Questions tagged [oauth]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
112 views

Any way to forward an auth session from OAuth system to another system (with API key)?

Description This is a long shot, but I'm in dire need of advice. If you know of a more appropriate forum for this type of question please share! I'm working with a legacy OAuth system using email + ...
  • 1
0 votes
0 answers
42 views

Is it possible or does it make sense to use OAuth 2.0 CodeFlow PKCE for an internal authentication provider?

Suppose that in a solution, there is IdentityServer as authentication provider and there is some APIs which need to be protected using OAuth 2.0 CodeFlow PKCE. I have read in several places that a ...
0 votes
2 answers
190 views

If my API depends on a third party OAUTH2 provider (Microsoft) - how do I write tests to test my API endpoints?

this is a followup question to the following StackExchange question - If you had a medium size company, several developers - but zero tests written in your REST API's - where would you start? At the ...
  • 279
0 votes
0 answers
31 views

Synchronising OIDC Provider and User Table

I asked this question on SO which is related to this. In this question, I propose exchanging a token from my OIDC provider for a token in my own custom OIDC provider, which becomes the ultimate token ...
-1 votes
1 answer
177 views

Can I call a WCF endpoint from ASP.Net Web API?

I have a web api with controller methods that use rest http(post/get calls). Clients consume this API with normal httpclient calls and I pass an http response back. My use case is I have a legacy ...
0 votes
1 answer
182 views

Passing an OAuth Token between services with Zero Trust and audience checks

Let's say, we're using an OAuth / OpenID Connect (OIDC) flow (in a Zero-Trust situation) to secure two APIs: ServiceA and ServiceB. To implement some of the functionality of ServiceA, it depends on ...
  • 306
1 vote
1 answer
91 views

Best way to renew OAuth token before expiry

I am building a simple application built in Rails that allows the client to connect to a third party api to sync customer data. The customer inputs their username and password and my application ...
3 votes
1 answer
208 views

Store OAuth 2.0 tokens for use in testing and CI/CD

I have a web application where users must authenticate with a 3rd-party OAuth 2.0 service in order to do what they need to do in the app. On initial registration/login, they will connect with the ...
1 vote
0 answers
22 views

Defining custom OIDC provider with delegating authentication to another OIDC provider and using own authorization database

I wanted to ask about your ideas on how to solve the problem that I have to solve in my application (App1). This is the classic Fronted + Backend (Angular + Java EE) application to which I am ...
  • 111
0 votes
0 answers
46 views

Proper way to use oauth with external auth server and an api

I have an api server that relies on an auth server (both owned by the same company). Once the client gets a grant from the auth server, it is no longer needed, because the only information I need from ...
0 votes
1 answer
124 views

OAuth2.0 Grant Type for User Logged In With Google

I have a confusion. So, in OAuth2.0 there are 4 types of Grant (Authorization Code, Password, Client Credentials and Implicit). In my use case, I have two login scenario. The first one is using ...
6 votes
1 answer
744 views

Client generated JWT

I'm working with a 3rd party company who are providing an API along with an unusual security approach. The security approach is essentially using a JWT by itself (no oauth). What's odd is that they'...
  • 517
13 votes
1 answer
3k views

How to handle per-resource (fine grained) permissions in OAuth?

I'm designing an app architecture using OAuth 2.0. I have a separate Resource Server and Authorization Server. The latter keeps a database of users and the scopes available to them. Now, my question ...
  • 361
1 vote
1 answer
547 views

JWT with shared secret to share data between services of different vendors

We offer a platform that provides certain data processing services. All our APIs are accessible via RESTful services. All services require authentication and authorization to work properly (user/...
  • 113
1 vote
1 answer
2k views

Can I have a client-side-only web application keep OAuth tokens?

I'm only a student, so forgive me if my understanding is poor or my ideas poorly expressed. I want to create a purely client-side browser application that works with the user's Dropbox account. They ...
0 votes
2 answers
2k views

Integrate Web API Services with multiple authentication services

In a multi-tenant deployment of Web application, How can the Asp.Net Core Web API services be designed to work with different authorization services? The Web applications use OAuth and JWT Bearer ...
  • 153
1 vote
0 answers
356 views

Storing temporary data received through an API call

I am working on a web app which uses Google oAuth flow and Drive API to list user's Google Drive files. With the access_type set to online, my app doesn't receive a refresh token. My question is, ...
  • 19
1 vote
1 answer
2k views

How to prevent users from decompiling app to find API key?

I'm currently building an Android app that uses OAuth to sign in to a service. With OAuth, I need to provide a client ID and a client secret to the service so it can identify my app. Right now, I'm ...
  • 358
2 votes
1 answer
898 views

How often should I be checking access tokens if I am using OAuth only for signing in to my app?

Disclaimer: I am asking this question with regard to a school project. The purpose of the project is hands-on learning and simulation of a real-world software development project. I am fully aware ...
  • 139
1 vote
1 answer
9k views

How to integrate Laravel passport, oauth scopes and roles and permissions

I am developing SPA in angular and backend API in laravel 5.3. I have integrated Laravel Passport for oauth. I have to make roles and permissions implementation using views on tables from other ...
  • 111
3 votes
0 answers
228 views

Handling OAuth callback URL

I've been reading the OAuth 1.0a RFC: https://www.rfc-editor.org/rfc/rfc5849 . Most of it is pretty clear. However, I have a few questions: I can't understand why the oauth_callback is sent when ...
7 votes
1 answer
328 views

Is OAuth 2.0 ok for building a container of applications?

I need to create a container app which contains several apps (imagine something like iCloud): once I've been logged in, I can see all the apps by means of icons, click on them and use them (a new tab/...
  • 397
2 votes
2 answers
115 views

Proper OAuth2 Grant

I'm looking to build a mobile application (iOS / Android) that digests information from a secured API. The API will require OAuth2 authentication to be able to digest any resources. The service I'm ...
0 votes
1 answer
640 views

What's the most straightforward way to integrate my company's custom authentication with ASP.NET SSO?

My company has a series of WinForms applications that pretty crudely provides authentication by checking usernames and passwords directly against the database (with a little hashing). I have a fair ...
  • 1
128 votes
4 answers
69k views

REST API security Stored token vs JWT vs OAuth

I am still trying to find the best security solution for protecting REST API, because the amount of mobile applications and API is increasing every day. I have tried different ways of authentication,...
  • 1,558
26 votes
5 answers
33k views

OAuth2 ROPC vs Basic Auth for public REST APIs?

The specific use case I'm interested in here is authenticating REST clients against publicly-available server endpoints (such as a public REST API). The simplest solution here is Basic Auth. But I ...
  • 4,710
1 vote
1 answer
81 views

OAuth/OAuth2 RFC question

This question is about a line from the OAuth2 rfc - https://www.rfc-editor.org/rfc/rfc6749 In Section 2.3, there is this line The client MUST NOT use more than one authentication method in each ...
  • 441
1 vote
1 answer
1k views

oauth 2 authenticate with other authorization server

Let's assume i have a mobile app backed up by a Server. the server is both an Authorization and Resource Server. Now i want to enable users to register / login to the app using Facebook API. After ...
  • 227
5 votes
1 answer
2k views

How can I build a seamless login for multiple sites using OAuth2?

The question is admittedly a bit leading, but what I mean to ask is: If a user logs into into site X, is there a way to automatically log into site Y? Site Y utilises single sign-on via OAuth2 ...
4 votes
1 answer
2k views

OAuth 2.0 - Should Client Identifier be unique for each user or only by client type?

Oauth 2 Specification, Section 2.2. (Client Identifier) states - The authorization server issues the registered client a client identifier -- a unique string representing the registration ...
  • 143
1 vote
1 answer
286 views

Is OAuth suitable for this scenario?

I need to create a simple web application for track expenses, with some basic actions (user must be able to create an account and log in, list expenses, edit them, etc) with a REST API for each one, ...
2 votes
1 answer
1k views

Access Token Verification

I have spent quite a few days reading up on Oauth and token based security measures for REST API's and I am currently looking at implementing an Oauth based authentication approach almost exactly like ...
1 vote
1 answer
2k views

Implicit OAuth2 endpoint vs. cookies

I currently have an app which basically runs two halves of an API - a restful API for the web app, and a synchronisation API for the native clients (all over SSL). The web app is completely ...
  • 201
3 votes
0 answers
103 views

How do I authenticate users from facebook/twitter?

I need to build a site for a mobile app that allows users to sign in with facebook/twitter or sign up as a new user (traditional username/password). No matter which method the user chooses, they ...
  • 319
0 votes
1 answer
765 views

Is api user authentication with oauth possible for both email/pw and 3rd party services

I have an api only application (rails-api) and I'm looking to authorize a user on both email/password or 3rd party services like facebook or twitter etc, so I know I will have to use Oauth at some ...
  • 103
9 votes
1 answer
536 views

Facebook authentication with an Authoritative Server for a Flash Game

I'm working on a multiplatform game in Flash. This game utilizes Photon Server for authoritative physics and user statistics tracking. I'm looking to leverage Facebook authentication as an alternative ...
8 votes
3 answers
2k views

OAuth alternative for a 2 party system

I'm writing a RESTful service (Java EE, Jersey) and a client application that communicates with it, and I wish to secure it and store any usernames & passwords dedicated in my own database. I do ...
  • 183
4 votes
1 answer
2k views

How to bypass Oauth2 authentication when the client and resource owner is the same entity?

We are currently working on using an API provided by Mercado Libre which is a maket place for selling various goods. Their APIs use OAuth 2.0 for authentication. The problem is that OAuth 2.0 as ...
  • 6,538
2 votes
0 answers
117 views

Switching between Azure Mobile Services vs my own implementation. Will UIDs change?

I'm looking at Azure Mobile Services, particularly the Authentication part (which I believe relies exclusively on OAUTH 1 or 2). I want to make sure that my application isn't tightly coupled to the ...
24 votes
4 answers
7k views

How should I architect a RESTful webservice to use 3rd party (i.e. Google, Facebook, Twitter) for authentication?

For my job we have a nice RESTful webservice we've built out that we use to drive a couple websites we have. Basically the webservice lets you create and work with support tickets, and the website is ...
1 vote
1 answer
822 views

Using oAuth as a complement to an existing authentication system?

I am hoping this is the correct stack exchange to be asking this, here goes. I am building a new website whereby it implements its own custom login system. You simply register your username, email ...
  • 113
4 votes
0 answers
2k views

Connecting with OAuth, dealing with logout and browser sessions

I work on a open-source web application (Moodle) which connects to a number of external services such as Google Drive, Dropbox etc. to allow users to exchange files with these services. Primarily we ...
7 votes
1 answer
542 views

Does it make sense to implement OAuth for a 2 party system?

I'm under the impression that OAuth is for authentication between three parties. Does it make sense to implement OAuth in a context where there is just a client and server. We have a server, and a ...
  • 1,542
1 vote
1 answer
4k views

GMail API for a small app (Rails? Javascript? PHP?)

I want to create an app that accesses the GMail API, but I'm finding that it isn't as simple as I thought it might be. I'm hoping somebody in the community here might have some experience working ...
  • 157
8 votes
1 answer
3k views

How should I handle a redirect to an identity provider during a web api data request

Scenario I have a single-page web app consisting purely of html, css, and javascript. After initial load and during use, it updates various views with data from one or more RESTful apis via ajax ...
  • 183
6 votes
1 answer
3k views

Performing client-side OAuth authorized Twitter API calls versus server side, how much of a difference is there in terms of performance?

I'm working on a Twitter application in Ruby on Rails. One of the biggest arguments that I have with other people on the project is the method of calling the Twitter API. Before, everything was done ...
2 votes
1 answer
461 views

What's the benefit of Azure ACS if ASP.NET 4.5 includes OAuth and OpenID providers? [closed]

Azure ACS offers OAuth and OpenID providers, and now that ASP.NET 4.5 offers the same thing, without the added cost, is there any reason for a .NET developer to consider ACS? (Disclaimer, I don't ...
0 votes
1 answer
3k views

Should OAuth token be shared to implement SSO?

What's a commonly accepted way of implementing SSO using a third party OAuth provider? I have a server with user resources associated with server's user ID, the user ID also has a Facebook user ID ...
  • 249
4 votes
3 answers
721 views

OAuth2 vs Public API

My understanding of OAuth (2.0) is that its a software stack and protocol to allow 2+ web apps to share information about a single end user. User A is a member of Site B and Site C; Site B wants to ...
  • 1,997
6 votes
1 answer
2k views

iOS and Server: OAuth strategy

I'm trying to working how to handle authentication when I have iOS clients accessing a Node.js server and want to use services such as Google, Facebook etc to provide basic authentication for my ...
  • 1,239