Questions tagged [oauth]
The oauth tag has no usage guidance.
55
questions
0
votes
0
answers
43
views
API authentication for iOS applications
I am currently working on my own iOS application and am going to be using a locally developed API for fetching data. I wanted to outline my current account sign-in architecture and verify this is ...
- 17
0
votes
1
answer
280
views
Any way to forward an auth session from OAuth system to another system (with API key)?
Description
This is a long shot, but I'm in dire need of advice. If you know of a more appropriate forum for this type of question please share!
I'm working with a legacy OAuth system using email + ...
- 1
0
votes
2
answers
350
views
If my API depends on a third party OAUTH2 provider (Microsoft) - how do I write tests to test my API endpoints?
this is a followup question to the following StackExchange question -
If you had a medium size company, several developers - but zero tests written in your REST API's - where would you start?
At the ...
- 289
0
votes
0
answers
38
views
Synchronising OIDC Provider and User Table
I asked this question on SO which is related to this.
In this question, I propose exchanging a token from my OIDC provider for a token in my own custom OIDC provider, which becomes the ultimate token ...
- 675
-1
votes
1
answer
554
views
Can I call a WCF endpoint from ASP.Net Web API?
I have a web api with controller methods that use rest http(post/get calls).
Clients consume this API with normal httpclient calls and I pass an http response back.
My use case is I have a legacy ...
1
vote
1
answer
366
views
Passing an OAuth Token between services with Zero Trust and audience checks
Let's say, we're using an OAuth / OpenID Connect (OIDC) flow (in a Zero-Trust situation) to secure two APIs: ServiceA and ServiceB. To implement some of the functionality of ServiceA, it depends on ...
- 326
1
vote
1
answer
180
views
Best way to renew OAuth token before expiry
I am building a simple application built in Rails that allows the client to connect to a third party api to sync customer data.
The customer inputs their username and password and my application ...
- 113
3
votes
1
answer
356
views
Store OAuth 2.0 tokens for use in testing and CI/CD
I have a web application where users must authenticate with a 3rd-party OAuth 2.0 service in order to do what they need to do in the app. On initial registration/login, they will connect with the ...
- 139
1
vote
0
answers
44
views
Defining custom OIDC provider with delegating authentication to another OIDC provider and using own authorization database
I wanted to ask about your ideas on how to solve the problem that I have to solve in my application (App1). This is the classic Fronted + Backend (Angular + Java EE) application to which I am ...
- 111
0
votes
0
answers
50
views
Proper way to use oauth with external auth server and an api
I have an api server that relies on an auth server (both owned by the same company). Once the client gets a grant from the auth server, it is no longer needed, because the only information I need from ...
- 9
0
votes
1
answer
150
views
OAuth2.0 Grant Type for User Logged In With Google
I have a confusion. So, in OAuth2.0 there are 4 types of Grant (Authorization Code, Password, Client Credentials and Implicit). In my use case, I have two login scenario. The first one is using ...
6
votes
1
answer
1k
views
Client generated JWT
I'm working with a 3rd party company who are providing an API along with an unusual security approach.
The security approach is essentially using a JWT by itself (no oauth). What's odd is that they'...
- 517
13
votes
1
answer
3k
views
How to handle per-resource (fine grained) permissions in OAuth?
I'm designing an app architecture using OAuth 2.0. I have a separate Resource Server and Authorization Server. The latter keeps a database of users and the scopes available to them.
Now, my question ...
- 361
1
vote
1
answer
676
views
JWT with shared secret to share data between services of different vendors
We offer a platform that provides certain data processing services. All our APIs are accessible via RESTful services. All services require authentication and authorization to work properly (user/...
- 113
1
vote
1
answer
2k
views
Can I have a client-side-only web application keep OAuth tokens?
I'm only a student, so forgive me if my understanding is poor or my ideas poorly expressed.
I want to create a purely client-side browser application that works with the user's Dropbox account. They ...
- 125
0
votes
2
answers
2k
views
Integrate Web API Services with multiple authentication services
In a multi-tenant deployment of Web application, How can the Asp.Net Core Web API services be designed to work with different authorization services? The Web applications use OAuth and JWT Bearer ...
- 153
1
vote
0
answers
442
views
Storing temporary data received through an API call
I am working on a web app which uses Google oAuth flow and Drive API to list user's Google Drive files. With the access_type set to online, my app doesn't receive a refresh token.
My question is, ...
- 19
1
vote
1
answer
2k
views
How to prevent users from decompiling app to find API key?
I'm currently building an Android app that uses OAuth to sign in to a service. With OAuth, I need to provide a client ID and a client secret to the service so it can identify my app. Right now, I'm ...
- 358
2
votes
1
answer
1k
views
How often should I be checking access tokens if I am using OAuth only for signing in to my app?
Disclaimer: I am asking this question with regard to a school project. The purpose of the project is hands-on learning and simulation of a real-world software development project. I am fully aware ...
- 139
1
vote
1
answer
9k
views
How to integrate Laravel passport, oauth scopes and roles and permissions
I am developing SPA in angular and backend API in laravel 5.3. I have integrated Laravel Passport for oauth.
I have to make roles and permissions implementation using views on tables from other ...
- 111
3
votes
0
answers
251
views
Handling OAuth callback URL
I've been reading the OAuth 1.0a RFC: https://www.rfc-editor.org/rfc/rfc5849 . Most of it is pretty clear. However, I have a few questions:
I can't understand why the oauth_callback is sent when ...
- 279
7
votes
1
answer
360
views
Is OAuth 2.0 ok for building a container of applications?
I need to create a container app which contains several apps (imagine something like iCloud): once I've been logged in, I can see all the apps by means of icons, click on them and use them (a new tab/...
- 417
2
votes
2
answers
122
views
Proper OAuth2 Grant
I'm looking to build a mobile application (iOS / Android) that digests information from a secured API. The API will require OAuth2 authentication to be able to digest any resources. The service I'm ...
- 23
0
votes
1
answer
668
views
What's the most straightforward way to integrate my company's custom authentication with ASP.NET SSO?
My company has a series of WinForms applications that pretty crudely provides authentication by checking usernames and passwords directly against the database (with a little hashing).
I have a fair ...
- 1
127
votes
4
answers
69k
views
REST API security Stored token vs JWT vs OAuth
I am still trying to find the best security solution for protecting REST API, because the amount of mobile applications and API is increasing every day.
I have tried different ways of authentication,...
- 1,558
26
votes
5
answers
34k
views
OAuth2 ROPC vs Basic Auth for public REST APIs?
The specific use case I'm interested in here is authenticating REST clients against publicly-available server endpoints (such as a public REST API).
The simplest solution here is Basic Auth. But I ...
- 4,840
1
vote
1
answer
91
views
OAuth/OAuth2 RFC question
This question is about a line from the OAuth2 rfc - https://www.rfc-editor.org/rfc/rfc6749
In Section 2.3, there is this line
The client MUST NOT use more than one authentication method in each ...
- 441
1
vote
1
answer
1k
views
oauth 2 authenticate with other authorization server
Let's assume i have a mobile app backed up by a Server. the server is both an Authorization and Resource Server.
Now i want to enable users to register / login to the app using Facebook API. After ...
- 227
5
votes
1
answer
2k
views
How can I build a seamless login for multiple sites using OAuth2?
The question is admittedly a bit leading, but what I mean to ask is:
If a user logs into into site X, is there a way to automatically log into site Y? Site Y utilises single sign-on via OAuth2 ...
- 491
4
votes
1
answer
3k
views
OAuth 2.0 - Should Client Identifier be unique for each user or only by client type?
Oauth 2 Specification, Section 2.2. (Client Identifier) states -
The authorization server issues the registered client a client
identifier -- a unique string representing the registration
...
- 143
1
vote
1
answer
295
views
Is OAuth suitable for this scenario?
I need to create a simple web application for track expenses, with some basic actions (user must be able to create an account and log in, list expenses, edit them, etc) with a REST API for each one, ...
- 13
2
votes
1
answer
1k
views
Access Token Verification
I have spent quite a few days reading up on Oauth and token based security measures for REST API's and I am currently looking at implementing an Oauth based authentication approach almost exactly like ...
- 121
1
vote
1
answer
2k
views
Implicit OAuth2 endpoint vs. cookies
I currently have an app which basically runs two halves of an API - a restful API for the web app, and a synchronisation API for the native clients (all over SSL).
The web app is completely ...
- 201
3
votes
0
answers
103
views
How do I authenticate users from facebook/twitter?
I need to build a site for a mobile app that allows users to sign in with facebook/twitter or sign up as a new user (traditional username/password).
No matter which method the user chooses, they ...
- 319
0
votes
1
answer
776
views
Is api user authentication with oauth possible for both email/pw and 3rd party services
I have an api only application (rails-api) and I'm looking to authorize a user on both email/password or 3rd party services like facebook or twitter etc, so I know I will have to use Oauth at some ...
- 103
9
votes
1
answer
627
views
Facebook authentication with an Authoritative Server for a Flash Game
I'm working on a multiplatform game in Flash. This game utilizes Photon Server for authoritative physics and user statistics tracking. I'm looking to leverage Facebook authentication as an alternative ...
- 264
8
votes
3
answers
2k
views
OAuth alternative for a 2 party system
I'm writing a RESTful service (Java EE, Jersey) and a client application that communicates with it, and I wish to secure it and store any usernames & passwords dedicated in my own database.
I do ...
- 183
4
votes
1
answer
3k
views
How to bypass Oauth2 authentication when the client and resource owner is the same entity?
We are currently working on using an API provided by Mercado Libre which is a maket place for selling various goods.
Their APIs use OAuth 2.0 for authentication.
The problem is that OAuth 2.0 as ...
- 6,558
2
votes
0
answers
117
views
Switching between Azure Mobile Services vs my own implementation. Will UIDs change?
I'm looking at Azure Mobile Services, particularly the Authentication part (which I believe relies exclusively on OAUTH 1 or 2).
I want to make sure that my application isn't tightly coupled to the ...
- 6,038
24
votes
4
answers
7k
views
How should I architect a RESTful webservice to use 3rd party (i.e. Google, Facebook, Twitter) for authentication?
For my job we have a nice RESTful webservice we've built out that we use to drive a couple websites we have. Basically the webservice lets you create and work with support tickets, and the website is ...
- 373
1
vote
1
answer
831
views
Using oAuth as a complement to an existing authentication system?
I am hoping this is the correct stack exchange to be asking this, here goes.
I am building a new website whereby it implements its own custom login system. You simply register your username, email ...
- 113
4
votes
0
answers
2k
views
Connecting with OAuth, dealing with logout and browser sessions
I work on a open-source web application (Moodle) which connects to a number of external services such as Google Drive, Dropbox etc. to allow users to exchange files with these services.
Primarily we ...
- 141
7
votes
1
answer
588
views
Does it make sense to implement OAuth for a 2 party system?
I'm under the impression that OAuth is for authentication between three parties. Does it make sense to implement OAuth in a context where there is just a client and server.
We have a server, and a ...
- 1,552
1
vote
1
answer
4k
views
GMail API for a small app (Rails? Javascript? PHP?)
I want to create an app that accesses the GMail API, but I'm finding that it isn't as simple as I thought it might be.
I'm hoping somebody in the community here might have some experience working ...
- 157
9
votes
1
answer
4k
views
How should I handle a redirect to an identity provider during a web api data request
Scenario
I have a single-page web app consisting purely of html, css, and javascript. After initial load and during use, it updates various views with data from one or more RESTful apis via ajax ...
- 193
6
votes
1
answer
3k
views
Performing client-side OAuth authorized Twitter API calls versus server side, how much of a difference is there in terms of performance?
I'm working on a Twitter application in Ruby on Rails. One of the biggest arguments that I have with other people on the project is the method of calling the Twitter API. Before, everything was done ...
- 3,052
2
votes
1
answer
463
views
What's the benefit of Azure ACS if ASP.NET 4.5 includes OAuth and OpenID providers? [closed]
Azure ACS offers OAuth and OpenID providers, and now that ASP.NET 4.5 offers the same thing, without the added cost, is there any reason for a .NET developer to consider ACS?
(Disclaimer, I don't ...
- 6,038
0
votes
1
answer
4k
views
Should OAuth token be shared to implement SSO?
What's a commonly accepted way of implementing SSO using a third party OAuth provider?
I have a server with user resources associated with server's user ID, the user ID also has a Facebook user ID ...
- 249
4
votes
3
answers
725
views
OAuth2 vs Public API
My understanding of OAuth (2.0) is that its a software stack and protocol to allow 2+ web apps to share information about a single end user. User A is a member of Site B and Site C; Site B wants to ...
- 2,027
6
votes
1
answer
2k
views
iOS and Server: OAuth strategy
I'm trying to working how to handle authentication when I have iOS clients accessing a Node.js server and want to use services such as Google, Facebook etc to provide basic authentication for my ...
- 1,279