Collaborate Disseminate
Context
A small web application with REST API and postgres as db, that has users, documents and teams. A user can do basic CRUD operations on document.
A user is always a part of a team. A team is generated on user signup. A team has at le… Continue reading Any obvious pitfalls of modeling access control policies using subject, scope, object?
Trying to allow a CLI to "login" via web browser and obtain an access token for the user’s account, similar to how gcloud and github’s CLI do it. I realize it’ll be using the OAuth Authorization Code flow.
But what about the clie… Continue reading OAuth Authorization Code for CLI
We want users of our service to be able to write programs/scripts that act on their (i.e. the user’s) behalf.
I’ve seen various services (github, digital ocean, gitlab) use Personal Access Tokens (PATs) for that purpose.
Is this not someth… Continue reading Personal Access Tokens vs OAuth
I have an application where the frontend app talks to 2 set of API servers: be1.domain.com and be2.domain.com
both these servers are independent entities (they do share the same top level domain, in case that is useful for this discussion)… Continue reading Oauth: Authorizing multiple clients at once
while fuzzing a public APK file for a bug bounty I came across a file awsconfiguration.json with some pretty promising data. However after reading here https://docs.aws.amazon.com/pdfs/appsync/latest/APIReference/appsync-api.pdf#Welcome a… Continue reading AWS AppSync awsconfiguration.json file found in prod apk, is it a security issue and how to verify api key
I am trying to understand how/if I can force MFA to a webapp hosted in the public cloud but the only information I have is that it only supports MFA at the infrastructure level. Does that mean that only specific groups in AAD can be enable… Continue reading What does it mean that MFA is supported only at the infrastructure layer? [closed]
I understand that oauth is an Authorization protocol, but it is possible to use it for authentication when clubbed with something like open ID Connect.
I am trying to understand why do we need an extra token in the redirect url to prove au… Continue reading Using oauth for authentication
I’m building a note-taking app, when a user writes a note an id is generated and I redirect them to a page where they can see its content with a URL like /note/DXSt832pS5iLuos6uxBn. What are the security risks of not double-checking that t… Continue reading What are the security risks of only using an id in the url to protect the content?
Technologies like Zero-knowledge password proof and PAKE seems to be pretty mature but almost all modern web-sites still send passwords over HTTPS to check authentication. At first glance, this protocols look like a magic pill, but still n… Continue reading Why PAKE or Zero-knowledge password proof didn’t replace sending a password via HTTPS
I have a use case where I am looking to authenticate my request with two endpoints that accept two different auth tokens.
My endpoint looks like this (I am using Azure traffic manager profile)
Endpoint:
-> Endpoint1 (80% traffic)
-> … Continue reading Multiple bearer tokens with POST request? [closed]