Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

learn more… | top users | synonyms

0
votes
0answers
24 views

Principles for secure user login/authentication

Backstory: In my from-scratch PHP/MySQL web development projects, I often start (and end) working on a secure user authentication. I'm self-taught and never certain that my site is adequately ...
1
vote
1answer
37 views

How to implement a secure way to allow users to reset password via url?

Password reset option should be given only if the link has come from that specific user's inbox and not from somewhere else. How to implement url in such a way that the required information i.e. ...
4
votes
1answer
54 views

is “ASP.NET Membership” still a good choice for ASP.NET MVC authentication nowdays?

The last time I used asp.net 4 years ago, the "ASP.Net Membership provider" was the best way to do user authentication in an ASP.Net application. Now days, Using the "ASP.Net Membership provider" is ...
0
votes
0answers
12 views

Web application: Split auth from business logic? And session values?

So when starting a new web project (ASP.NET mostly) I always end up arguing with myself: Where do I keep the Authentication logic, the User entities and how do I combine them with my other business ...
0
votes
1answer
49 views

Is it a bad idea to use Facebook friendships as sole source of filtering content?

I'm writing a social app in Django where all users sign up through Facebook using Python Social Auth. All content that a user sees will be content created by her Facebook friends. Initially, I planned ...
-3
votes
0answers
23 views

Spring MVC OpenLDAP Authentication [closed]

I have made a Spring MVC user login Java application, but I want the user login to get authenticated using OpenLDAP ? Can someone explain the procedure ?
1
vote
0answers
37 views

Facebook Login vs Python Social Auth (or django-allauth, etc.)

Background: I'm creating a mobile app using an API built with Django using Django REST Framework and hosted on Heroku. In the past, I've used Python Social Auth with this setup to authenticate users ...
0
votes
0answers
15 views

Using JWT over Oauth2.0

I am creating an API that will communicate with a ReactJS app. I am in two minds whether to go through with the implementation of OAuth2.0. The question is why should I use OAuth2.0 implicit grant ...
5
votes
2answers
108 views

REST server user authentication

So i am creating my first larger scale application (by larger scale i mean something i see myself publishing in the app store) and i am not sure of how to handle user authorization. The client will ...
0
votes
1answer
39 views

Web App Authentication's Architecture Related Query

I have a web app that makes use of node.js in the backend and angulajs on the front end. Let's say I have a user who has the ability to login via multiple systems; I must allow multiple logins. I ...
4
votes
0answers
40 views

Is this a correct JWT authentication implementation?

I've created a Flask RESTful API which requires an email / password and Facebook login flow. This will probably need to be extended in the future to support more social logins. I've chosen to ...
1
vote
0answers
21 views

From PreAuthentication to JWTAuthorization

I would like to ask about a problem I have designing a security flow. The context I have a webapp designed in two modules web and server Web: it's a single page client, built with Angular 1.5.5 (...
2
votes
1answer
45 views

JWT refresh token exponentially?

This is how I do my JWT refresh token: A token is check for validity every time a request is made. If it's not expired, allow access. If it's expired calls another function named RefreshToken to ...
1
vote
0answers
23 views

When do I reset Two Factor Authentication secret keys?

I have built a simple authentication system for my web application that makes use of the open-source time-based OTP algorithm (RFC 6238). The key for each user is generated when the user is registered ...
2
votes
1answer
32 views

User auto account deletion when using OAuth2

Web app users can delete their accounts, they re-enter the password and if it fits, the account and its assets are removed (soft deletion). They can register using an email (and a password) or using ...
-1
votes
1answer
76 views

Is the mechanism used in Passwordless module widely used? [closed]

I came across Passwordless which uses email/SMS to allow the user to login. Is this mechanism widely used? What are the advantages/disadvantages of using such mechanism? I'm asking because I haven't ...
0
votes
0answers
38 views

How to use Integrated authentication for a user other than the logged in user?

I have a Winforms .net app that requires a user to login to our app. I want to use integrated database authentication, but the user logged in to the app may be a different (Windows/Active Directory) ...
-2
votes
3answers
171 views

Authenticate user without password [closed]

I would like to work on a project where I can authenticate or validate a user without the typical user/password combination to authenticate a user in my system. In other words, I would have a API and ...
0
votes
0answers
20 views

Where to store authentication/authorization entities with respect to crosscuting concerns?

Can you explain me how and where to store authentication/authorization entities in project structure. For example I have 4 projects in my solution in Visual Studio: SolutionName.WebApp SolutionName....
0
votes
1answer
264 views

How to secure my authentication code?

I'm working a PHP project where I need to authenticate users to a portal. Just wanted to get your opinion on the code, statistics of the website show some strange behaviour with the login form. ...
1
vote
1answer
44 views

Should arbitrary numbers be stored as strings in a database?

I'm using Google as a login system for my latest project. So, my users table has a column named googleid, which stores Google's unique user id, which is a number, with a few dozen digits. For example, ...
1
vote
0answers
149 views

Implementing software licensing

I have an unpoliced piece of software and I must implement some control over who can install it via licensing. I already have an authentication server that implements OAuth 2.0 and OpenId that's used ...
0
votes
0answers
56 views

Authenticate to a SQL Server with Active Directory credentials from a UWP app

I've been tasked to design an application and a database to store information our company's electricians have measured on-site. We need to save in our database who exactly did which measurement. ...
3
votes
3answers
269 views

Modern recommendations for password recovery

I'm going to implements password recovery in my authentication. I haven't put this together in a while and wondering if there is anything I ought to be aware of. My idea at the moment is: User ...
0
votes
0answers
497 views

How to implement authentication between asp.net MVC application and Web API?

For an upcoming project, we have to build a secured web application with ASP.NET MVC. This web application will communicate with an ASP.NET Web API for all the CRUD actions. The user will have an ...
0
votes
2answers
67 views

Handling delay in entry of OTP for log in validation

There's an application, which accepts a user id and password to login. Validation of the id and password is processed by another system. Now after password validation, the application generates a One ...
0
votes
0answers
43 views

“remember me” functionality but user database on another app on another sub-domain

I'm considering how to add remember me functionality to our app. However we have our app, and a separate app that handles authentication on another sub-domain. When authenticating from one of our apps,...
0
votes
2answers
33 views

Secure authentication using JWT

I read about JWT and how they can provide secure authentication for calling api routes over http. I naively implemented it and here is how it goes : a client posts username and password to a login ...
0
votes
0answers
54 views

Is Shiro's use of Auth Exceptions an example of control flow? [duplicate]

In Java/OOP-land, it is a well established anti-pattern to use exceptions for control flow. Apache Shiro is one of the standard Java security frameworks. When using Shiro, especially when ...
2
votes
0answers
58 views

Client Browser, Node Server, Web API auth structure

I have a web API that accepts Authorization headers to allow access. It responds with the requested data in addition to setting a session cookie. Subsequent requests can be made with no auth headers ...
4
votes
1answer
158 views

Filtering request and responses in RESTful MEAN stack

I have a very basic RESTful service written using the MEAN stack (MongoDb, Express.js, Angular.js, Node.js) and utilizing the Mongoose ODM. Product schema var productSchema = new mongoose.Schema({ ...
2
votes
1answer
115 views

Tracking online users with a stateless architecture

I own a stateless architecture, exchanging a JWT token between client and server at authentication time. I want to store in database (once per day) a timestamp related to the user access. Indeed, I ...
2
votes
1answer
94 views

Social auth from mobile app connected to API server

I have a Node.js server using PassportJS that uses social login via Google, Facebook, and Twitter. The Node.js server hosts an API that uses the PassportJS middleware to authenticate routes and ...
0
votes
1answer
48 views

Where should I log in the user based on http session: service or controller?

I know that best practice is to let everything about authentication/authorization to the service layer. Controller should not be aware of that. But how to let a service (from service layer so) to ...
0
votes
0answers
13 views

Proxied server requests + forwarding authentication info in a secure fashion

We are using PassportJS with a couple of Node.js servers - but we have some questions about how to use Passport with "proxy" requests. My main question is how do we (and should we at all) forward the ...
2
votes
2answers
49 views

Customer Authentication in a website

Just to be clear, by authentication I don't mean user-authentication, but I want to make sure that my app is running on the customer's server and in a defined time-span. Some of our customers use our ...
2
votes
0answers
175 views

Caching authenticated requests for all users

I am working on a web app that must deal with very large impulses of simultaneous users, who need to be authorised, to request identical content. In it's current state, it's totally crippling to even ...
0
votes
0answers
72 views

Understanding SSO flows

I m actually studying SSO using OAuth2 and I m having some questions working with real architecture. I understand the way how we connect to a tier server, getting an access token and making requests ...
0
votes
0answers
30 views

Modeling token generation on OAuth2 for two different users

I have an OAuth2 implementation that works with the authorization_code flow. As per an implicit relationship, one kind of user (Alice) is able to retrieve tokens for the other (Bob). On the RFC it ...
1
vote
0answers
54 views

'HMAC style' design example for a shared secret

I'm looking to secure an API based on a shared key and a given username and datetime. The API gives access to trusted third parties and does not require the input from a user in order to access their ...
1
vote
1answer
45 views

Preventing unauthorized writing to parts of server [closed]

Say I have two members which share a server. Both members have a game that is accessible to anyone and after playing, it records high scores by sending a request to write to a file on the server. ...
3
votes
1answer
393 views

How should I pass login data from client to server using REST API

I want to create a new session, the new session will be created by logging in (naturally). Should I pass the username and password: via URL (POST request to session?username=:username&password=:...
3
votes
1answer
99 views

Hide authentication information on Github

When your creating a project that has some sort of information that needs to be private (authentication details, etc), but you want to use some public repo like Github, are there anything that can be ...
2
votes
0answers
37 views

Architecting an account system for oauth that bridges a new and legacy system

So this question is specific to implementing auth in our system but I'm looking for high-level (just the architecture) solution or advice on which direction to head towards. Overview (TL;DR) Our ...
5
votes
1answer
2k views

REST API security: HMAC/key hashing vs JWT

I just read this article that is a few years old but describes a clever way of securing your REST APIs. Essentially: Each client has a unique public/private key pair Only the client and the server ...
1
vote
1answer
79 views

OAuthv2 access tokens and resource servers

In the OAuthv2 authorization grant, a “client app” authenticates itself against an “auth server”, and receives an “access token” for accessing resources living on a “resource server”. My concerns: ...
2
votes
1answer
123 views

OAuthv2 for distributed applications

Please note: Months ago I asked this question that received a truly amazing answer and introduction to OAuthv2. I’m now knee deep in the implementation of such a system and have similar (but notably ...
1
vote
2answers
213 views

JWT based webservice authentication

I'm currently writing a web service that will be consumed by an android app. To access user specific content, one must authenticate against the service. Since I'm not (primarily) using a ...
2
votes
2answers
296 views

Restful User/Password Authentication

I'm currently designing a REST-API with the following properties: Backend for a single page application (Later Apps) Integrated user database for each instance HTTPS/TLS only Authentication with ...
0
votes
0answers
85 views

MVC OAuth with keeping user logged in

I am creating a news site where one can add some news. User will be registering with theirs facebook accounts like on this site. There will not be other type of users, just facebook users. And I wish ...