious about the differences that would go into having a ...
user avatar
1 vote
1 answer
79 views

Showing confidential to a customer info without having him to create an account: GET or POST approach?

There's a website where a person should pay to get some service/product. After a person has made a reservation/product by paid for it, I want to allow him to track the progress without having to or ...
user avatar
  • 13
1 vote
1 answer
651 views

Authorization and Domain Model

I have an enterprise system that is represented by a domain model, part of the requirement that the system should limit access to some of the features based on privileges of the logged in user. ...
user avatar
  • 359
3 votes
1 answer
509 views

How to delegate the refresh token renewal in a SOA

So, we've got SOA on the backend (BE) and on the frontend (FE) we've got micro-frontends (the separate micro-frontends are loaded as components into the frontend app when needed, so internal process ...
user avatar
3 votes
1 answer
839 views

Designing authentication and authorisation micro service

Background: There are three different applications A, B and C and they all share same user details but I had to implement authentication in each of them which was duplication of effort. After some ...
user avatar
  • 2,106
0 votes
1 answer
84 views

Login to application based on profile created on another application

I have a "difficult" problem that i am not sure how should i approach it. Basically i have a mobile app, that has a server side (in Go) and the appropriate base (PSSQL). User can register via the ...
user avatar
  • 19
0 votes
1 answer
119 views

Are user generated PW's a thing of the past for most apps?

I'm making a online game where I need to preserve some things for the players so each will have an account. However, I don't want to get into the business of storing user created passwords since that'...
user avatar
12 votes
1 answer
4k views

Microservice Architecture - using Auth Server as a User Resource server

I'm designing an application based on microservices architecture, In this application I will need Auth microservice, Also I will need to store some extra User information such as, perhaps, multiple ...
user avatar
2 votes
2 answers
123 views

How can I authenticate/approve a user and still maintain anonymity in a web application?

This is a systems architecture question. I'm in the process of planning an online platform that will collect people's medical information. Because of the extremely sensitive nature of the data being ...
user avatar
0 votes
2 answers
2k views

When to check if the user is logged in?

I have an app with an optional login where some functionality requires the user to login. When checking if the user is logged in I use a framework that runs an async function that requests an access ...
user avatar
6 votes
2 answers
980 views

How do you handle JWT expiration for long running calls?

Currently we are debating over securing our multiple micro-services. The major concern is that the JWT token provided to us will expire before the call is finished. (This is in the synchronous design) ...
user avatar
2 votes
1 answer
3k views

Storing an id of a shopping cart in a cookie for unauthenticated user

I want to implement the "shopping cart" feature on my website. Both anonymous/unauthenticated and authenticated can have it. While it's clear how to implement it for an authenticated user, it's not ...
user avatar
  • 21
0 votes
2 answers
2k views

Integrate Web API Services with multiple authentication services

In a multi-tenant deployment of Web application, How can the Asp.Net Core Web API services be designed to work with different authorization services? The Web applications use OAuth and JWT Bearer ...
user avatar
  • 153
1 vote
2 answers
735 views

Is there a valid alternative to HTTP headers for sending auth credentials

I have built simple auth for REST servers in academic projects. I always used the headers to pass the credentials. This is probably just because every tutorial I've ever seen did it this way. ...
user avatar
  • 119
-1 votes
1 answer
86 views

Does Policy-Based authentication remove refactoring security?

I understand Role Based Security. I have read about Policy Based. I have read what others call Activity Based. What I want to know is if I do Policy-Based, am I avoiding what Role-Based requires and ...
user avatar
  • 3,629
2 votes
2 answers
248 views

How to debug in visual studio 2015 when your web app. need to login via another web app?

My web app (under development) need to login via http://devWebServer/ExtApp/login.aspx After login via address above, it will pass cookie to http://devWebServer/myApp/Login/Default.aspx and continue ...
user avatar
  • 219
2 votes
1 answer
323 views

How to use social sign in with my PHP website?

I have a website built on PHP, and now I want users to be able to log in. I do not want to take care of user management myself, so I'm thinking that social sign in would be convenient both for myself ...
user avatar
  • 405
1 vote
1 answer
338 views

Creating JWT token internally

I need to implement JWT tokens in my ASP.NET Core API app to handle authorization. My question is, what is the risk of generating my own JWT token within my API app as opposed to having it handled ...
user avatar
  • 333
2 votes
4 answers
681 views

Synonym for "Authorization"?

I think a lot of new comers get confused because these two terms look and sound similar: Authentication Authorization I think "Authentication" is well known, I will use this term. But for some docs ...
user avatar
  • 180
1 vote
2 answers
2k views

How to secure web services when authentication is done at client side (frontend)

I have web application which structure is as- webapi : django web services [NOT REST] no security implemented frontend : Angular2. authentication implemented via SAML Database : Mongodb Can you ...
user avatar
4 votes
1 answer
352 views

Service bus and authentication

I have a system that consists of several applications. Often these applications need to talk to each other. Sometimes it can make sense to use a "service account" for the communication but other ...
user avatar
2 votes
2 answers
1k views

Best practices in saving user data when using identity provider like AWS Cognito

So in my mind, the usual users table that we are used to having, is going to split in two: whatever data is within the Identity Provider the domain specific data (user.facialHairStyle) is going to ...
user avatar
  • 121
1 vote
1 answer
102 views

How to manage development credentials vs generic (example) ones?

I am an amateur developper and would like to share some of my code via GitHub or GitLabs. The problem I am trying to resolve is that I have a configuration file with my real credentials (used during ...
user avatar
  • 1,541
0 votes
2 answers
567 views

How do I resend a confirmation token, if two different people try to register the same email address?

I am designing a REST API that allows users to register and authenticate with an email address and a password. Before being able to authenticate, I want to ensure that the user owns the email address ...
user avatar
3 votes
0 answers
1k views

DDD problem with aggregate design (users, authentication)

We're having a bounded context dealing with payments. I'm trying to model case, where Merchant can create another merchant and inherit some of its properties in this case: users that are needed for ...
user avatar
  • 217
2 votes
2 answers
2k views

How are resource owner credentials stored in OAuth2

I have been researching oauth2 as of recent and trying to draft an implementation plan. However I seem to be missing something, or something hasn't quite clicked yet. I plan on creating an api and ...
user avatar
22 votes
3 answers
13k views

Is it bad practice to store a user's email address in a JWT?

I'm using JWTs for user auth in a web application. I have a user db where each user's unique ID is their email address. To identify the subject of the JWT, I currently have a claim which stores the ...
user avatar
0 votes
1 answer
98 views

Api and Auth tightly coupled circular dependancy

I am programming an application and am having trouble finding a good architecture for some of its components. As part of the front-end app, I have a user authentication system and an API that allows ...
user avatar
20 votes
1 answer
17k views

Difference between 'aud' and 'iss' in jwt

I want to implement a more robust authentication service and jwt is a big part of what I want to do, and I understand how to write the code, but I'm having a little trouble understanding the ...
user avatar
12 votes
2 answers
12k views

cookie vs. session vs jwt

I am reading up on authentication/authorization in web applications. Could anybody confirm/correct my current knowledge? Cookies: in their early version, a text file with a unique client Id an all ...
user avatar
1 vote
1 answer
5k views

Microservices session data when communicating internally

I'm not sure the title is correct, so please advise if you think of a better title. The scenario is: We have an API gateway that exposes REST API to our clients (web and mobile apps). We have a "...
user avatar
  • 111
0 votes
3 answers
158 views

Handling one-user-only applications

I am planning creating a small personal blog application that handles only one user - the content author, let's call that user admin. There would not be any registration option, only a hidden login ...
user avatar
  • 103

1 2 3
4
5
8