All Questions

Tagged with
Filter by
Sorted by
Tagged with
0
votes
0answers
46 views

Prevent token sharing: chained single-use tokens VS a designated invalidation feature

Situation: A Client is requesting a resource from a Host multiple times, usually with minutes or hours between requests. The Client has a signed, verifiable token, which we'll call a Receipt, that ...
3
votes
2answers
128 views

How to safeguard a COTS REST API with on-premise servers for approved client apps only?

Goal: Prevent unauthorized 'clone' apps from using REST API-based solutions where the customers manage their own servers and services instead of the vendor doing so (database, resource, and identity). ...
-1
votes
1answer
26 views

How to implement linkedin authentication/data sharing with multi party?

Hi I am working on application 2. My application interacts with application 1 and 3. Clients of application 1 need to be to share their linkedin profile information with application 3. I have ...
3
votes
1answer
639 views

Designing authentication and authorisation micro service

Background: There are three different applications A, B and C and they all share same user details but I had to implement authentication in each of them which was duplication of effort. After some ...
0
votes
1answer
333 views

Anonymous Controller/Action within Authorized Site

Say I have an MVC .net core website where 100% of the controllers/methods are behind [Authorize] attributes (complete with policies and all). Would it be taboo, to carve out a set of un-authorized/...
1
vote
2answers
127 views

Is there a valid alternative to HTTP headers for sending auth credentials

I have built simple auth for REST servers in academic projects. I always used the headers to pass the credentials. This is probably just because every tutorial I've ever seen did it this way. ...
-1
votes
1answer
76 views

Does Policy-Based authentication remove refactoring security?

I understand Role Based Security. I have read about Policy Based. I have read what others call Activity Based. What I want to know is if I do Policy-Based, am I avoiding what Role-Based requires and ...
9
votes
1answer
8k views

Difference between 'aud' and 'iss' in jwt

I want to implement a more robust authentication service and jwt is a big part of what I want to do, and I understand how to write the code, but I'm having a little trouble understanding the ...
2
votes
3answers
779 views

OAuth2 overkill for small business

I'm currently in the process of writing an API that will interact with a web application, iPhone app, and Android app for my work. The API is pretty simple and deals with pilots and their ...
2
votes
1answer
468 views

Can a third party service rely on JWT for authorization

I am using JWT for authentication in a micro service architecture. There is 1 UI web app and multiple REST API exposed services in the backend. I am considering a IAM service which will give a JWT to ...
2
votes
1answer
304 views

What is the purpose of a multi-claims-based authorization system?

I'm having a difficult time conceptualizing the purpose of a multi-claims-based authorization system. For example, ASP.NET MVC Identity allows for key-value pairs called claims that you can store on a ...
14
votes
5answers
6k views

Authorization and authentication system for microservices and consumers

We plan to refactor our company system into a micro-service based system. This micro-services will be used by our own internal company applications and by 3rd party partners if needed. One for booking,...
3
votes
2answers
2k views

Microservices and authorization

We are currently working on a micro-service based system. The idea behind it is to split our monolithic system to small domains (micro-service per domain). All services will be used by our internal ...
7
votes
2answers
3k views

Prevent abuse to REST API endpoint

Question 1 I have a login API endpoint http://127.0.0.1:8080/api/account/login It checks if the phone number has been validated. If not it will call POST http://127.0.0.1:8080/api/account/sendsms ...
43
votes
2answers
20k views

Role vs Permission Based Access Control

I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization). Let's start with a given: in our system, a Permission will be a fine-...
6
votes
3answers
307 views

Multi platform password storage with retrieval for applications with authorization?

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use. Are ...
16
votes
2answers
13k views

Should I store my user claims in the JWT token?

I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure. I cannot makeup my mind as to whether ...
1
vote
2answers
136 views

Is it a good idea to require passwords in offline applications?

I am developing an application which can install extension modules (plugins, if you will) from APT-style repositories hosted elsewhere. The plugins need not be signed (although the downloads are ...
1
vote
2answers
2k views

How do you make sure a .net client application is not being hacked to bypass authorization claims?

We wrote a simple .NET (C#) desktop application in Wpf. We also used WIF (Windows Identity Framework) to get a list of claims for the authenticated user. Some examples are: CanOverrideSalesAmount ...
9
votes
2answers
726 views

Imitating Exchange Server's “RBAC AuthZ” in my own application… (is there something similar?)

Exchange 2010 has a delegation model where groups of winrm cmdlets are essentally grouped into roles, and the roles assigned to a user. (Image source) This is a great & flexible model ...
13
votes
8answers
1k views

Punishing users for insecure passwords [closed]

I'm thinking about limiting the rights of users who choose insecure passwords (insecurity of a password being determined by length, how many types of characters (upper/lower case, numbers, symbols, ...