Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

learn more… | top users | synonyms

71
votes
8answers
32k views

Is browser fingerprinting a viable technique for identifying anonymous users?

Is browser fingerprinting a sufficient method for uniquely identifying anonymous users? What if you incorporate biometric data like mouse gestures or typing patterns? The other day I ran into the ...
22
votes
4answers
3k views

How should I architect a RESTful webservice to use 3rd party (i.e. Google, Facebook, Twitter) for authentication?

For my job we have a nice RESTful webservice we've built out that we use to drive a couple websites we have. Basically the webservice lets you create and work with support tickets, and the website is ...
14
votes
2answers
9k views

How should an API use http basic authentication

When an API requires that a client authenticates to it, i've seen two different scenarios used and I am wondering which case I should use for my situation. Example 1. An API is offered by a company ...
10
votes
4answers
686 views

Am I Over-Engineering If I Consider User's Intentional Wrongdoing?

Is it over-engineering if I add protection against a user's intentional wrongdoing (to put it mildly), if the harm the user can incur is not related to my code? To clarify, I'm exposing a simple JSON ...
10
votes
5answers
7k views

Best practices for web application Authentication/Security (Any Platform)

I got a question today from my manager asking me my thoughts on what is considered an acceptable design for authentication of a web form application, especially in regards to the nature of many ...
9
votes
7answers
2k views

Will Authentication over HTTPS Slow My Application?

I am building a web application and RESTful web service. I have been reading various articles about the best way to authenticate the requests to the web service. The best option for me seems to be ...
9
votes
3answers
4k views

Web Authentication using PKI Certs

I understand PKI reasonably well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of ...
8
votes
1answer
7k views

Authenticate native mobile app using a REST API

I'm starting a new project soon, which is targeting mobile application for all major mobile platforms (iOS, Android, Windows). It will be a client-server architecture. The app is both informational ...
8
votes
2answers
687 views

Is this solution RESTful and secure?

Our product registers new players on our service, and we've chosen to host it on Azure (we're using .NET) and we wanted it to be stateless (for scalability) and relatively secure. Since this is the ...
8
votes
2answers
3k views

Designing authentication for REST API

I'm working up an API for a REST service that I'm going to both be producing and consuming. I've spent the past few days trying to figure out how to handle authentication nicely, and think I've ...
7
votes
2answers
3k views

Best way to hide API key in source code

I need some ideas on how to protect a private API key in an application, specifically in a c# .NET application. Firstly, I understand that it is theoretically impossible to hide anything in the ...
6
votes
2answers
6k views

Custom use of Authorization header in a REST API

I'm building a REST api where clients are authenticated using client certificates. A client in this case is not an individual user, but some sort of a presentation layer. Users are authenticated using ...
6
votes
3answers
338 views

What is the best policy for allowing clients to change email?

We are developing a web application with a fairly standard registration process which requires a client/user to verify their email address before they are allowed to use the site. The site also ...
6
votes
2answers
3k views

Security in Authentication in single page apps

What's the most secure method of performing authentication in a single paged apps? I'm not talking about any specific client-side or server-side frameworks, but just general guidelines or best ...
6
votes
2answers
4k views

What is the correct way to implement Auth/ACL in MVC?

I am looking into making a correctly laid out MVC Auth/ACL system. I think I want the authentication of a user (and the session handling) to be separate from the ACL system. (I don't know why but this ...
6
votes
1answer
812 views

API Auth vs User Auth

I have read many posts and articles on this topic but still cant connect the dots. I want to make a Rails app that is strictly a JSON API maybe using Sinatra or the rails-api gem. I also want to make ...
5
votes
3answers
187 views

Multi platform password storage with retrieval for applications with authorization?

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use. Are ...
5
votes
2answers
121 views

Auth options for distributed systems

I am in the process of designing 3 components that will work in symphony with one another: A RESTful web service which requires BasicAuth over HTTPS on all calls, and which is what actually does all ...
5
votes
1answer
853 views

Java solution for mutual authentication with smart card

I need to develop a Java solution for mutual authentication between Tomcat 6 (server) and SmartCard "IDGo 300" (client). In order to do this I thought of the following scheme: 1.Tomcat (server) send ...
5
votes
1answer
121 views

Is there a proven concept to website reverse certificate authentication?

We're looking at exposing some of our internal application data externally via a website. The actual details of the website aren't that interesting, it'll be built using ASP.NET/IIS etc, that might be ...
5
votes
1answer
830 views

Authentication for users on a Single Page App?

I have developed a single page app prototype that is using Backbone on the front end and going to consume from a thin RESTful API on the server for it's data. Coming from heavy server side ...
5
votes
1answer
88 views

Best practice to authenticate third party to a website?

I've a website built with ASP.NET, and uses Cookie based Forms Authentication to protect it self from unauthorized access. It also has a REST based API which uses API key based Authentication. (Key ...
4
votes
3answers
2k views

Did I understand the website “autologin” feature right?

I'm developing an authentication library (*) for a website and I realized that maybe I'm not completely understanding what an "autologin" feature is, and how to develop it. While gathering infos and ...
4
votes
4answers
11k views

REST Service Authentication/Authorization

I have a WCF rest service that will be consumed by multiple clients. The information returned by the client requires me to know who they are, so that I can return information specific to them. Is ...
4
votes
2answers
576 views

How to prevent third party misuse of what is intended to be a private api (avoiding what happened to Snapchat)?

I have never used Snapchat and do not intend to but I have been reading up about what happened to them with respect to the recent media coverage about pictures being leaked especially because I am ...
4
votes
2answers
536 views

Standard -server to server- and -browser to server- authentication method

I have server with some resources; until now all these resources were requested through a browser by a human user, and the authentication was made with an username/password method, that generates a ...
4
votes
1answer
167 views

Can someone explain the behind-the-scenes process of connecting an app account to a Facebook account?

I am developing an app that will use the Twitter and Facebook login APIs exclusively. Suppose a new user downloads the apps and is presented with the option to log in through Facebook or Twitter. The ...
4
votes
3answers
900 views

Kerberos web authentication

I'v developed an internal singe-page web-app (unix, apache & postgresql) protected by a simple login page. Currently, the users have their own login role with a password. This is starting to get ...
4
votes
5answers
499 views

How to implement a no-login authentication system

I am looking to build a very loose authentication system that can track a user and link submitted data/comments to a specific user. The submissions are essentially anonymous, but a user may want to ...
4
votes
2answers
707 views

Two factor authentication using time base key generator on smartphones

I recently enabled two factor authentication for my Google account. One of the ways of getting the second factor (the key that I have) is to install an Android app on my phone that displays a key for ...
4
votes
1answer
516 views

How to solve a general authentication problem for multiple applications?

At my current job (we're in a MS environment), we have multiple deployed web applications, both inter/intra net. The internal apps generally use an Active Diretory sign in, the forward facing sites ...
4
votes
1answer
392 views

Multiple SSH keys for different organizations

I can see that GitHub allows you to have multiple mail account and associate every organization you are part of with a different address. Can this be done also for SSH keys? What I would like to do ...
4
votes
2answers
1k views

What .NET objects should I use to create a cookie based session in MVC?

I'm writing a custom password reset application that uses a validation technique that doesn't fit cleanly with ASP.NET Membership Provider's challenge questions. Namely I need to invoke a workflow ...
4
votes
1answer
611 views

How do you get the usernames/passwords onto a STUN or TURN server for long-term credential authentication?

The STUN and TURN specifications allow for client authentication using usernames and passwords, and call this authentication via long-term credentials. In fact, TURN requires that clients authenticate ...
4
votes
5answers
569 views

Is restricting sessions to an absolute IP likely to have a wide impact on mobile networks?

Our website currently restricts a cookie-based session to the IP address that was originally sent the Set-Cookie HTTP header. In the past a user's IP would rarely change, so this didn't present much ...
3
votes
2answers
395 views

What's the benefit of Azure ACS if ASP.NET 4.5 includes OAuth and OpenID providers?

Azure ACS offers OAuth and OpenID providers, and now that ASP.NET 4.5 offers the same thing, without the added cost, is there any reason for a .NET developer to consider ACS? (Disclaimer, I don't ...
3
votes
1answer
347 views

How would one go about creating a “Licence Key” for a distributable source-available Software project?

It has been a while since I have seen anything you can download which has to connect to license server in order to monetize a piece of software (and the last time I saw it, it went very wrong when the ...
3
votes
1answer
99 views

How do you implement an active sessions system like LinkedIn? [closed]

With some platforms, like LinkedIn, you can see a list of all sessions where you are logged in, and you can even log them out on a distance. How would you implement something like that? I'm not ...
3
votes
1answer
169 views

JSON Web Token - why is the payload public?

I can't understand the reasoning for making the claims/payload of a JWT publicly visible after base64 decoding it. Why? It seems like it'd be much more useful to have it encrypted with the secret. ...
3
votes
1answer
94 views

Is “friendly fire” session replay a valid concern?

I've been reading a lot about sessions and security, trying to learn as much as possible before writing too much code. I've read about limiting session replay by including a timestamp within the ...
3
votes
2answers
119 views

Using Facebook to authenticate, how to link to user record in my app? Email?

I'm using Facebook to authenticate users. We also have conventional username/ password login and registration form too. Anyway, when a user chooses to login with Facebook, we use the following ...
3
votes
1answer
563 views

Implementing User Authentication on an N-Tier Web Application

I appreciate all help and feedback. Parts bolded are critical parts if this is too verbose. Perhaps it will help to mention I am a green developer. I have found some useful info from related ...
3
votes
1answer
135 views

How safe is it to cache a user ticket in SESSION

I'm working on a client library to interface with my company's api, and we generate a user ticket when the user logs in using the api. Obviously I don't want to send the user ticket to the client ...
3
votes
2answers
281 views

Using Paypal (or similar) to log into my site?

I have a web site and I want to offer a few levels of service - one free, one for a one-off payment, and one for a subscription. My first inclination is to use Paypal for the payment options. I ...
3
votes
2answers
402 views

Implementing Lazy Registration

I'm interested in setting up Lazy Registration on my website. Ideally, I'd like people to be able to fill out a record that might include their name, email, address, etc. and then record it to a user ...
3
votes
1answer
229 views

Is my websocket session idea practical?

In a situation where all communication (including logging in) between a client (web browser) and server is done over a persistent TLS encrypted websocket, would there be anything inadvisable about ...
3
votes
0answers
76 views

Adding new service to authenticated website

So I've created an API that I want to leverage to add some functionality to an existing web app. My current website authenticates users using SAML. What I'm looking to do is instead of moving the code ...
3
votes
0answers
354 views

Authorization and Authentication using multiple types of authentication in MVC

Currently I am managing a team where we're building a new SaaS application. The way it is currently structured is that we have a solution that has our business logic and data, and a solution that ...
3
votes
0answers
244 views

Facebook authentication with an Authoritative Server for a Flash Game

I'm working on a multiplatform game in Flash. This game utilizes Photon Server for authoritative physics and user statistics tracking. I'm looking to leverage Facebook authentication as an alternative ...
2
votes
2answers
109 views

Restful User/Password Authentication

I'm currently designing a REST-API with the following properties: Backend for a single page application (Later Apps) Integrated user database for each instance HTTPS/TLS only Authentication with ...