Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [oauth]

The tag has no usage guidance.

1
vote
0answers
38 views

Oauth 1 for background services and Server to Server communication

Background: I have an internet service that acts like a middle ware type solution. Many of the system I talk to use the standard username/password or offline token exchange for authentication/...
3
votes
1answer
343 views

How to handle per-resource (fine grained) permissions in OAuth?

I'm designing an app architecture using OAuth 2.0. I have a separate Resource Server and Authorization Server. The latter keeps a database of users and the scopes available to them. Now, my question ...
1
vote
1answer
107 views

JWT with shared secret to share data between services of different vendors

We offer a platform that provides certain data processing services. All our APIs are accessible via RESTful services. All services require authentication and authorization to work properly (user/...
1
vote
1answer
198 views

Can I have a client-side-only web application keep OAuth tokens?

I'm only a student, so forgive me if my understanding is poor or my ideas poorly expressed. I want to create a purely client-side browser application that works with the user's Dropbox account. They ...
0
votes
2answers
706 views

Integrate Web API Services with multiple authentication services

In a multi-tenant deployment of Web application, How can the Asp.Net Core Web API services be designed to work with different authorization services? The Web applications use OAuth and JWT Bearer ...
1
vote
0answers
148 views

Storing temporary data received through an API call

I am working on a web app which uses Google oAuth flow and Drive API to list user's Google Drive files. With the access_type set to online, my app doesn't receive a refresh token. My question is, ...
1
vote
0answers
274 views

Suggestions on building an authentication system with Django Rest Framework, Mongo and auth0

I am trying to get some suggestions on how I should architect the authentication system for a Django rest framework API. The stack looks like this: Django REST framework Django REST framework ...
1
vote
1answer
1k views

How to prevent users from decompiling app to find API key?

I'm currently building an Android app that uses OAuth to sign in to a service. With OAuth, I need to provide a client ID and a client secret to the service so it can identify my app. Right now, I'm ...
1
vote
1answer
264 views

How often should I be checking access tokens if I am using OAuth only for signing in to my app?

Disclaimer: I am asking this question with regard to a school project. The purpose of the project is hands-on learning and simulation of a real-world software development project. I am fully aware ...
1
vote
1answer
4k views

How to integrate Laravel passport, oauth scopes and roles and permissions

I am developing SPA in angular and backend API in laravel 5.3. I have integrated Laravel Passport for oauth. I have to make roles and permissions implementation using views on tables from other ...
2
votes
0answers
165 views

Handling OAuth callback URL

I've been reading the OAuth 1.0a RFC: https://tools.ietf.org/html/rfc5849 . Most of it is pretty clear. However, I have a few questions: I can't understand why the oauth_callback is sent when ...
7
votes
1answer
216 views

Is OAuth 2.0 ok for building a container of applications?

I need to create a container app which contains several apps (imagine something like iCloud): once I've been logged in, I can see all the apps by means of icons, click on them and use them (a new tab/...
2
votes
2answers
97 views

Proper OAuth2 Grant

I'm looking to build a mobile application (iOS / Android) that digests information from a secured API. The API will require OAuth2 authentication to be able to digest any resources. The service I'm ...
0
votes
1answer
548 views

What's the most straightforward way to integrate my company's custom authentication with ASP.NET SSO?

My company has a series of WinForms applications that pretty crudely provides authentication by checking usernames and passwords directly against the database (with a little hashing). I have a fair ...
93
votes
3answers
50k views

REST API security Stored token vs JWT vs OAuth

I am still trying to find the best security solution for protecting REST API, because the amount of mobile applications and API is increasing every day. I have tried different ways of authentication,...
19
votes
5answers
19k views

OAuth2 ROPC vs Basic Auth for public REST APIs?

The specific use case I'm interested in here is authenticating REST clients against publicly-available server endpoints (such as a public REST API). The simplest solution here is Basic Auth. But I ...
1
vote
1answer
79 views

OAuth/OAuth2 RFC question

This question is about a line from the OAuth2 rfc - https://tools.ietf.org/html/rfc6749 In Section 2.3, there is this line The client MUST NOT use more than one authentication method in each request....
1
vote
1answer
950 views

oauth 2 authenticate with other authorization server

Let's assume i have a mobile app backed up by a Server. the server is both an Authorization and Resource Server. Now i want to enable users to register / login to the app using Facebook API. After ...
5
votes
1answer
832 views

How can I build a seamless login for multiple sites using OAuth2?

The question is admittedly a bit leading, but what I mean to ask is: If a user logs into into site X, is there a way to automatically log into site Y? Site Y utilises single sign-on via OAuth2 ...
4
votes
1answer
1k views

OAuth 2.0 - Should Client Identifier be unique for each user or only by client type?

Oauth 2 Specification, Section 2.2. (Client Identifier) states - The authorization server issues the registered client a client identifier -- a unique string representing the registration ...
1
vote
0answers
79 views

oAuth Flow Question in a SSO scenario

I have the following simple scenario: Multiple web applications share SSO functionality An Authorization Server is used as the central identity service for the web applications Users are ...
1
vote
1answer
258 views

Is OAuth suitable for this scenario?

I need to create a simple web application for track expenses, with some basic actions (user must be able to create an account and log in, list expenses, edit them, etc) with a REST API for each one, ...
2
votes
1answer
915 views

Access Token Verification

I have spent quite a few days reading up on Oauth and token based security measures for REST API's and I am currently looking at implementing an Oauth based authentication approach almost exactly like ...
1
vote
1answer
1k views

Implicit OAuth2 endpoint vs. cookies

I currently have an app which basically runs two halves of an API - a restful API for the web app, and a synchronisation API for the native clients (all over SSL). The web app is completely ...
2
votes
0answers
99 views

How do I authenticate users from facebook/twitter?

I need to build a site for a mobile app that allows users to sign in with facebook/twitter or sign up as a new user (traditional username/password). No matter which method the user chooses, they ...
0
votes
1answer
741 views

Is api user authentication with oauth possible for both email/pw and 3rd party services

I have an api only application (rails-api) and I'm looking to authorize a user on both email/password or 3rd party services like facebook or twitter etc, so I know I will have to use Oauth at some ...
7
votes
0answers
390 views

Facebook authentication with an Authoritative Server for a Flash Game

I'm working on a multiplatform game in Flash. This game utilizes Photon Server for authoritative physics and user statistics tracking. I'm looking to leverage Facebook authentication as an alternative ...
6
votes
3answers
2k views

OAuth alternative for a 2 party system

I'm writing a RESTful service (Java EE, Jersey) and a client application that communicates with it, and I wish to secure it and store any usernames & passwords dedicated in my own database. I do ...
4
votes
1answer
1k views

How to bypass Oauth2 authentication when the client and resource owner is the same entity?

We are currently working on using an API provided by Mercado Libre which is a maket place for selling various goods. Their APIs use OAuth 2.0 for authentication. The problem is that OAuth 2.0 as ...
2
votes
0answers
115 views

Switching between Azure Mobile Services vs my own implementation. Will UIDs change?

I'm looking at Azure Mobile Services, particularly the Authentication part (which I believe relies exclusively on OAUTH 1 or 2). I want to make sure that my application isn't tightly coupled to the ...
24
votes
4answers
6k views

How should I architect a RESTful webservice to use 3rd party (i.e. Google, Facebook, Twitter) for authentication?

For my job we have a nice RESTful webservice we've built out that we use to drive a couple websites we have. Basically the webservice lets you create and work with support tickets, and the website is ...
1
vote
1answer
791 views

Using oAuth as a complement to an existing authentication system?

I am hoping this is the correct stack exchange to be asking this, here goes. I am building a new website whereby it implements its own custom login system. You simply register your username, email ...
4
votes
0answers
2k views

Connecting with OAuth, dealing with logout and browser sessions

I work on a open-source web application (Moodle) which connects to a number of external services such as Google Drive, Dropbox etc. to allow users to exchange files with these services. Primarily we ...
6
votes
1answer
432 views

Does it make sense to implement OAuth for a 2 party system?

I'm under the impression that OAuth is for authentication between three parties. Does it make sense to implement OAuth in a context where there is just a client and server. We have a server, and a ...
1
vote
1answer
4k views

GMail API for a small app (Rails? Javascript? PHP?)

I want to create an app that accesses the GMail API, but I'm finding that it isn't as simple as I thought it might be. I'm hoping somebody in the community here might have some experience working ...
6
votes
1answer
2k views

How should I handle a redirect to an identity provider during a web api data request

Scenario I have a single-page web app consisting purely of html, css, and javascript. After initial load and during use, it updates various views with data from one or more RESTful apis via ajax ...
6
votes
1answer
3k views

Performing client-side OAuth authorized Twitter API calls versus server side, how much of a difference is there in terms of performance?

I'm working on a Twitter application in Ruby on Rails. One of the biggest arguments that I have with other people on the project is the method of calling the Twitter API. Before, everything was done ...
2
votes
1answer
458 views

What's the benefit of Azure ACS if ASP.NET 4.5 includes OAuth and OpenID providers? [closed]

Azure ACS offers OAuth and OpenID providers, and now that ASP.NET 4.5 offers the same thing, without the added cost, is there any reason for a .NET developer to consider ACS? (Disclaimer, I don't ...
0
votes
1answer
3k views

Should OAuth token be shared to implement SSO?

What's a commonly accepted way of implementing SSO using a third party OAuth provider? I have a server with user resources associated with server's user ID, the user ID also has a Facebook user ID ...
4
votes
3answers
681 views

OAuth2 vs Public API

My understanding of OAuth (2.0) is that its a software stack and protocol to allow 2+ web apps to share information about a single end user. User A is a member of Site B and Site C; Site B wants to ...
6
votes
1answer
2k views

iOS and Server: OAuth strategy

I'm trying to working how to handle authentication when I have iOS clients accessing a Node.js server and want to use services such as Google, Facebook etc to provide basic authentication for my ...
2
votes
0answers
85 views

How can a client authorize us to collect their data from a service provider?

Our clients need to authorize our partners to release data to us. We can collect this data via a push/pull mechanism. Since our partners have never shared data before, they don't have OAuth ...
2
votes
2answers
2k views

Implementing oAuth 2 server

Do you have any pointers on how one should go about implementing the oAuth2 protocol itself? That is, the server side or the "provider" facet of OAuth2? If you have tried to implement (a part of) it,...
5
votes
1answer
1k views

Mask oAuth API key and token for pure client-side technologies

If I were to build a Twitter or Facebook application using pure client-side technologies like HTML and javascript, how would I mask/hide my API keys? For example, for Twitter I have consumer key and ...
31
votes
5answers
10k views

How do I store the OAuth v1 consumer key and secret for an open source desktop Twitter client without revealing it to the user?

I want to make a thick-client, desktop, open source twitter client. I happen to be using .NET as my language and Twitterizer as my OAuth/Twitter wrapper, and my app will likely be released as open ...
4
votes
1answer
613 views

How to solve a general authentication problem for multiple applications?

At my current job (we're in a MS environment), we have multiple deployed web applications, both inter/intra net. The internal apps generally use an Active Diretory sign in, the forward facing sites ...