Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options answers only user 177980

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

0
votes
One of the ideas behind the OAuth system is that the resource provider can check the validity of your auth token and read its claims but NOT issue you a token itself. For that you need to go back to t …
answered May 14 '16 by Ewan
3
votes
X should check the signature and expiry on the JWT auth token and not contact the auth server directly Logout adds a wrinkle to the problem as the user may have logged out before the expiry date on t …
answered Apr 7 '17 by Ewan
0
votes
Having the client bound to a user or connection string or whatever can be a good thing. But yes there are occasions where you need to have a different user each time you call a method on the client. …
answered Sep 16 '18 by Ewan
0
votes
I think its low risk. The main worry I would have is that maybe they will be calling it all the time instead of keeping their token. But there are a couple of worries. Do you now have to keep a db …
answered Jul 26 by Ewan
2
votes
to your javascript, images, html and other content. You can do this by keeping your current server side authentication code to handle the login and token generation. Once the login has succeeded the …
answered Jul 2 '18 by Ewan
7
votes
The purpose of including claims in the token is so you don't have to have that communication between the resource and the authentication provider. The resource can just check that the token has a …
answered Jun 25 '18 by Ewan
0
votes
Where you have an Access and Refresh token, usually the refresh token will have a long expiry period. You need only ask the user to login when that refresh token expires. Which can be days or even m …
answered Feb 22 '18 by Ewan
2
votes
I would suggest the following for your specific example where its the user id that you are using for the query parameter In the token add a userid claim. (usually the token will already have one of …
answered May 31 '18 by Ewan
1
vote
Ok so that's basically a session token. Apart for your 'app wide dictionary' which will eat memory and crash your server at some level of users. The problem with your scheme is how to you integrate c …
answered Apr 28 '17 by Ewan
1
vote
My view is that you have two choices here. If you just need to have configurable access to essentially the same application, then have the services check permissions and give your customers an inter …
answered Aug 22 '16 by Ewan
0
votes
So the most common approach I have seen is to use oauth2 with a short (5min) expirey access token and a long (1 month) expirey refresh token. This means that once the user logs in, they can abstain f …
answered Oct 3 '18 by Ewan
1
vote
to those methods with standard role based authentication. eg: (psudocode based on c# mvc) public class OrderController : Controller { //this is for users [Authorize(Role="User")] public …
answered May 11 '18 by Ewan
1
vote
when you don't really want to. What I setup was Cookie, JWT and OpenIdConnect authentication. in the cookie auth we forward events to the JWT or OpenId auth .AddCookie(options …
answered Jul 15 by Ewan
0
votes
Cookies on the domain .appname.com should be sent to both companyname.appname.com and search.appname.com so you can potentially use the same cookie. However, all "cookie authentication" means is …
answered Mar 25 by Ewan
2
votes
So, theory first: Generally speaking, Authentication and Authorization are cross cutting concerns which should not be part of the Models. In MVC the controller is the "entry point" for all actions … going to assume this is a web application going forward. Instead of a single application I would split it as follows Authentication service This performs Authentication and issues tokens with …
answered Apr 5 by Ewan

15 30 50 per page