Questions tagged [authorization]
Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Not to be confused with authentication.
474 questions
0 votes
1 answer
63 views
How can CSRF occur in OAuth2 using the Authorisation Code flow if not using the state parameter?
I'm trying to understand the Authorisation Code flow in OAuth and I'm confused about how CSRF would happen, specifically I don't think I'm understand how the flow actually works. Here's a diagram of ...
- 103
0 votes
1 answer
105 views
Secure file download: pre-signed URL vs temporary cookie
(Security non-expert here) Use case: You have Simple single page web app, where users can download files. The page uses JWT tokens for authorization. Only certain users should be able to access ...
- 111
1 vote
0 answers
82 views
Have there been any attempts at implementing declarative security in Go?
A recurring problem when implementing authorisation checks using procedural code is that you end up duplicating a lot of checks across your codebase and it is easy to forget to apply a check, or ...
- 136k
3 votes
2 answers
780 views
Are client certificates a secure way of having publicly facing SQL database?
Quick Context: I often come across videos where people build apps using SQL database services alongside serverless functions (like AWS Lambda, Vercel, and others) without setting up a VPC to keep the ...
5 votes
2 answers
1k views
Accessing a database publicly via HTTPS API vs. native but with client certificates
There are database services offering access to the database via a HTTPS API, such as Neon and Algolia. This is great for serverless environments, but from a security standpoint, I’m curious if this ...
0 votes
1 answer
91 views
Why hide the access token from the User Agent? (OAuth Authorization Code Grant)
My understanding is that the OAuth Authorization Code Flow is used to avoid exposing the access token from the User Agent. But why? I was reading this article (Common OAuth Vulnerabilities) by ...
- 1,196
0 votes
1 answer
138 views
When not to use Authorization Code Grant?
Why would an OAuth implementation choose to use the Authorization Code Grant -- when it means that the access tokens are leaked to a third party? I've been using API keys for a package on my server to ...
- 1,196
0 votes
0 answers
114 views
How to assess poor OAuth security implementations?
What questions should I ask to determine if a given OAuth implementation is secure? I've been using a wordpress plugin for payments that authenticates with the payment gateway with an API key. I like ...
- 1,196
1 vote
1 answer
100 views
I'm calling the API of a third party, and have to pass the credentials as parameters in a HTTPS URL. Is that safe?
Basically I am doing a GET on this URL from SAP: https://www.thirdparty.be/webservices.php?m=get_private_information&o=json&u=username&p=password The third party webservice does use IP-...
3 votes
1 answer
380 views
Authorization Code Redirection URI Manipulation Doubts
I am studying the security considerations chapter of oauth2 RFC 6749, but I am a bit confused about Authorization Code Redirection URI Manipulation paragraph 10.6: "When requesting ...
2 votes
2 answers
158 views
JWT Token Claim Validation after it has been granted
Scenario: A user logs-in to a web application and receives a JWT Token. The Token Service looks up user roles and adds them to the JWT Claims and all necessary signatures to the token. When the ...
- 123
0 votes
0 answers
135 views
Is OAuth2 a Good Choice for Small First-party Native Application?
I want to provide authorization for our native application. Requirements are like: It is a to-customer product. All features are integrated in the software provided to customer, like product = {...
1 vote
2 answers
154 views
OAuth2 authorization code grant: in the case of a public client, what is the point of exchanging the authorization code for a token?
In the OAuth2 authorization code grant, in the case of a public client, what is the point of exchanging the authorization code for a token, rather than issuing a token directly?
- 75
2 votes
1 answer
378 views
OAuth2 authorization code grant: how does redirection work for mobile applications?
In the oauth2 authorization code grant flow, if the client is not a web application, but rather a mobile application, how can the authorization server redirect to the client?
- 75
1 vote
0 answers
196 views
Microsoft Identity vs ASP.NET Core Identity
I’ve been using the Microsoft ASP.NET Identity Library. It’s a basic authentication and authorization system that is a DLL that stores everything in my app’s DB. It has screens for forgotten password, ...
- 513