Collaborate Disseminate
An authorization server issues an access token with issuer details which are exposed in a well-known API of that server. This server uses client authentication JWT tokens with clients configured. These JWT tokens are sent as a part of a re… Continue reading Bearer JWT client authentication and access token issued by authorization server
I made a website which among other things allows users to sign up to events. The HTML form is filled out and submitted, which automatically updates a google spreadsheet with all applications. This of course uses IDs and auth keys, which I … Continue reading How do I best share a shared account’s private key?
Malicious third-party OAuth apps with an evident “Publisher identity verified” badge have been used by unknown attackers to target organizations in the UK and Ireland, Microsoft has shared. The attacks were first spotted by Proofpoint resea… Continue reading Attackers used malicious “verified” OAuth apps to infiltrate organizations’ O365 email accounts
Details: traditional web-application with react frontend & nodejs API backend. FE & BE served on the same domain. FE -> example.com, API -> example.com/api
We have users and some of the private API routes (the majority of the… Continue reading Is it worth replacing session based traditional auth with OpenID-Connect?
As per the below resource: https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uri-validation/
we should validate the redirect url at 3 points:
at time of app registration
when the auth flow begins
when granting an access token
A… Continue reading Oauth: redirect uri validation [duplicate]
EDIT: adding more details to make this more suited to security stackexchange.
The solutions that are listed below are not exhaustive, these are some potential ways i think this type of functionality can be implemented. Each of the suggeste… Continue reading One way session sharing between mobile app and web [closed]
We have an oauth implementation, which was chosen because of the following reasons:
session sharing across different applications
easy to reason about the security considerations as oauth is well known and documented
As part of our explo… Continue reading Oauth: native UI for internal / first party apps
I recently completed Azure OAuth2 integration with my existing web application. Upon user’s successful login into my application user can configure multiple outlook accounts using OAuth2 flow.
As for CSRF prevention for my web application … Continue reading Using CSRF token as state parameter for OAuth request
I have an oauth implementation (uses phone number for authentication) which is used across several applications. These applications want to maintain the same identity of the user as the user moves across applications.
Example scenario 1:
… Continue reading Oauth: only allow login with a certain id
Let’s say I’m building a web application (let’s focus on the backend side) that is B2C. Users should be able to register with my application, using a SSO provider like Google or Facebook. Once they’re registered, they can access other endp… Continue reading SSO and/or JWT: make sure web app’s endpoints are protected