Questions tagged [oauth2]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
-2
votes
1answer
48 views

Authentication solution for custom PHP-based API

Here is description of my app I'm working on. On the client-side (index.html) a user can interact with a data. When he needs to call a server operation for example reading or writing a file on the ...
4
votes
0answers
43 views

Is it possible to use a reverse proxy authentication in a native mobile app

We have a few backend services that our frontend SPAs fetch data from. Right now, the SPAs use JS libraries to authenticate with the Auth server (Azure AD) which returns a JWT which is validated by my ...
2
votes
0answers
47 views

Is it possible to use an SPA as the UI for an OAuth 2.0 authorization server?

Using SPAs as the UI in front of an API has become standard practice, with OAuth 2.0 / OIDC being the common authz mechanism for this. This approach generally entails the SPA receiving its access via ...
2
votes
0answers
49 views

Is it good practice to use the sub claim as the user_id in my app

The resources on the web I have seen so far suggest that the 'sub' claim in a JWT identifies the principal. According to this question, at least for some identity provider implementations, one cannot ...
1
vote
0answers
28 views

In OAuth / OpenID Connect, does the redirect url matter for server to server API calls?

In OAuth / OpenID Connect, does the redirect url matter for server to server API calls? I'm currently setting up Azure AD to secure our API's. The first implementation will likely only be server to ...
0
votes
1answer
34 views

How to secure messaging-based communication with microservices

I'm comfortable with a lot of OpenID Connect and OAuth2 concepts in the context of HTTP-based communication between microservices. I'm currently leveraging Azure AD. In the HTTP-based scenario I would ...
0
votes
1answer
34 views

OAuth2 not implicit flow, POST username and password

I am a mobile dev, now for a project need to authenticate with a backend service using identityserver4 and OAuth2. The project has things set up so it is using OIDC for authentication. BUT It is on a &...
0
votes
0answers
23 views

How to change response when token expire using AuthExceptionEntryPoint?

I'm facing issue in spring security custom response. I have asked question in stackoverflow community also, Here is link for Question, Can anyone help me out for this issue.
1
vote
2answers
65 views

Recommended strategy for maintaining a session when navigating from app to browser?

We have an SSO application that provides authentication for a native mobile application, as well as for a web application. There are some features that the web application has that the mobile ...
1
vote
0answers
13 views

How to integrate multiple services via API's into a single dashboard on a per-user basis with SSO?

so my project is that I'd like to pull data from a bunch of different services/API's and show them in a single dashboard. SSO is a requirement so I want to make sure the user doesn't have to put in ...
0
votes
0answers
18 views

Multiple simultaneous users with oauth

I'm dealing with a native .net WPF app which is more or less a shopping client operated on one of multiple self service terminals. On these terminals the users have four possibilities in order to ...
0
votes
0answers
32 views

Structure for a spotify / OAUTH web app

I am creating a spotify app that will allow 2 users to compare what songs they have in common. I have never designed a super-complicated web app before, so I wanted to get some advice for the ...
0
votes
1answer
84 views

Best way to store Session token on mobile App

Backgroud Building a mobile App for product X which is currently hosted as a SaaS solution. The product X does not support OAuth currently, implements basic authentication and generates Session token ...
0
votes
1answer
60 views

How should I distribute my app with my own OAuth2 client ID, without letting anyone find it out?

I've written an app using golang which uses OAuth2(Authorization code flow with PKCE) to interact with the Gmail API. If I build the app using my own client ID then my client ID can easily be found ...
2
votes
0answers
38 views

Api Authorization for first party apps and third party apps

I have a few microservices that i would like to combine in form of an api. The main purpose of the api is to be used by our (first party) mobile app. A side note, we don't have a mobile app or web app ...
0
votes
0answers
22 views

Standards for access tokens (authorization)

I am looking for standards to implement access tokens to do authorization in our services. So far I found the OAuth standard, which seems to offer everything we need. I am however looking for ...
2
votes
1answer
99 views

Handling OAuth 2.0 access token

I am creating a rest template to consume REST API secured by OAuth 2.0. The provider has implemented an expiry for the access token for 5 mins. So Using the rest template, I will be calling the ...
2
votes
1answer
88 views

Delegating authorization across multiple API's

I'm building a multi-tenant system that consists of one (SPA) client, calling multiple API's, all under my control. User authentication is done with OpenID Connect, I'm sending an ID and access token ...
1
vote
0answers
24 views

Handling 3rd party OAuth2 tokens

After some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd ...
0
votes
0answers
41 views

How do I properly secure a Spring Boot app serving server-side rendered pages and API?

I'm wondering how do I properly secure this example app (https://github.com/brunodrugowick/spring-thymeleaf-vue-crud-example). The app is: A Spring (Boot) app with server-rendered pages via ...
3
votes
3answers
145 views

Auth in microservices applications with service mesh

Premise: - Two services A and B - Resource X has owner U, and is managed by service B Now, I need to handle these auth scenarios: 1- End-user needs to directly use service B's API to access X 2- ...
2
votes
3answers
171 views

Securing API for third party use

We have a set of microservices and would like to expose endpoints from a subset of these for third parties to use. To this end, we will build an API Gateway that acts as the access control mechanism ...
1
vote
1answer
59 views

What is the point of the OAuth2 client identifier?

The entire explanation of the client ID from RFC 6749: The authorization server issues the registered client a client identifier -- a unique string representing the registration ...
0
votes
0answers
68 views

oauth2 + angular - Most elegant way to pass the JWT auth token

I have an angular application, which is querying an API as a client (written on Spring Boot 2.2.1 + Spring 5.2.1) that supports 3rd party authentication over OAuth2. The API has altogether 3 different ...
2
votes
2answers
240 views

How to combine session-based authentication and stateless REST API

What is the proper way of combining session-based authentication with stateless, token-based authentication for a REST API? Use case: User logs-in in the standard, traditional, session-based way. ...
2
votes
2answers
65 views

Customized access control using OAuth 2.0

I'm designing a enterprise infrastructure monitoring application which has customized needs of access control, beyond roles and authorities. The architecture include multiple nodes of REST API being ...
-1
votes
1answer
45 views

Oauth in Microservices context

I'm trying to implement an oauth2 server to protect the endpoints developed in php. I have some confusions of how would be the flow to protect my endpoints. I understand that my resource server should ...
2
votes
0answers
27 views

Architecting OAuth2 Flow With an API and Static JS Client

I'm building a very security conscious application. (All applications should be security conscious, but this one may contain a lot of red data). Assuming that I will use a Vue/React JavaScript Single ...
0
votes
1answer
124 views

How to dynamically create and assign user permissions for a group based service

tldr: In building a platform where users can create private groups, and invite other people to those private groups, how is it be to secure those groups? I'm building a platform around private groups ...
1
vote
2answers
2k views

How to keep user logged in when using OpenID Connect & Cookies in dotnet core?

I'm working on an OpenID Connect Hybrid flow, basically the response type in my case is: code id_token Problem: I can't seem to persist the session of the user when logged in using the id_token. I ...
0
votes
1answer
136 views

What's the point of logging in with oauth2 if it's a paid subscription site?

I understand what oauth2 is and I've programmed it in one of our projects. The point was to pull user's data from an oauth2 provider (facebook, google, etc.) to our application (for example, the user'...
5
votes
3answers
4k views

Is caching Access Tokens on the back end of a Web Application a good idea? (access_token storage best practices)

Let's suppose we have a Web Application that uses an Open Id Connect service provider, the Web Application uses the Authorization Code flow to get access to a different API, and therefore gets an ...
1
vote
1answer
85 views

OAuth2.0 Grant Type for User Logged In With Google

I have a confusion. So, in OAuth2.0 there are 4 types of Grant (Authorization Code, Password, Client Credentials and Implicit). In my use case, I have two login scenario. The first one is using ...
0
votes
1answer
116 views

Creating and Approving OAuth2 clients using Laravel Passport

As I understand with laravel passport, in order for a third party application to consume my api they need to register their application with mine by creating a client. The passport:client artisan ...
1
vote
3answers
112 views

Open ID Connect Session Management Access/Refresh Token vs Session iFrame

We have a web app in which we allow users to log into the app using any Open ID provider(e.g. Okta, Google, Facebook etc.). We want to implement the correct Open ID Connect prescribed methodology/...
2
votes
2answers
377 views

How to generate an access token using OAuth 2.0 for another app that never expires

I'm using OAuth 2.0 with Laravel (Passport) in order to grant access to my frontend app to the API. Access tokens generated this expires after a while. Now, I have a second app that has to consume ...
2
votes
0answers
33 views

OAuth2 - client_credentials

I am in the process of building out a private REST API. This API is intended for machine to machine communication. In short someone else's server will kick off a job via CRON that pulls information ...
0
votes
0answers
42 views

Which OAuth2 Flow?

I'm just getting into OAuth2 and I'm a tad confused (you've probably heard that before)! I am writing a small independent service which will expose a basic REST API enabling client applications to ...
4
votes
2answers
728 views

So I am creating a user registration system with oauth login to four services. How do I handle username selection?

My registration system normally asks for 4 things: The user's full name, their email, their preferred username, and a password. I want to add four oauth2 registration services to make it easier and ...
10
votes
2answers
589 views

Should an SPA use OIDC's Implicit flow or Auth Code flow?

We are developing a new Angular SPA which leverages Keycloak for its SSO abilities using OpenID Connect (OIDC). The app is currently designed to use the Implicit flow to retrieve short-lived access ...
-2
votes
1answer
52 views

Should API also authenticate users from front end app?

I am building an API using Laravel and am looking at using Laravel/Passport for authentication - but I am struggling with a design decision. The API will be consumed by multiple other applications / ...
1
vote
0answers
407 views

How to make rest api end points in swagger UI pre authenticated in Spring BOOT

I have written a spring boot rest API application with OAuth.I have integrated swagger UI for API documentation. I want the API endpoints on swagger UI to be accessible without an access token. Please ...
2
votes
1answer
535 views

User identity and microservices

I have created a User service that controls user login using OAuth2 protocol and stores the user in the local database. So this service is aware of the user session and user identity. Now I have ...
11
votes
1answer
2k views

How to handle per-resource (fine grained) permissions in OAuth?

I'm designing an app architecture using OAuth 2.0. I have a separate Resource Server and Authorization Server. The latter keeps a database of users and the scopes available to them. Now, my question ...
4
votes
3answers
2k views

Token based vs session based authentication in back-end

I'm trying to build an application by creating an RESTful API(Koa.js) to communicate with clients(Web with React and Mobile with Ionic). But I'm facing issues when dealing with authentication. So my ...
1
vote
1answer
1k views

Can I have a client-side-only web application keep OAuth tokens?

I'm only a student, so forgive me if my understanding is poor or my ideas poorly expressed. I want to create a purely client-side browser application that works with the user's Dropbox account. They ...
0
votes
1answer
58 views

Oauth2.0 implementation to be done client side or server side

My application consist of a web client (implemented in angular or reach) and rest web service, both hosted on different servers. For implementing the OAuth2.0 login for Google, Facebook etc., should i ...
0
votes
1answer
65 views

OAuth used for registration

When I read and watch videos on Oath it talks more about being able to access data from other applications. However, a common usage of what I think is OAuth is simply identifying a user without ...
1
vote
1answer
639 views

Windows Service with authentication, some UI required

I have to build a Windows Service which requires OAuth2 authentication. The service is intended (like all services should be) to run unattended (no user need to be logged in in Windows). The problem ...
0
votes
1answer
2k views

How Immadiately Blacklist and Block Access of Access Token using JWT?

I have read OAuth2 and its statelessness using JWT as token. Token expires based on expired time, then how do I control token like blacklist and block its access immediately without being stateful? ...