Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

learn more… | top users | synonyms

3
votes
0answers
81 views

Adding new service to authenticated website

So I've created an API that I want to leverage to add some functionality to an existing web app. My current website authenticates users using SAML. What I'm looking to do is instead of moving the code ...
4
votes
2answers
851 views

How to prevent third party misuse of what is intended to be a private api (avoiding what happened to Snapchat)?

I have never used Snapchat and do not intend to but I have been reading up about what happened to them with respect to the recent media coverage about pictures being leaked especially because I am ...
1
vote
0answers
171 views

Mutual Authentication in JSON or AJAX only?

AFAIK we must install the client-certificate into the users browser to connect with https-sites using server-certificates to have a mutual authentication. What about AJAX and JSON, can we connect to ...
1
vote
0answers
50 views

Reliable way to generate a token in a SOAP webservice

Legacy SOAP service here at work use a token authentication. The flow is: As first step I call the startSession method passing username (say myUser) and password (say myPWD) as parameter. At this ...
1
vote
2answers
171 views

When should I implement authentication in a database?

I'm currently embarking on a MongoDB project (a simple user login system), and I notice that there is an option for authentication. Here is the server string, with the userinfo shown as optional ...
3
votes
1answer
96 views

Is “friendly fire” session replay a valid concern?

I've been reading a lot about sessions and security, trying to learn as much as possible before writing too much code. I've read about limiting session replay by including a timestamp within the ...
3
votes
1answer
291 views

Is my websocket session idea practical?

In a situation where all communication (including logging in) between a client (web browser) and server is done over a persistent TLS encrypted websocket, would there be anything inadvisable about ...
1
vote
2answers
460 views

Common techniques to integrate social media login to a website that requires account registration

I have developed websites where users would register with a username of their choice and an entry would be created in a database table that holds their username and some sort of salted password. They ...
0
votes
1answer
572 views

Knowing who is the user in every request (every action, every view, every time)

I have many model classes that are mapped from/to tables using EF. Two of them are User and UserCookie, which are stored in tables Users and UserCookies. public class User { public long UserId { ...
0
votes
2answers
638 views

How does Facebook manage to allow a user unlimited sessions?

I could login through the website, android app, iOS app, the browsers on mobile, and when I log out from one, it doesn't log me out of all of them. Traditionally, you would log out of all the services ...
2
votes
1answer
73 views

Security Pattern to store SSH Keys

I am writing a simple flask application to submit scientific tasks to remote HPC resources. My application in background talks to remote machines via SSH (because it is widely available on various HPC ...
0
votes
2answers
289 views

Separating roles authorization and database

Something really bothers me about the way authorization tends to be done with roles in ASP.NET MVC. The way it is normally done is that you have a Users table and a Roles table. A User can have many ...
1
vote
1answer
95 views

Testing for Authentication loop holes / bugs

We've got a web application which is 99% complete prior to public beta, were currenlty securing the site from security perspective, locking down the server, db etc, one thing I'm concerned about but ...
1
vote
2answers
158 views

Should all HTTP requests including credentials be made using a POST even if it is actually just a request for data?

Assume there is a request which is going to look up a list of items from a service which requires authorisation (e.g. it's behind a Basic Authentication domain). If the service didn't require ...
1
vote
1answer
103 views

Is OAuth suitable for this scenario?

I need to create a simple web application for track expenses, with some basic actions (user must be able to create an account and log in, list expenses, edit them, etc) with a REST API for each one, ...
4
votes
1answer
443 views

Authorization and Authentication using multiple types of authentication in MVC

Currently I am managing a team where we're building a new SaaS application. The way it is currently structured is that we have a solution that has our business logic and data, and a solution that ...
0
votes
1answer
457 views

Is it a good practice to decouple the membership system?

Currently I'm developing a project that basically is built with ASP.NET Web API. The membership system I'm using is ASP.NET Identity. The only problem I'm seeing with this is that the membership ...
1
vote
1answer
758 views

Implicit OAuth2 endpoint vs. cookies

I currently have an app which basically runs two halves of an API - a restful API for the web app, and a synchronisation API for the native clients (all over SSL). The web app is completely ...
2
votes
1answer
3k views

Most Appropriate Authentication Type for MVC5 project

I am about to start a new ASP.NET MVC5 project and I am planning the authentication / authorization requirements at present. The client wants Windows authentication, to prevent their users having to ...
0
votes
1answer
144 views

Flexible authorization design in ASP.NET pages?

I'm developing an ASP.NET webforms application with pages which displays information based on the authorization level of the authenticated user (very typical). I will write a simple example of the ...
1
vote
1answer
90 views

How to make sure that reported issues are not caused by wrong credentials or typos of the client? [duplicate]

I have found myself a few times in the situation where a client reports an issue like 'I can no longer login to my account'. Sure enough when trying to login with the client's credentials myself ...
0
votes
2answers
342 views

Authentication with If/Else

For keeping the "Administration Panel" secure to those who are logged in, for my web application, is the best practice to use an If/Else Statement? if($_SESSION['logged_in'] == true) { include ...
1
vote
6answers
457 views

How to distribute, one virtual token to each person in this world, and make sure nobody gets more than one? [closed]

How to distribute, one virtual token to each person in this world, and make sure nobody gets more than one? In other words, how to prevent a user from creating more than one user account in a site? ...
4
votes
1answer
184 views

Can someone explain the behind-the-scenes process of connecting an app account to a Facebook account?

I am developing an app that will use the Twitter and Facebook login APIs exclusively. Suppose a new user downloads the apps and is presented with the option to log in through Facebook or Twitter. The ...
1
vote
3answers
6k views

Can one determine the creation date of an email account?

Is it possible to determine the creation date of the mail account for the address supplied within the authentication process flow; Or at least determine that the mail account was/was not created the ...
2
votes
0answers
66 views

How to handle static-ish content from a CDN with authentication?

I have a website that allows user uploads of content. Part of the design, to date, involves storing the user content on a NAS that has been configured with a separate app pool in IIS that has ...
0
votes
1answer
268 views

How to manage multiple database credentials across multiple projects

We have 10 separate projects that all access the same database. Initially, all 10 projects had database credentials hardcoded into them. I decided to move the credentials into a utility method and ...
1
vote
1answer
160 views

How to have my callbacks authenticated in a REST app?

I'm developing a REST application and I allow my clients to authenticate in several ways (typically using Authorization: Token ... as in OAuth 2.0, but also there's session-based auth option for the ...
2
votes
0answers
77 views

How do I authenticate users from facebook/twitter?

I need to build a site for a mobile app that allows users to sign in with facebook/twitter or sign up as a new user (traditional username/password). No matter which method the user chooses, they ...
7
votes
2answers
4k views

Best way to hide API key in source code

I need some ideas on how to protect a private API key in an application, specifically in a c# .NET application. Firstly, I understand that it is theoretically impossible to hide anything in the ...
-2
votes
3answers
124 views

Why speaks basic http authentication always of a username

In RFC 2617 HTTP Authentication: Basic and Digest Access Authentication they speak always of username and password for the authentication. Why should I choose to take a username as identifier for a ...
0
votes
1answer
295 views

Why can't we use unique identifier as combination of email and password? [closed]

For prevent email conflicts for authentication system we can surely choose email and password combination as unique identifier. What can prevent me to built authentication system by treating unique ...
4
votes
3answers
1k views

Kerberos web authentication

I'v developed an internal singe-page web-app (unix, apache & postgresql) protected by a simple login page. Currently, the users have their own login role with a password. This is starting to get ...
1
vote
1answer
417 views

What kind of user authentication do I need in for a restful web api

I am doing a restful web api with asp.net Web API 2 I do not want to use any form of cookies or basic authentication (send user/pass in cleartext thus SSL needed) I do not use/need claims stuff. I ...
1
vote
2answers
307 views

Is double password protection safe for admin authentication?

I was looking at some of my past codes, and I viewed one of my admin boards I've made. I had it setup so that the admin has to define/enter 2 passwords for his account. Is this really double-safe or ...
4
votes
0answers
284 views

Facebook authentication with an Authoritative Server for a Flash Game

I'm working on a multiplatform game in Flash. This game utilizes Photon Server for authoritative physics and user statistics tracking. I'm looking to leverage Facebook authentication as an alternative ...
1
vote
1answer
774 views

Is it an implementation of a stateful mechanism for Rest API authentication?

In many articles about Rest API's best practices, it is recommended to not depend upon sessions on server side since it leads to a stateful mechanism. I currently use Play 2.2 framework, with a ...
0
votes
1answer
63 views

Identifying how server is authenticating users

I'm trying to build a bot that will parse the list of classes offered by my university and let me know when the one I'm looking for is open. The problem is that in order to get to the ...
0
votes
0answers
59 views

Validating time-limited HMACs

I'm exploring using HMAC style secret-key authentication with timestamp expiry, but am struggling to get my head around how you validate the timestamp portion. On the client side you would do: ...
8
votes
1answer
9k views

Authenticate native mobile app using a REST API

I'm starting a new project soon, which is targeting mobile application for all major mobile platforms (iOS, Android, Windows). It will be a client-server architecture. The app is both informational ...
2
votes
1answer
798 views

Approach to Authenticate Clients to TCP Server

I'm writing a Server/Client application where clients will connect to the server. What I want to do, is make sure that the client connecting to the server is actually using my protocol and I can ...
1
vote
2answers
744 views

Is this a secure solution for RESTful authentication?

I need to quickly implement a RESTful authentication system for my JavaScript application to use. I think I understand how it should work, but I just want to double check. Here's what I'm thinking -- ...
1
vote
2answers
72 views

Authentication at my web site using other credentials

Suppose there are 2 web site: example.com I don't own and example2.com I own. I want to extend the functionality of example.com somehow. example.com doesn't have any API. I want the users of ...
3
votes
1answer
668 views

Implementing User Authentication on an N-Tier Web Application

I appreciate all help and feedback. Parts bolded are critical parts if this is too verbose. Perhaps it will help to mention I am a green developer. I have found some useful info from related ...
2
votes
4answers
811 views

Authenticating users for a website

I'm working on a website and I want to validate that an individual is an employee at one of a large number of companies (probably using their company's email address, which I don't know before hand). ...
1
vote
0answers
132 views

How to evaluate Secure Authorization for server to client

I have a customer that wants me to build a web portal (Asp.net 4.0) that will communicate with a desktop client, tablet and/or smart phone (e.g. iOS and/or Android). I was thinking of using oAuth ...
22
votes
4answers
4k views

How should I architect a RESTful webservice to use 3rd party (i.e. Google, Facebook, Twitter) for authentication?

For my job we have a nice RESTful webservice we've built out that we use to drive a couple websites we have. Basically the webservice lets you create and work with support tickets, and the website is ...
1
vote
1answer
514 views

User Authentication & Session Management

One of the fundamental ways of handling user login authentication & session management is by storing variables in Session space plus setting some data in cookies on client computer while sometimes ...
2
votes
2answers
1k views

Alternatives to Traditional Password Authentication [closed]

The third party login is excellent function that has come in recent years that relieves the load on a programmers mind so that I have to remember less useless passwords. I don't use the same ...
-2
votes
2answers
139 views

APIs that deal with logins

I have been asked to make a mobile app for a friends website. The website is a Multi level marketing site that sells products and franchises. A client logs in in to the website and can view his or her ...