The authentication tag has no wiki summary.
0
votes
0answers
19 views
Login to a Web App using PKI Certs [duplicate]
I understand PKI reasonably well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of ...
1
vote
1answer
77 views
In what situations will Windows-based authentication for my ASP.NET MVC web application fail to allow users from accessing the web application?
My requirements are:
To build an ASP.NET MVC web application to use Windows-based authentication, since all the users which will be accessing the application are our internal employees, and they ...
8
votes
3answers
82 views
Web Authentication using PKI Certs
I understand PKI reasonably well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of ...
2
votes
1answer
114 views
Client side authentication through signatures instead of passwords
I want to save some user-generated data with some signature of the user that generated it (let's say that the user has to fill some forms with some data and I want him to sign the written data).
The ...
1
vote
3answers
221 views
Where should authentication be handled, in the server's code, or in the application's server-side code?
I'm developing a simple web application in node.js. Users can log in from any page in the application, so I handle authentication in the server's code and logic, and the application's server-side ...
0
votes
3answers
103 views
Best way to auto login in web application
This question could be titled "Place password hash and salt in query string?" as well to be less subjective, but the point remains the same:
I want to create kind of a launcher application for my web ...
3
votes
1answer
105 views
Multiple SSH keys for different organizations
I can see that GitHub allows you to have multiple mail account and associate every organization you are part of with a different address.
Can this be done also for SSH keys?
What I would like to do ...
8
votes
2answers
380 views
Is this solution RESTful and secure?
Our product registers new players on our service, and we've chosen to host it on Azure (we're using .NET) and we wanted it to be stateless (for scalability) and relatively secure.
Since this is the ...
1
vote
1answer
73 views
How to authenticate an archive
Background:
I have a updator feature in my program which will downloads updates to a directory specified be the user. Then user can install these updates whenever he/she wants by just opening them. ...
1
vote
4answers
114 views
Simple method to authenticate human input into a form for relaying via email to a 3rd party
I put up a webpage advertising a particular birthday party. A simple html page served by apache2 on ubuntu server 12.04. I have a link on the page to a cgi script-Python-that asks the requester to ...
1
vote
1answer
408 views
Security in Authentication in single page apps
What's the most secure method of performing authentication in a single paged apps? I'm not talking about any specific client-side or server-side frameworks, but just general guidelines or best ...
0
votes
1answer
101 views
Using oAuth as a complement to an existing authentication system?
I am hoping this is the correct stack exchange to be asking this, here goes.
I am building a new website whereby it implements its own custom login system. You simply register your username, email ...
0
votes
1answer
310 views
Custom use of Authorization header in a REST API
I'm building a REST api where clients are authenticated using client certificates. A client in this case is not an individual user, but some sort of a presentation layer. Users are authenticated using ...
1
vote
1answer
70 views
Design pattern for sharing Social Authentication across subdomains?
Right now building an app that authenticates using either email or different social accounts. Because it is going to function on multiple subdomains and domains, I'm wondering if there's a design ...
7
votes
6answers
599 views
Will Authentication over HTTPS Slow My Application?
I am building a web application and RESTful web service.
I have been reading various articles about the best way to authenticate the requests to the web service.
The best option for me seems to be ...
3
votes
2answers
391 views
What .NET objects should I use to create a cookie based session in MVC?
I'm writing a custom password reset application that uses a validation technique that doesn't fit cleanly with ASP.NET Membership Provider's challenge questions.
Namely I need to invoke a workflow ...
1
vote
2answers
186 views
Simplest token-system for authenticating and authorizating
I want to make Python script that will accept input from Vim and send it to my web-site. So basically I want to make Vim my text-editor for blog articles.
Of course, I need to authenticate and ...
2
votes
1answer
124 views
Should I manage authentication on my own if the alternative is very low in usability and I am already managing roles?
As a small in-house dev department, we only have experience with developing applications for our intranet. We use the existing Active Directory for user account management. It contains the accounts of ...
4
votes
2answers
154 views
Standard -server to server- and -browser to server- authentication method
I have server with some resources; until now all these resources were requested through a browser by a human user, and the authentication was made with an username/password method, that generates a ...
2
votes
2answers
787 views
Sharing authentication methods across API and web app
I'm wanting to share an authentication implementation across a web application, and web API. The web application will be ASP.NET (mostly MVC 4), the API will be mostly ASP.NET WEB API, though I ...
5
votes
3answers
277 views
What is the best policy for allowing clients to change email?
We are developing a web application with a fairly standard registration process which requires a client/user to verify their email address before they are allowed to use the site. The site also ...
4
votes
1answer
577 views
Authentication for users on a Single Page App?
I have developed a single page app prototype that is using Backbone on the front end and going to consume from a thin RESTful API on the server for it's data.
Coming from heavy server side ...
11
votes
2answers
3k views
How should an API use http basic authentication
When an API requires that a client authenticates to it, i've seen two different scenarios used and I am wondering which case I should use for my situation.
Example 1. An API is offered by a company ...
5
votes
1answer
433 views
API Auth vs User Auth
I have read many posts and articles on this topic but still cant connect the dots. I want to make a Rails app that is strictly a JSON API maybe using Sinatra or the rails-api gem. I also want to make ...
3
votes
2answers
251 views
What's the benefit of Azure ACS if ASP.NET 4.5 includes OAuth and OpenID providers?
Azure ACS offers OAuth and OpenID providers, and now that ASP.NET 4.5 offers the same thing, without the added cost, is there any reason for a .NET developer to consider ACS?
(Disclaimer, I don't ...
2
votes
0answers
90 views
How do you get the usernames/passwords onto a STUN or TURN server for long-term credential authentication?
The STUN and TURN specifications allow for client authentication using usernames and passwords, and call this authentication via long-term credentials. In fact, TURN requires that clients authenticate ...
5
votes
1answer
316 views
Java solution for mutual authentication with smart card
I need to develop a Java solution for mutual authentication between Tomcat 6 (server) and SmartCard "IDGo 300" (client).
In order to do this I thought of the following scheme:
1.Tomcat (server) send ...
1
vote
4answers
187 views
Is restricting sessions to an absolute IP likely to have a wide impact on mobile networks?
Our website currently restricts a cookie-based session to the IP address that was originally sent the Set-Cookie HTTP header. In the past a user's IP would rarely change, so this didn't present much ...
3
votes
2answers
1k views
What is the correct way to implement Auth/ACL in MVC?
I am looking into making a correctly laid out MVC Auth/ACL system. I think I want the authentication of a user (and the session handling) to be separate from the ACL system. (I don't know why but this ...
2
votes
1answer
736 views
How to host a site in another site - with little or no coding
SUMMARY: All of these happens on Site A
User visits site A
User enter username and password
User click on Login Button
User authenticated on Site B behind the scene
User is shown a page on Site A ...
0
votes
3answers
192 views
Lightweight external authentication - looking for an OpenID alternative
We have a "backend" area for performing maintenance/debugging tasks on most of our developed websites and (obviously) this area requires authentication.
Most of these websites have their own ...
2
votes
1answer
633 views
HTTP PHP Authentication and Android
I am working on a website for which I hope to have an application for as well. Because of this, I am creating PHP API's which will go into my Database and serve specific data based on the ...
0
votes
1answer
156 views
JAAS - What is the required control flag used for?
The Java Authentication and Authorization Service (JAAS) defines that if a login module has the flag "REQUIRED", the authentication should proceed down the login module list on success or failure, and ...
3
votes
4answers
4k views
REST Service Authentication/Authorization
I have a WCF rest service that will be consumed by multiple clients. The information returned by the client requires me to know who they are, so that I can return information specific to them.
Is ...
1
vote
1answer
359 views
What is the future for ASP.NET Membership Providers? [closed]
While working on a new project with MVC3, a DI framework (Ninject), and unit tests (NUnit) paired with mocks (Moq), I found setting up the Membership Provider felt a bit "awkward". I've run into tasks ...
2
votes
4answers
255 views
How to implement a no-login authentication system
I am looking to build a very loose authentication system that can track a user and link submitted data/comments to a specific user. The submissions are essentially anonymous, but a user may want to ...
2
votes
1answer
358 views
Security in a private web service
I am developing a web site and a web service for a small on-line game. Technically, I'll be using Express (node.js) and MongoDB+Redis for the databases. This the structure I came up with:
One ...
3
votes
1answer
102 views
How safe is it to cache a user ticket in SESSION
I'm working on a client library to interface with my company's api, and we generate a user ticket when the user logs in using the api.
Obviously I don't want to send the user ticket to the client ...
2
votes
3answers
94 views
Authentication for 'participants' vs 'users'
I'm building a site that lets users schedule interviews/conferences with third parties and I'm wondering what's the best way to provide security around the participant experience while providing the ...
1
vote
1answer
173 views
How can I efficiently approach cookie-based session handling?
Currently our web application uses server-sided sessions. Because of the large amount of memory usage, we want to switch to cookie-based sessions. I have been thinking about several ways:
Idea 1
My ...
3
votes
3answers
741 views
Did I understand the website “autologin” feature right?
I'm developing an authentication library (*) for a website and I realized that maybe I'm not completely understanding what an "autologin" feature is, and how to develop it.
While gathering infos and ...
46
votes
8answers
9k views
Is browser fingerprinting a viable technique for identifying anonymous users?
Is browser fingerprinting a sufficient method for uniquely identifying anonymous users? What if you incorporate biometric data like mouse gestures or typing patterns?
The other day I ran into the ...
5
votes
1answer
89 views
Is there a proven concept to website reverse certificate authentication?
We're looking at exposing some of our internal application data externally via a website. The actual details of the website aren't that interesting, it'll be built using ASP.NET/IIS etc, that might be ...
1
vote
2answers
609 views
Sharing Authentication Across Subdomains using cookies
I know that in general cookies themselves are not considered robust enough to store authentication information.
What I am wondering is if there is an existing design pattern or framework for sharing ...
-3
votes
1answer
604 views
Devise and Warden
I've been using Devise for a little while, and I've realized it's built on something else called Warden that handles authentication. What does Devise offer me outside of Warden, because I was ...
4
votes
2answers
385 views
Two factor authentication using time base key generator on smartphones
I recently enabled two factor authentication for my Google account. One of the ways of getting the second factor (the key that I have) is to install an Android app on my phone that displays a key for ...
3
votes
2answers
193 views
Using Paypal (or similar) to log into my site?
I have a web site and I want to offer a few levels of service - one free, one for a one-off payment, and one for a subscription. My first inclination is to use Paypal for the payment options. I ...
10
votes
4answers
587 views
Am I Over-Engineering If I Consider User's Intentional Wrongdoing?
Is it over-engineering if I add protection against a user's intentional wrongdoing (to put it mildly), if the harm the user can incur is not related to my code?
To clarify, I'm exposing a simple JSON ...
3
votes
2answers
228 views
Implementing Lazy Registration
I'm interested in setting up Lazy Registration on my website.
Ideally, I'd like people to be able to fill out a record that might include their name, email, address, etc. and then record it to a user ...
0
votes
1answer
176 views
Looking for an up-to-date PHP Auth script to manage users
I have a client that has a rather generic, but established, website up and running. He now wants to add a simple UserAuth mechanism by which users can register (name,email) and access "member pages". ...
