Questions tagged [authentication]
Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.
437 questions
6 votes
2 answers
1k views
How dangerous is storing sensitive information in LocalStorage?
Since I started studying security in web applications, it seems that everyone always says to never store sensitive information (e.g., refresh tokens, access tokens, and so on) due to the risk of ...
- 165
4 votes
3 answers
226 views
Achieving Multitenancy with an External Identity Provider
We are designing a backend system for a large platform where users can interact with multiple products on behalf of different companies. We plan to use Keycloak as an external identity provider. The ...
- 165
2 votes
0 answers
158 views
Invalidate session for user in authentication
when user login in my web application (Article Website) I'm using Redis to cache the refresh token. So when user login I will generate refresh token and send it to him. While caching in my Redis the ...
- 21
0 votes
2 answers
108 views
Using unique attributes for user login
Suppose a user can have multiple emails. A given email may be held by at most one user. Is email a good pick for login purposes (so that it's used instead of the username)? Should an authentication ...
- 2,030
3 votes
1 answer
115 views
Is there a context in oAuth, reusable in the callback?
I am developing a home-grade web application (server-client, based on Nuxt and nuxt-auth-utils). I am using the opportunity to learn something about oAuth (and OpenID). One of the issues I face is ...
- 1,661
-1 votes
1 answer
189 views
Which authentication method to use?
I have a REST API with protected endpoints, which require an AccessToken for access. For the user to receive the AccessToken, they need to access the login endpoint and with the correct credentials (...
- 11
0 votes
1 answer
119 views
Database structure for two-step registration flow
I'm trying to design a database for supporting a multi-step registration flow. The registration flow goes like this: the user logs in via OAuth (which creates a session and user), then they're asked ...
- 123
2 votes
3 answers
1k views
Race condition when issuing a refresh token: worth addressing or not?
I'm quite new to the world of access and refresh tokens, so bear with me. Client uses its refresh token to get a new access token. The server invalidates the just used refresh token and contextually ...
- 125