208
votes
Accepted
Are private, unguessable URLs equivalent to password-based authentication?
A private URL is somewhat weaker than authentication with credentials, even if the bit size of the URL is the same as that of the credentials. The reason is the URL may more easily "leak". It is ...
- 57.4k
59
votes
Is this scenario an exception to the rule of never storing passwords in plaintext?
This is a really good example of insecure authentication, justified on the basis that if the site is compromised it is not possible to identify the person. If that's the case, why do we even need a ...
- 9,925
50
votes
Accepted
Cookie-based vs Session vs Token-based vs Claims-based authentications
I agree that the naming of the different concepts is confusing. When talking about authentication in a web context, there are several aspects to consider.
What information does the client send when ...
- 793
48
votes
Are private, unguessable URLs equivalent to password-based authentication?
Note:
A lot of people seem to be confusing a "private" URL with authentication. Also, there seems to be some confusion that sending the link via a trusted entity is an attempt at two-factor ...
30
votes
Is this scenario an exception to the rule of never storing passwords in plaintext?
"Never store passwords in plain text" is not a rule. It is a best practice based on common security breaches on naive implementations of password protections.
In that sense, the question:
Is this ...
- 2,768
25
votes
Authentication and authorisation for people with intellectual disabilities
Users don't care.
Mental disorder or not users simply don't care as much as you do about security. You could set up two factor, OTP, even physical keys and users will still wander off to the bathroom ...
- 103k
23
votes
Accepted
Where to place an API key: a custom HTTP header VS the Authorization header with a custom scheme
Be consistent
Some may say this is unnecessary (and not too long ago I would have agreed) but these days, with so many auth protocols, if we use the Authorization header to pass an API key, it is ...
- 14.3k
22
votes
Accepted
Handling token renewal / session expiration in a RESTful API
This sounds like a case of authentication versus authorization.
JWTs are cryptographically signed claims about the originator of a request. A JWT might contain claims like "This request is for user X"...
- 4,449
21
votes
Accepted
Authorization and authentication system for microservices and consumers
Authentication and authorization are always good topics
I will try to explain to you how we deal with authorizations in the current multi-tenant service that I am working. The authentication and ...
- 376
21
votes
Accepted
Is it bad practice to store a user's email address in a JWT?
Yes, it is bad practice and a security problem.
Email addresses are PII (personally identifiable information). Like all other PII, email addresses should never be stored unencrypted at rest; doing so ...
- 325
19
votes
Accepted
Share private SSH keys with Bash on Windows
So as Telastyn commented I added symlinks in WSLs ~/.ssh/ to the id_rsa and id_rsa.pub using:
> ln -s /mnt/c/Users/MyName/.ssh/id_rsa ~/.ssh/id_rsa
> ln -s /mnt/c/Users/MyName/.ssh/id_rsa.pub ~/...
- 595
19
votes
Accepted
Difference between 'aud' and 'iss' in jwt
These are intended for scenarios where you have a token issuing authority that is not the same as the application that is the intended recipient.
This may not be different for your application.
But ...
- 3,277
17
votes
Accepted
Caching authenticated requests for all users
I've been trying to address a similar issue.
My users need to be authenticated for every request they make.
I've been focusing on getting the users authenticated at least once by the backend app (...
- 286
17
votes
Handling token renewal / session expiration in a RESTful API
Your API session is a thing which should not exist in a RESTful world at all. RESTful operations are supposed to be stateless, session contains state and thus has no place in a RESTful world.
The JWT ...
- 10.2k
17
votes
Authentication and authorisation for people with intellectual disabilities
Two obvious things.
One, there's an inadequate specification of who the security measures need to resist, and/or who stands to gain from unauthorised access. No system is wholly resistant to ...
- 7,148
16
votes
Is it bad practice to store a user's email address in a JWT?
The short answer is no. There should not be any problem because email is a valid and registered public claim.
I have a user DB where each user's unique ID is their email ...
Well, there's a ...
- 14.3k
16
votes
Accepted
Group set of commands as atomic transactions (C++)
In practice, such atomic transactions do not exist. Instead, you can try to make all operations idempotent so that they can be safely retried.
Idempotence is particularly important for network ...
- 133k
15
votes
Share private SSH keys with Bash on Windows
Based on the new build "Insider Build 17063" permissions for files works differently now.
In short you need to do:
sudo umount /mnt/c
sudo mount -t drvfs C: /mnt/c -o metadata
This will make ...
- 251
14
votes
Synonym for "Authorization"?
Using another word for "Authorization" or "Authentication" isn't helpful for writing documentation. Even though they're obscure, these two are already the most common words for those things, and any ...
- 108k
12
votes
Accepted
REST API security: HMAC/key hashing vs JWT
Let's get this started with a very basic answer.
JWT (as used in the context of OAuth and OpenID) does not require shared secrets between client and API. There are 3 components and pairs of 2 share a ...
- 1,873
12
votes
Accepted
cookie vs. session vs jwt
Cookies: in their early version, a text file with a unique client Id
an all the other information needed about the client (e. g. roles)
Cookies are tuples key-value originally addressed to retain ...
- 14.3k
11
votes
Accepted
Should I encrypt mobile number and otp when sending to backend
What my concern is someone can figure out the API, and start hitting
with different combination of OTPs for mobile number and gain the
access to an account
This is a frequent question related to ...
- 14.3k
10
votes
Accepted
Should access permissions and roles be included in payload of JWT?
The purpose of including claims in the token is so you don't have to have that communication between the resource and the authentication provider.
The resource can just check that the token has a ...
- 71k
10
votes
Is this scenario an exception to the rule of never storing passwords in plaintext?
In Short: No
If you forget your password, you ask the professor, who can look it up
I see no real reason in the question to ignore the secure authentification guidelines here. Many (too many) ...
- 201
9
votes
Accepted
is "ASP.NET Membership" still a good choice for ASP.NET MVC authentication nowdays?
Yes. Asp.Net Membership is a bit outdated. Asp.Net Identity was introduced a few years ago to help solve some of the pain points with the older system.
It supports third party OAuth through Google (...
- 8,921
9
votes
Accepted
Microservice Architecture - using Auth Server as a User Resource server
3 is the correct answer.
Your Auth server authenticates users, Your User server would perhaps be better named 'UserProfiles'
You'll find that many of your users will be people with profiles, but ...
- 71k
9
votes
Accepted
Is it bad to leave Azure secrets keys as plaintext in my source code if I don't release the code, only the exe?
Yes, anyone can easily find the key.
The simplest method would be to use the .net development tools (available for free download from Microsoft) which contains a decompiler. Aim the decompiler at the ...
- 15.9k
8
votes
Accepted
Should arbitrary numbers be stored as strings in a database?
Store it as a string.
You've already stated some of the reasons why:
You're not going to do any mathematical operations on it
You need a very large precision number to store that many digits
Let me ...
- 199k
8
votes
Are private, unguessable URLs equivalent to password-based authentication?
Pretty much all authentication schemes boil down to proving that you know a secret. You authenticate yourself to some service by proving that you know a secret password, or a secret URL or,...
Some ...
- 1,213
8
votes
cookie vs. session vs jwt
Cookies: in their early version, a text file with a unique client Id an all the other information needed about the client (e. g. roles)
Your definition of cookie doesn't really describe what they do. ...
- 9,137
Only top scored, non community-wiki answers of a minimum length are eligible