Collaborate Disseminate
We are attempting to set up authentication for a Web-API (build on .NET Core) that is being hosted on different domains, mostly within the the respective intranets. Currently relying on Windows Authentication, an alternative/fallback solut… Continue reading REST API with OAuth-Authorization running in different domains
Currently, Can you provide your suggestion, whether my below approach is good with security perspective.
User clicks on login button which calls backend/api/login
Step1 triggers the oauth flow and finally google returns the auth token
Now… Continue reading Redirection from backend with frontend using OAuth token with Cookie
OAuth manual advises that the client ID should not be easily guessable to decrease phishing attacks. https://www.oauth.com/oauth2-servers/client-registration/client-id-secret/
Is it still the case when PKCE is used and auth server redirect… Continue reading Guessable oauth client id and phishing
I’m in a debate of where to securely store an OAuth 2.0 access token. There are two opinions:
On the browser (inside of a HttpOnly cookie)
On the server/inside the a database
The argument against using the cookie storage mitigating the i… Continue reading Storing an OAuth 2.0 access token
I have read that oauth2 can be used for both authorization as well as authentication. I have often encountered the 2nd usecase where when I want to login to a new website where I don’t already have account, I can login using my google/fb/g… Continue reading Real world examples of websites using oauth2 for authorization [closed]
I’ve looked at various ways of logging in users and I’m wondering if I should write my own.
There are a lot of third party solutions that make it easy and cheap to get started, like Amazon Cognito and Auth0. But as easy as it is to get sta… Continue reading Should I build my own login functionality? [closed]
Of the following two approaches, which is "more secure", under which circumstances, and why? In other words, please compare the security risks of these two approaches:
Log in to an OAuth provider such as Google or Facebook using… Continue reading Security risks of OAuth vs a password manager
I have worked on many API integrations scenarios and I used 2 approaches to authenticate the API calls:
Using API Keys
For example inside Hubspot integration I use this web call to get all the accounts using API Key:
https://api.hubapi.c… Continue reading Is OAuth more secure compared to API Keys
I’m planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS exclusively. To make this convenient for develope… Continue reading OAuth for command line application
This proposal concerns a strategy for isolating the permissions given to plugins in a plugin architecture. I’m looking for insight into whether this design can succeed in isolating those permissions.
Access to the entire site is controlled… Continue reading Isolating permissions available to browser JS via oauth and referer