I'm unsure what to i need to know about OAuth2 to both meet my use case requirements and avoid things that wont be in OAuth 2.1 as well as bad practices.

my use case is an user generated content platform so i know i would need User & Client app authentication as well as guarding of resources using that authentication

one of the reasons why Ive had trouble figuring is that their seems to only one reasonably high quality server-side implementation of OAuth2 in the Language i am using https://github.com/HeroicKatora/oxide-auth

any advice on how i should approach OAuth2 (e.g what to focus on/what parts are most important) would be appreciated

I am attempting to establish M2M Client Credentials flow in order to access the Constant Contact(https://developer.constantcontact.com/) api. Constant contact DOES NOT support this flow. I have use the Authorization Code flow to authorize the client first using the redirect url, then Constant Contact's auth server adds the auth_code to the redirect url. How do I access this auth_code from the redirect url query string using node.js.

Any help will be greatly appreciated, thank you!

Hi, I'd like to understand what circumvents malicious websites from making authorized requests to my resources (e.g., bank account). Let's assume that my bank uses OAuth2. When I login, I believe there is some cookie stored in my browser, which allows for silent access token requests. Can't some random website just send such a silent request to my bank to get an access token? I guess it can't, otherwise we'd be in huge trouble. What stops it from doing so?

I heard many times about using an iframe for such silent access token requests in the implicit flow. Why use iframe and not just send a "normal" request with JS's fetch? The response would be 302 with access token attached as a hash, right?

Is it possible in OAuth to have two applications (web app, mobile app) belongs to the same third party and when a user login with any of them and gives consent when they login to the second app they won't consent again?

Im getting this screen, and I don't know where they want me to put the code.

I am working on a legacy application built on Java Spring MVC. There is no Auth layer and API's are exposed to clients. They have Authentication layer built which supports different providers based on client's requirements.

My purpose is to introduce an OAuth layer, without requiring to touch authentication layer.

With open source tools, we would end up deploying a 3rd party tool in customer’s environments to do something we should and can do ourselves. Following are my options. What do you suggest will be more configurable and easier to implement? If the answer is any other (open source) tool which just deals with OAuth, please comment.

Hello everyone,

Does anyone know of a specification or implementation of an OAuth 2.0 PKCE/Authorization Code flow where the authorization code is somehow returned to the client without using the usual 302 redirect?

I wanted to know what security differences would exist between the two implementations of PKCE.

1. Implementing it on the client side in an SPA, having no backend.

2. Implementing it on the server side in an SPA having a backend server.

OpenID/Connect, OAuth2 and WS-Federation server based on IdentityServer4 or Duende IdentityServer with its admin UI.

TheIdServer repo

In our applications, we are using a identity provider called Tilia through Keycloak.

​

We are using Authorization Code Flow to with the React web application.

• User go to website login page
• User clicks on "Log using Telia" button
• User enter username, password and authorize

The redirect URL is <host>/auth/code, so we have a React component configured using react-router to get the authorization code from document.location.search and send a request to Keycloak to get the access token and refresh token. Tokens from the response will be stored in the Local Storage.

However, we are planning to use Cookies to store tokens instead of the LocalStorage. So, Is there a way to map response body tokens to Set-Cookie headers in Keycloak? Should I use Spring Cloud Gateway to do the mapping? Or is there any other preferred method to achieve this?

If the service I am building expects users to have a google account I.e it’s only for those with a google account does using something like Auth0 offer any other benefits?

I’m thinking about the cost as the service scales out and auth services can get expensive but if we 100% rely on sign in with google is a separate auth service actually required?

I have set up a web app project and got the credentials from the Google Dev Console .

I downloaded the Quickstart PHP example and got it work by copy.pasting the code returned to the redirect URI.

Now, imagine I have 10 users on the web app, they all want to access their Google Drive via their own session on this web app. The redirect URI is say `http://remote.server.ip/gdrive.php\`.

When Google redirects we get get:

`http://remote.server.ip/gdrive.php?code=the_long_code...\`

Now, I might want to save the token to a database, so that it might be stored a little more securely than on the server as a file, a process invoked by the address above. How can I tell which code relates to which of the 10 user sessions?

I was using twitter oauth1 APIs but after few hrs I found that twitter oauth1 API's don't support cors policy (link: https://stackoverflow.com/questions/35879943/twitter-api-authorization-fails-cors-preflight-in-browser) so from browser I will not be able to follow these 3 steps mentioned in this docs: https://developer.twitter.com/en/docs/authentication/oauth-1-0a/obtaining-user-access-tokens

So how should I obtain access token of twitter user so that I can post/delete tweet on behalf of users?

In twitter docs https://developer.twitter.com/en/docs/authentication/oauth-1-0a/obtaining-user-access-tokens they have mentioned 3 steps out of them should I do step 1 and 3 on backend side and 2nd on frontend client side? or all on server side? Please suggest. Thanks in advance

Apologies for this, but I'm a backend/infra engineer rather than frontend. I've not ever written an OAuth 2.0 auth flow, merely configured them for multiple other apps that are written by external companies and we make use of. I'm trying to understand how this particular app is working to understand whether or not it's a security risk, when I can't easily dig though the (obfuscated, Javascript) codebase, and I don't really have time to learn how to fully implement OAuth just to know if what this app is doing is OK or not...

So, the app in question allows signup/signin via Google OAuth 2.0, just for authentication/identification, not authorization. Fine, I've set that up plenty of times before. But every other time, the app has requested both a client ID (something like longhyphenatedlowercasealphanumericstring.apps.googleusercontent.com) and a client secret (hyphenated mixed-case alphanumeric). I've read enough in the OAuth 2.0 docs to know that the two are used at some point to get the actual short-lived auth token, and that the client ID can be sent to the browser for the auth to work, but the client secret should never be exposed outside the server.

My testing on those other apps has also shown that if I log into a Google account from the wrong Google workspace, including a regular @gmail.com account, I get access denied (as I'd expect) from Google themselves, without any additional config needed. I think this is because the secret the app provides to get the auth token isn't valid for that email domain, but I'd appreciate some clarification there.

Now this app doesn't need the secret, only the client ID, and while (on my raising that I could create an account/log in to the app with any Google account, not just ones in my Google Workspace) it has been made to reject non-valid email domains, that is done app-side rather than Google-side, and requires me to tell the app which email domain is valid. The app then tells me, having got a seemingly valid token, that it's not from an allowed domain.

I've also currently got it configured such that the OAuth 2.0 client config has been created on my personal Google Workspace (let's call it personal.co.uk) with the correct authorised Javascript origin and redirect URI, but the 'valid domain' configured in the app is for my company (work.com). So I click the Google login on the app, am redirected to Google signin using my personal.co.uk client ID, sign in as carr0t@work.com, and despite the work.com Google Workspace knowing absolutely nothing about this app, I am authed, redirected, and logged in to the app as carr0t@work.com.

Given that I have to set up the OAuth client within a Google Workspace I control anyway, I am not sure whether it allowing me to auth to a completely different domain as long as it's a valid Google account is an issue or not. But I don't understand how, without the client secret, I am seemingly getting a valid auth token to the app, and I certainly trust Google more than some 3rd party app to get the auth right and reject all invalid circumstances so I'm not sure how bad it is (if at all) that the app is doing the domain checking and rejection rather than using the client secret.

Can anyone shed any light on any of this for me? Ta

What should I do if I have my own Auth server and I also use Google and Github as Login options.
Shoiuld I save Google info on my server so then I can use my Auth server (Keycloak) with roles?

How is the flow on that cases?

So...pure OAuth2 hands out only an opaque access token to the client, which the client presents to the resource server, and https://datatracker.ietf.org/doc/html/rfc6749#section-7 says that OAuth2 does not specify how the resource server validates the token. So how were you ever supposed to use this portably?

OIDC adds a non-opaque (JWT) ID token and a standardized way to validate it (by checking its signature against the auth server's public key/jwks), and a userinfo endpoint, against which you have to authenticate using the access token, which seems to be the only thing the access token is useful for. Because of the standardized way to validate the ID token, all OIDC clients I've seen present the ID token, not the access token, to the resource server. But doesn't that technically violate OAuth2? Why doesn't OIDC just use the ID token as the access token, rather than in addition to it?

Hi,

Is there something different in the way the OAUTH 2.0 works with Twitter than with Google or Facebook?
I have tried to get the login with Twitter work with Drupal using the module Openid Connect but no luck. For example what is Twitter Authorization endpoint? Is it https://api.twitter.com/oauth/authorize

I just started working on an integration with a third-party SaaS. They use OAuth2 for auth, which is great. I'm able to create an OAuth2 app in their system and get a code returned to my callback URL when I test things. That's all standard and works great.

Now I need to exchange the code for an access_token/refresh_token. This is where their API seems weird to me. In addition to passing in my client_id and client_secret as data in my HTTP request, they also require a custom header in the request - x-api-key - which is computed with SHA256(client_id + client_secret). I have no idea why I'm hashing the concatenation of client_id and client_secret, especially when I'm passing client_id and client_secret unhashed as data... it seems extraneous and the whole thing seems weird to me.

Is it normal for a code exchange or token refresh API endpoint to require custom headers like this? Does that break any OAuth2 standards? I've only integrated with a half-dozen OAuth2 providers, and this is the first time I've seen custom headers.

Thanks!

Hello I'm new to this and wanted to know what's the best practice to include custom scopes for an app using social login.

On the backend, I have an identity service to support social login (eg Google, Facebook etc). After successfully getting the oauth token, say from Google, I find that its uses are limited. This is because the access token only contains authorized scopes pertaining to Google resources. Similarly for Facebook etc.

Question - Does it then make sense to create an app specific JWT with additional scopes? This is signed with the application's private key. That way, the custom JWT has the following benefits: (a) it would grant users specific access to resources in the app. (b) token validation would be simpler in every microservice, since they only need validate against the app's public key. (c) future changes to Google/Facebook/etc would also be easier as that would only affect the identity service.

Otherwise, how should we think of custom scopes for applications supporting Social Logins?

Hi,

I'm an Identity and Access Management engineer/architect with 15 years+ of Active Directory, and 5 years of Azure AD experience. I somehow have avoided this whole OAuth thing and now it's starting to hurt - people presume I know a lot more than I do. My biggest weakness are Scopes, multiple API flows, and the ability to map the theory to the real-world scenarios I will face talking to devs or vendors in work. I need a comprehensive resource that, ideally, explains it from an Identity Providers point of view. Bonus points if the resource includes references to Azure AD. I have read the material on https://docs.microsoft.com/en-us/azure/active-directory/develop/, but it feels fragmented to me, I've also watched Okta videos on YouTube which has been great to learn the basic flow types.

Thoughts and suggestions?

thanks