Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

learn more… | top users | synonyms

0
votes
1answer
67 views

How to authenticate against an API?

In a enterprise distributed system, a user of a web portal can sign into one site, be redirected to a federation provider. Once they log in with, for example, a facebook account, that user is ...
0
votes
0answers
24 views

Authentication of mobile apps using Identity server [closed]

What is the reference architecture for adding authentication and authorization to a mobile application. Do I need access tokens infrastructure or can I just use validation of a token data using ...
0
votes
0answers
12 views

Authentication structure for public area within admin dashboard?

I'm looking for input on how to organize the authentication scheme for a SaaS app where the application users offer a questionnaire to their customers. The paying SaaS user needs to login in order ...
0
votes
0answers
36 views

SPA + Web API + Azure active directory: authenticating with graph API

I have an angular client app which talks to an ASP.NET Web API backend. I am using Azure Active Directory to authenticate users, and I have registered my Web API with my Azure AD tenant. I am using ...
-1
votes
0answers
53 views

X-Authenticated-User … what/where/how?

I am developing some software to process to add some logging and authentication to HTTP requests. I am working with others on this who have decided, for various reasons, that we need to support basic ...
0
votes
0answers
36 views

LDAP Authentication with RESTFUL API

I am developping a RestFul API with Symfony2. (v2.6) The front-end application is build with AngularJs. (v1.3.16) I would like to install SingleSignOn Authentication with an Active Directory. Both ...
0
votes
0answers
46 views

Web API - Can Windows Authentication and an API key be used on same call? [migrated]

I'm new to web services and am creating HTTP services using .NET Web API 2. The consumers of the services will be other applications, but in the future I foresee web applications (browsers, mobile ...
0
votes
3answers
212 views

How can I reinforce that security questions answers should not be the same and how to encrypt?

When my users are creating an account they need to fill and set several security questions pertaining to their account. I am wondering, how can I make sure that the answer the user enters for each ...
0
votes
0answers
97 views

Single sign-on flow using ASP.NET MVC + Active Directory

I'm looking into creating a single-sign-on portal built in ASP.NET MVC. This single sign on portal should give users the option to sign in with their individual account (which should be verified ...
0
votes
2answers
117 views

The best shard key for user authentication

For access to my API user should send login and password and get generated token for access. Account login password Suppose the size of account's table is very large. So large - so needs ...
1
vote
1answer
108 views

Token based authentication and multiple sessions

I've a token based authentication system (REST) that I inherited for an iOS app (can't change), and I've to re-use the same authentication web api system (that I can change to adapt for the web ...
3
votes
1answer
107 views

JSON Web Token - why is the payload public?

I can't understand the reasoning for making the claims/payload of a JWT publicly visible after base64 decoding it. Why? It seems like it'd be much more useful to have it encrypted with the secret. ...
1
vote
1answer
144 views

What OpenID Connect flow is right for me?

Here's the deal. I have a .NET MVC5 web application that I'm moving up to the OpenID Connect standard. I also would like to be able to access controller methods from a mobile app (much like an API) ...
5
votes
3answers
180 views

Multi platform password storage with retrieval for applications with authorization?

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use. Are ...
0
votes
0answers
47 views

Authenticating users of a chrome extension against a ASP.NET MVC web application

I have a chrome extension which is supported by a ASP.NET MVC web app as the back end. I want the chrome extension user to login through my web application and once he is logged in, the chrome ...
1
vote
1answer
58 views

oauth 2 authenticate with other authorization server

Let's assume i have a mobile app backed up by a Server. the server is both an Authorization and Resource Server. Now i want to enable users to register / login to the app using Facebook API. After ...
0
votes
1answer
78 views

Personal Digital Signatures in Web Applications [closed]

In order to sign data with personal digital signature in a web application, server side languages like PHP can do the whole job, but that would require that the user uploads his private key, lets say ...
0
votes
1answer
47 views

Authenticating users across multiple web services

User details (name, address, etc) are stored across multiple sites that are vendor specific. For example, vendor A holds information concerning room bookings while vendor B holds information specific ...
0
votes
2answers
111 views

Should a “secret access code” use the same security as a normal password? [closed]

Obviously, when you store a password, you should use something similar to bcrypt before you store it in in the database. But I have a client who wants to add the ability to add a "secret code" to ...
1
vote
1answer
175 views

Should I store my user claims in the JWT token?

I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure. I cannot makeup my mind as to whether ...
1
vote
2answers
62 views

Should I specify the userId in the REST URL structure?

Basically, one feature of my app is to retrieve the logged user's friends. Actually, I hesitate between both kind of endpoints: GET /api/users/friends GET /api/users/:userId/friends Using 1, ...
3
votes
2answers
103 views

Using Facebook to authenticate, how to link to user record in my app? Email?

I'm using Facebook to authenticate users. We also have conventional username/ password login and registration form too. Anyway, when a user chooses to login with Facebook, we use the following ...
2
votes
0answers
116 views

Oauth 2 store access token vs verifying on each call

Let's say my Server is both Authorization Server and Resource server My Client (for example mobile app) can authenticate in 2 matters: via Resource Owner Password Credentials Grant via ...
1
vote
1answer
77 views

Purpose of authentication on API's?

After asking this question I found that I have a different question. What's the purpose of authenticating an API anyway? Take Twitter for instance. If you want to use this link to load some user's ...
0
votes
4answers
298 views

Identifying user of a webapp

For a small webapp I want to be able to identify a user. The issue is, if the user cheats in some manner, I want to be able to forbid him the usage of my application. I already have done extensive ...
3
votes
1answer
92 views

How do you implement an active sessions system like LinkedIn? [closed]

With some platforms, like LinkedIn, you can see a list of all sessions where you are logged in, and you can even log them out on a distance. How would you implement something like that? I'm not ...
0
votes
2answers
111 views

REST backend restricted access only for humans

I will design a REST backend that will work with my database. I want users to access this data by viewing my webpage (I will work with an MVC JS framework) without logging in. At the same time, I ...
2
votes
0answers
72 views

Adding new service to authenticated website

So I've created an API that I want to leverage to add some functionality to an existing web app. My current website authenticates users using SAML. What I'm looking to do is instead of moving the code ...
4
votes
2answers
447 views

How to prevent third party misuse of what is intended to be a private api (avoiding what happened to Snapchat)?

I have never used Snapchat and do not intend to but I have been reading up about what happened to them with respect to the recent media coverage about pictures being leaked especially because I am ...
1
vote
0answers
113 views

Mutual Authentication in JSON or AJAX only?

AFAIK we must install the client-certificate into the users browser to connect with https-sites using server-certificates to have a mutual authentication. What about AJAX and JSON, can we connect to ...
1
vote
0answers
36 views

Reliable way to generate a token in a SOAP webservice

Legacy SOAP service here at work use a token authentication. The flow is: As first step I call the startSession method passing username (say myUser) and password (say myPWD) as parameter. At this ...
1
vote
2answers
137 views

When should I implement authentication in a database?

I'm currently embarking on a MongoDB project (a simple user login system), and I notice that there is an option for authentication. Here is the server string, with the userinfo shown as optional ...
3
votes
1answer
94 views

Is “friendly fire” session replay a valid concern?

I've been reading a lot about sessions and security, trying to learn as much as possible before writing too much code. I've read about limiting session replay by including a timestamp within the ...
3
votes
1answer
200 views

Is my websocket session idea practical?

In a situation where all communication (including logging in) between a client (web browser) and server is done over a persistent TLS encrypted websocket, would there be anything inadvisable about ...
1
vote
2answers
280 views

Common techniques to integrate social media login to a website that requires account registration

I have developed websites where users would register with a username of their choice and an entry would be created in a database table that holds their username and some sort of salted password. They ...
0
votes
1answer
323 views

Knowing who is the user in every request (every action, every view, every time)

I have many model classes that are mapped from/to tables using EF. Two of them are User and UserCookie, which are stored in tables Users and UserCookies. public class User { public long UserId { ...
0
votes
0answers
374 views

Login from external application in MVC

We have an ASP.Net MVC application that use Identity provider to authenticate users. A new customer now wants to access owr application pressing a button inside their winform app. I started to modify ...
0
votes
2answers
352 views

How does Facebook manage to allow a user unlimited sessions?

I could login through the website, android app, iOS app, the browsers on mobile, and when I log out from one, it doesn't log me out of all of them. Traditionally, you would log out of all the services ...
0
votes
0answers
102 views

What should my redirect URL be for OAuth2.0 in Azure if my application is a local windows application?

I am setting up OAuth2.0 on Azure. I am at the stage where I have been allowed access to the application and a Code has been returned in my redirect URL. My application is a local windows application. ...
2
votes
1answer
62 views

Security Pattern to store SSH Keys

I am writing a simple flask application to submit scientific tasks to remote HPC resources. My application in background talks to remote machines via SSH (because it is widely available on various HPC ...
0
votes
2answers
204 views

Separating roles authorization and database

Something really bothers me about the way authorization tends to be done with roles in ASP.NET MVC. The way it is normally done is that you have a Users table and a Roles table. A User can have many ...
0
votes
0answers
85 views

If OWIN is used on PC and Mac (Mono), then what is the abstraction for claims and authentication?

If the PC implementation of OWIN is Katana, and OWIN doesn't define authentication abstractions, (or authorizations)* then: What is the abstraction for Authentication (cookies, forms, OAuth, SAML, ...
0
votes
0answers
580 views

Best practice: Secure Android app online authentication

Currently, I develop an Android App needing online authentication for login (and registration). The main focus is on security. I’m amaing for: keeping the users’ passwords safe and preventing MITM ...
1
vote
1answer
88 views

Testing for Authentication loop holes / bugs

We've got a web application which is 99% complete prior to public beta, were currenlty securing the site from security perspective, locking down the server, db etc, one thing I'm concerned about but ...
1
vote
2answers
135 views

Should all HTTP requests including credentials be made using a POST even if it is actually just a request for data?

Assume there is a request which is going to look up a list of items from a service which requires authorisation (e.g. it's behind a Basic Authentication domain). If the service didn't require ...
0
votes
0answers
89 views

Token based autorization for a web game

I am lead developer for a multiplayer game in a small startup company. I would like to present here my solution for token based authentication and hear your opinions about possible weak spots. I am ...
0
votes
0answers
38 views

Mobile application: What should be the server authentication strategies?

I am developing an mobile application for the first time and have some confusions around it What I plan to do? The iPhone application will have Sign in with Google where user will authenticate on ...
1
vote
1answer
91 views

Is OAuth suitable for this scenario?

I need to create a simple web application for track expenses, with some basic actions (user must be able to create an account and log in, list expenses, edit them, etc) with a REST API for each one, ...
3
votes
0answers
320 views

Authorization and Authentication using multiple types of authentication in MVC

Currently I am managing a team where we're building a new SaaS application. The way it is currently structured is that we have a solution that has our business logic and data, and a solution that ...
0
votes
1answer
328 views

Is it a good practice to decouple the membership system?

Currently I'm developing a project that basically is built with ASP.NET Web API. The membership system I'm using is ASP.NET Identity. The only problem I'm seeing with this is that the membership ...