All Questions
12 questions
0
votes
0
answers
63
views
Utilising Social Logins via OAuth2 in native mobile apps
This question has been asked over and over again, but I have not yet found a satisfying answer:
How to use Social Logins (via OAuth2) to obtain access tokens for your backend if your only clients are ...
- 9
0
votes
1
answer
276
views
Securing a SPA's API when using external identity providers
I'm trying to understand OAuth and Securing APIs better when using External Identity Providers, and all my research on it doesn't really seem to apply to my issue, so I'm starting to wonder if I'm ...
- 3
0
votes
1
answer
139
views
How should I distribute my app with my own OAuth2 client ID, without letting anyone find it out?
I've written an app using golang which uses OAuth2(Authorization code flow with PKCE) to interact with the Gmail API.
If I build the app using my own client ID then my client ID can easily be found ...
- 101
2
votes
0
answers
108
views
Api Authorization for first party apps and third party apps
I have a few microservices that i would like to combine in form of an api. The main purpose of the api is to be used by our (first party) mobile app. A side note, we don't have a mobile app or web app ...
- 121
4
votes
2
answers
3k
views
How to combine session-based authentication and stateless REST API
What is the proper way of combining session-based authentication with stateless, token-based authentication for a REST API?
Use case:
User logs-in in the standard, traditional, session-based way. ...
- 51
2
votes
0
answers
52
views
Architecting OAuth2 Flow With an API and Static JS Client
I'm building a very security conscious application. (All applications should be security conscious, but this one may contain a lot of red data).
Assuming that I will use a Vue/React JavaScript Single ...
- 211
0
votes
1
answer
316
views
Creating and Approving OAuth2 clients using Laravel Passport
As I understand with laravel passport, in order for a third party application to consume my api they need to register their application with mine by creating a client.
The passport:client artisan ...
- 291
2
votes
2
answers
679
views
Does it make sense to create a whole new API interface to just handle the web secret key?
In OAuth2.0 we have to send client id and secret along side the user credential to obtain an access token from an authorization server. We have a ReactJS web application that needs to send its request ...
- 123
3
votes
2
answers
1k
views
REST API Oauth 2 - Which grant type to use?
I have an application which basically inserts some rows from the current front end web application.
All the calls before the service layer checks/validates if the user is allowed to insert data or ...
- 103
5
votes
5
answers
390
views
Should I treat a worker as another 'user' in my system?
Basically I am designing a web-enabled application that should have an API in the middle. I found this question on Stack Overflow, which unfortunately has no answers.
Let's say there is a system, ...
- 369
5
votes
1
answer
924
views
Storing OAuth2 data in Mongo?
Our system has users but we want to perhaps allow some users to be able to use our API service. I'm looking at using OAuth2 for authorization. As it's going to be (trusted) machine-to-machine access I ...
- 795
4
votes
1
answer
3k
views
How to bypass Oauth2 authentication when the client and resource owner is the same entity?
We are currently working on using an API provided by Mercado Libre which is a maket place for selling various goods.
Their APIs use OAuth 2.0 for authentication.
The problem is that OAuth 2.0 as ...
- 6,663