Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

learn more… | top users | synonyms

4
votes
0answers
30 views

Is this a correct JWT authentication implementation?

I've created a Flask RESTful API which requires an email / password and Facebook login flow. This will probably need to be extended in the future to support more social logins. I've chosen to ...
1
vote
0answers
18 views

From PreAuthentication to JWTAuthorization

I would like to ask about a problem I have designing a security flow. The context I have a webapp designed in two modules web and server Web: it's a single page client, built with Angular 1.5.5 ...
2
votes
1answer
40 views

JWT refresh token exponentially?

This is how I do my JWT refresh token: A token is check for validity every time a request is made. If it's not expired, allow access. If it's expired calls another function named RefreshToken to ...
1
vote
0answers
21 views

When do I reset Two Factor Authentication secret keys?

I have built a simple authentication system for my web application that makes use of the open-source time-based OTP algorithm (RFC 6238). The key for each user is generated when the user is registered ...
2
votes
1answer
32 views

User auto account deletion when using OAuth2

Web app users can delete their accounts, they re-enter the password and if it fits, the account and its assets are removed (soft deletion). They can register using an email (and a password) or using ...
-1
votes
1answer
74 views

Is the mechanism used in Passwordless module widely used? [closed]

I came across Passwordless which uses email/SMS to allow the user to login. Is this mechanism widely used? What are the advantages/disadvantages of using such mechanism? I'm asking because I haven't ...
0
votes
0answers
37 views

How to use Integrated authentication for a user other than the logged in user?

I have a Winforms .net app that requires a user to login to our app. I want to use integrated database authentication, but the user logged in to the app may be a different (Windows/Active Directory) ...
-2
votes
3answers
167 views

Authenticate user without password [closed]

I would like to work on a project where I can authenticate or validate a user without the typical user/password combination to authenticate a user in my system. In other words, I would have a API and ...
0
votes
0answers
20 views

Where to store authentication/authorization entities with respect to crosscuting concerns?

Can you explain me how and where to store authentication/authorization entities in project structure. For example I have 4 projects in my solution in Visual Studio: SolutionName.WebApp ...
0
votes
1answer
260 views

How to secure my authentication code?

I'm working a PHP project where I need to authenticate users to a portal. Just wanted to get your opinion on the code, statistics of the website show some strange behaviour with the login form. ...
1
vote
1answer
43 views

Should arbitrary numbers be stored as strings in a database?

I'm using Google as a login system for my latest project. So, my users table has a column named googleid, which stores Google's unique user id, which is a number, with a few dozen digits. For example, ...
1
vote
0answers
113 views

Implementing software licensing

I have an unpoliced piece of software and I must implement some control over who can install it via licensing. I already have an authentication server that implements OAuth 2.0 and OpenId that's used ...
0
votes
0answers
45 views

Authenticate to a SQL Server with Active Directory credentials from a UWP app

I've been tasked to design an application and a database to store information our company's electricians have measured on-site. We need to save in our database who exactly did which measurement. ...
3
votes
3answers
267 views

Modern recommendations for password recovery

I'm going to implements password recovery in my authentication. I haven't put this together in a while and wondering if there is anything I ought to be aware of. My idea at the moment is: User ...
0
votes
0answers
401 views

How to implement authentication between asp.net MVC application and Web API?

For an upcoming project, we have to build a secured web application with ASP.NET MVC. This web application will communicate with an ASP.NET Web API for all the CRUD actions. The user will have an ...
0
votes
2answers
60 views

Handling delay in entry of OTP for log in validation

There's an application, which accepts a user id and password to login. Validation of the id and password is processed by another system. Now after password validation, the application generates a One ...
0
votes
0answers
43 views

“remember me” functionality but user database on another app on another sub-domain

I'm considering how to add remember me functionality to our app. However we have our app, and a separate app that handles authentication on another sub-domain. When authenticating from one of our ...
0
votes
2answers
33 views

Secure authentication using JWT

I read about JWT and how they can provide secure authentication for calling api routes over http. I naively implemented it and here is how it goes : a client posts username and password to a login ...
0
votes
0answers
54 views

Is Shiro's use of Auth Exceptions an example of control flow? [duplicate]

In Java/OOP-land, it is a well established anti-pattern to use exceptions for control flow. Apache Shiro is one of the standard Java security frameworks. When using Shiro, especially when ...
2
votes
0answers
53 views

Client Browser, Node Server, Web API auth structure

I have a web API that accepts Authorization headers to allow access. It responds with the requested data in addition to setting a session cookie. Subsequent requests can be made with no auth headers ...
4
votes
1answer
153 views

Filtering request and responses in RESTful MEAN stack

I have a very basic RESTful service written using the MEAN stack (MongoDb, Express.js, Angular.js, Node.js) and utilizing the Mongoose ODM. Product schema var productSchema = new mongoose.Schema({ ...
2
votes
1answer
113 views

Tracking online users with a stateless architecture

I own a stateless architecture, exchanging a JWT token between client and server at authentication time. I want to store in database (once per day) a timestamp related to the user access. Indeed, I ...
2
votes
1answer
79 views

Social auth from mobile app connected to API server

I have a Node.js server using PassportJS that uses social login via Google, Facebook, and Twitter. The Node.js server hosts an API that uses the PassportJS middleware to authenticate routes and ...
0
votes
1answer
46 views

Where should I log in the user based on http session: service or controller?

I know that best practice is to let everything about authentication/authorization to the service layer. Controller should not be aware of that. But how to let a service (from service layer so) to ...
0
votes
0answers
13 views

Proxied server requests + forwarding authentication info in a secure fashion

We are using PassportJS with a couple of Node.js servers - but we have some questions about how to use Passport with "proxy" requests. My main question is how do we (and should we at all) forward the ...
2
votes
2answers
46 views

Customer Authentication in a website

Just to be clear, by authentication I don't mean user-authentication, but I want to make sure that my app is running on the customer's server and in a defined time-span. Some of our customers use our ...
2
votes
0answers
147 views

Caching authenticated requests for all users

I am working on a web app that must deal with very large impulses of simultaneous users, who need to be authorised, to request identical content. In it's current state, it's totally crippling to even ...
0
votes
0answers
67 views

Understanding SSO flows

I m actually studying SSO using OAuth2 and I m having some questions working with real architecture. I understand the way how we connect to a tier server, getting an access token and making requests ...
0
votes
0answers
30 views

Modeling token generation on OAuth2 for two different users

I have an OAuth2 implementation that works with the authorization_code flow. As per an implicit relationship, one kind of user (Alice) is able to retrieve tokens for the other (Bob). On the RFC it ...
1
vote
0answers
54 views

'HMAC style' design example for a shared secret

I'm looking to secure an API based on a shared key and a given username and datetime. The API gives access to trusted third parties and does not require the input from a user in order to access their ...
1
vote
1answer
45 views

Preventing unauthorized writing to parts of server [closed]

Say I have two members which share a server. Both members have a game that is accessible to anyone and after playing, it records high scores by sending a request to write to a file on the server. ...
3
votes
1answer
337 views

How should I pass login data from client to server using REST API

I want to create a new session, the new session will be created by logging in (naturally). Should I pass the username and password: via URL (POST request to ...
3
votes
1answer
98 views

Hide authentication information on Github

When your creating a project that has some sort of information that needs to be private (authentication details, etc), but you want to use some public repo like Github, are there anything that can be ...
2
votes
0answers
35 views

Architecting an account system for oauth that bridges a new and legacy system

So this question is specific to implementing auth in our system but I'm looking for high-level (just the architecture) solution or advice on which direction to head towards. Overview (TL;DR) Our ...
5
votes
1answer
1k views

REST API security: HMAC/key hashing vs JWT

I just read this article that is a few years old but describes a clever way of securing your REST APIs. Essentially: Each client has a unique public/private key pair Only the client and the server ...
1
vote
1answer
72 views

OAuthv2 access tokens and resource servers

In the OAuthv2 authorization grant, a “client app” authenticates itself against an “auth server”, and receives an “access token” for accessing resources living on a “resource server”. My concerns: ...
2
votes
1answer
111 views

OAuthv2 for distributed applications

Please note: Months ago I asked this question that received a truly amazing answer and introduction to OAuthv2. I’m now knee deep in the implementation of such a system and have similar (but notably ...
1
vote
2answers
206 views

JWT based webservice authentication

I'm currently writing a web service that will be consumed by an android app. To access user specific content, one must authenticate against the service. Since I'm not (primarily) using a ...
2
votes
2answers
275 views

Restful User/Password Authentication

I'm currently designing a REST-API with the following properties: Backend for a single page application (Later Apps) Integrated user database for each instance HTTPS/TLS only Authentication with ...
0
votes
0answers
82 views

MVC OAuth with keeping user logged in

I am creating a news site where one can add some news. User will be registering with theirs facebook accounts like on this site. There will not be other type of users, just facebook users. And I wish ...
5
votes
2answers
409 views

Auth options for distributed systems

I am in the process of designing 3 components that will work in symphony with one another: A RESTful web service which requires BasicAuth over HTTPS on all calls, and which is what actually does all ...
2
votes
2answers
113 views

Authenticate in the Services? Or in an Endpoint that exposes the Services?

When I'm in charge, I typically model services separate from endpoints. For example: Company.Project.Domain.dll has all of the logic required to complete the services for that domain. In order to ...
2
votes
0answers
76 views

Global Accounts in Multi-Tenant Authorization System

Our system is fundamentally a multi-tenant setup, where each client maintains a separate database with its own data and users. The authentication system on login issues an authentication token which ...
6
votes
1answer
244 views

Best practice to authenticate third party to a website?

I've a website built with ASP.NET, and uses Cookie based Forms Authentication to protect it self from unauthorized access. It also has a REST based API which uses API key based Authentication. (Key ...
1
vote
3answers
307 views

How to authenticate against an API?

In a enterprise distributed system, a user of a web portal can sign into one site, be redirected to a federation provider. Once they log in with, for example, a facebook account, that user is ...
0
votes
0answers
27 views

Authentication structure for public area within admin dashboard?

I'm looking for input on how to organize the authentication scheme for a SaaS app where the application users offer a questionnaire to their customers. The paying SaaS user needs to login in order ...
0
votes
0answers
400 views

SPA + Web API + Azure active directory: authenticating with graph API

I have an angular client app which talks to an ASP.NET Web API backend. I am using Azure Active Directory to authenticate users, and I have registered my Web API with my Azure AD tenant. I am using ...
0
votes
3answers
539 views

How can I reinforce that security questions answers should not be the same and how to encrypt?

When my users are creating an account they need to fill and set several security questions pertaining to their account. I am wondering, how can I make sure that the answer the user enters for each ...
1
vote
0answers
369 views

Single sign-on flow using ASP.NET MVC + Active Directory

I'm looking into creating a single-sign-on portal built in ASP.NET MVC. This single sign on portal should give users the option to sign in with their individual account (which should be verified ...
-1
votes
2answers
206 views

The best shard key for user authentication

For access to my API user should send login and password and get generated token for access. Account login password Suppose the size of account's table is very large. So large - so needs ...