1
vote
1answer
57 views

Implicit OAuth2 endpoint vs. cookies

I currently have an app which basically runs two halves of an API - a restful API for the web app, and a synchronisation API for the native clients (all over SSL). The web app is completely ...
1
vote
1answer
290 views

Is it an implementation of a stateful mechanism for Rest API authentication?

In many articles about Rest API's best practices, it is recommended to not depend upon sessions on server side since it leads to a stateful mechanism. I currently use Play 2.2 framework, with a ...
0
votes
0answers
47 views

Validating time-limited HMACs

I'm exploring using HMAC style secret-key authentication with timestamp expiry, but am struggling to get my head around how you validate the timestamp portion. On the client side you would do: ...
2
votes
1answer
202 views

Approach to Authenticate Clients to TCP Server

I'm writing a Server/Client application where clients will connect to the server. What I want to do, is make sure that the client connecting to the server is actually using my protocol and I can ...
0
votes
0answers
995 views

How secure is this way of authenticating an ASP .NET Web API - creating your own tokens?

http://www.codeproject.com/Articles/630986/Cross-Platform-Authentication-With-ASP-NET-Web-API#_rating The above link shows exactly how I want to go about authenticating against an ASP .NET Web API. ...
1
vote
1answer
218 views

User Authentication & Session Management

One of the fundamental ways of handling user login authentication & session management is by storing variables in Session space plus setting some data in cookies on client computer while sometimes ...
0
votes
0answers
23 views

Login to a Web App using PKI Certs [duplicate]

I understand PKI reasonably well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of ...
8
votes
2answers
537 views

Is this solution RESTful and secure?

Our product registers new players on our service, and we've chosen to host it on Azure (we're using .NET) and we wanted it to be stateless (for scalability) and relatively secure. Since this is the ...
4
votes
2answers
2k views

Security in Authentication in single page apps

What's the most secure method of performing authentication in a single paged apps? I'm not talking about any specific client-side or server-side frameworks, but just general guidelines or best ...
6
votes
3answers
318 views

What is the best policy for allowing clients to change email?

We are developing a web application with a fairly standard registration process which requires a client/user to verify their email address before they are allowed to use the site. The site also ...
1
vote
1answer
480 views

What is the future for ASP.NET Membership Providers? [closed]

While working on a new project with MVC3, a DI framework (Ninject), and unit tests (NUnit) paired with mocks (Moq), I found setting up the Membership Provider felt a bit "awkward". I've run into tasks ...
2
votes
1answer
478 views

Security in a private web service

I am developing a web site and a web service for a small on-line game. Technically, I'll be using Express (node.js) and MongoDB+Redis for the databases. This the structure I came up with: One ...
2
votes
3answers
105 views

Authentication for 'participants' vs 'users'

I'm building a site that lets users schedule interviews/conferences with third parties and I'm wondering what's the best way to provide security around the participant experience while providing the ...
4
votes
3answers
1k views

Did I understand the website “autologin” feature right?

I'm developing an authentication library (*) for a website and I realized that maybe I'm not completely understanding what an "autologin" feature is, and how to develop it. While gathering infos and ...
10
votes
5answers
6k views

Best practices for web application Authentication/Security (Any Platform)

I got a question today from my manager asking me my thoughts on what is considered an acceptable design for authentication of a web form application, especially in regards to the nature of many ...