Collaborate Disseminate
I have been analyzing the security process in 3gpp specs (pg 11) and the registration process in the spec explained with that flow. The flow represents the registration of a client to the server..
I am not a security specialist and I do … Continue reading Registration process by OAuth2
So according to the resources found here and in the official protocol documents I have a good grasp on what flow-types to use for what client-type. According to the following picture (credit: https://alexbilbie.com/guide-to-oauth-2-grants/… Continue reading Choosing oauth flow-type for on-prem installations
I have the following problem:
There are 3 parties A, B and X.
X is holding 2 entities on behalf of A and B.
A communicates with X to operate it’s own entity. B also communicates with X to operate it’s own entity.
Permissions could be … Continue reading How to establish a secure channel with authenticated and authorized access to a remote entity
I want to create Angular 9 + Spring Boot application with strong security complaint to PCI-DSS security standard.
Which security protocol is preferred for user sessions in order to have high security when we use Angular and Spring Boot:
… Continue reading Which Authentication mechanism to choose for PCI-DSS system
This question is essentially the opposite of Why isn’t PKCE encouraged for Single-Page Apps?.
In recent years, most OAuth API vendors seem to be have become unanimous in recommending that JavaScript apps without a server backend (a.k.a. SPAs) use a proof-key-for-code-exchange grant flow (PKCE, as documented here).
What I’m curious about is why that change came about.
It’s easy to understand why PKCE is needed in native apps, where things like custom URI schemes are used to collect access tokens, which is a vector for token leakage when any app on your OS can potentially register itself as a handler for your URI scheme.
But what are the weaknesses in a browser app? Referer headers? Extensions? History leakage? Some other vector I haven’t thought of but which evil hackers will swoop in to exploit mere minutes after my site goes live?
(For the record, I have no particular aversion to using PKCE, I’m just really interested in the security context and would like to get better at reasoning about weaknesses in front end applications)
Continue reading Why *is* PKCE recommended for single page JavaScript apps?
Say I had a centralized OAuth 2 authentication server, a Single Page Application (SPA) in an electron app, and a third-party server. The user launches this SPA, goes through the PKCE flow to obtain an access & refresh token, and is now… Continue reading Using OAuth SPA app to provide third party with access token
We’ve recently overhauled the backend to our mobile app from having a very basic authentication mechanism that went through the API to having both an authentication server and an API server, with the auth server issuing OAuth2 JWT tokens (… Continue reading Where should ‘reset password’ functionality be?
This is a more direct "yes" or "no" question to the following
PKCE vs Client Secret
What is the purpose of the OAuth2 client secret?
Does PKCE replace state in the Authorization Code OAuth flow?
What is PKCE actually pr… Continue reading Does PKCE replace client-secrets?
Just wondering because I was looking at an older implementation of an OpenID Connect specification for a single app which adds a couple of extensions.
The extension is that the authorization sequence goes as follows
Client: go to the .w… Continue reading What would the difference be between PKCE and sending a JWT that’s encrypted?
I’ve been learning a bit about the OAuth web application flow.
One thing that is not clear to me is if the Authentication Code generated from step 5 of this diagram is something that can be used permanently to generate a new access token … Continue reading Are OAuth Authenication Codes meant to be transient or permanent?