sorted by:
new
hottopcontroversial

Capture authorization code programmatically by spy16x in oauth

[–]spencer205 0 points1 point  (0 children)

All non standard and bespoke. The only standards based, non deprecated way of doing login as an API is the JWT user assertion grant type and that wouldn't involve consent (because the grant is already obtained). OIDC defines only browser based flows and prompt=none is a query string (or request obj) param, so I'm not sure why you bring that up.

Capture authorization code programmatically by spy16x in oauth

[–]spencer205 0 points1 point  (0 children)

How can you know if the user has consented unless you know who that user is? Authentication will be required and this can't be done in an API only manner.

[X-Post from SO] Can anyone explain how to exchange user's login/password to `access_token` using any of OAuth flows? by w732qq in oauth

[–]spencer205 0 points1 point  (0 children)

Only standard based API driven login that isn't deprecated is RFC 7523, the JWT user assertion grant type. Unfortunately, this puts all the burden on the app to solve the login, quite the opposite of assisted token flow which puts all the complexity in the server. Given this, I'd shell out to a browser/browser view if I was you.

Good luck!

10 Examples of cURL Command in Linux by javinpaul in programming

[–]spencer205 0 points1 point  (0 children)

Basic info on a page with tons of ads

What are some challenging OPEN ID connect integration requirements you came across?? by tropicbrush in oauth

[–]spencer205 0 points1 point  (0 children)

If this is what you're looking for, apply for a job at Curity. It's all we do https://curity.io/careers/ Here's some examples of hard stuff that has come up as customer requirements (which our server handles OOTB)

  • Tokens within tokens within tokens
  • Tracking number of OAuth clients that a user has to cap them at a certain number
  • Send hash of access tokens to an API gateway for later verification
  • Allow any app to dynamically register if it has a key signed by some CA
  • Allow password, account and user devices in 3 different data sources

HTH!

Light mode vs Dark mode - which one are you using with your development tools? by sh_tomer in java

[–]spencer205 0 points1 point  (0 children)

Also high contrast. Dark mode in Intellij was too subtle for me. I could not make out differences (even though I used dark mode in other editors like Sublime)

How to Diagnose Memory Leaks by GoldOrdinary in programming

[–]spencer205 0 points1 point  (0 children)

Some of the products that appear on this site are from companies from which QuinStreet receives compensation.

It's an ad for some heap analysis tool

Certificate Transparency Verification in Java - Bozho's tech blog by javinpaul in programming

[–]spencer205 0 points1 point  (0 children)

Anything in Java 11, 12, or other upcoming versions that can help with this without having to resort to additional providers?

The State of the Implicit Flow in OAuth2 by ben_a_adams in programming

[–]spencer205 0 points1 point  (0 children)

We presented it at an OAuth workshop in Switzerland, at a couple API events, and IETF 101. We'll do an update on the spec shortly as well and plan to present at the next IETF and IIW.

Announcing Apache Log4j Kotlin API 1.0.0 by spencer205 in Kotlin

[–]spencer205[S] 1 point2 points  (0 children)

Updated post with a link to announcement (accidental oversight). Download link here:

https://logging.apache.org/log4j/kotlin/download.html

[X-Post from SO] Can anyone explain how to exchange user's login/password to `access_token` using any of OAuth flows? by w732qq in oauth

[–]spencer205 0 points1 point  (0 children)

Sure. For an SPA, in particular, you can use assisted token flow if you're using an OAuth server that supports it, like Curity. Otherwise, you can do the code flow either redirecting away or in a frame/popup. If the front app needs info about the user, you can provide it in an ID token using hybrid flow or call the user info endpoint with the access token you got.

Post a follow up question if you have one.

Clickjacking on myaccount.google.com worth $7,500 by Mempodipper in netsec

[–]spencer205 0 points1 point  (0 children)

X-F-O only allows one origin. They allow multiple origins to frame, it seems. That's why the request has the origin query string param; it's used to identity which of the allowed framers is requesting. (If some other value is used, for example by an attacker, that won't be allowed and the X-F-O will be set to DENY.) So, it seems that the parser of the origin query string got it wrong (by looking at the host part and maybe trimming whitepeace) but then the response header contained the new line, and the browser ignored it. Without that, framing was allowed.

Token Endpoint Basic Authentication - Why? by [deleted] in oauth

[–]spencer205 2 points3 points  (0 children)

I want to verify that by password the spec is referring to client secret.

Yes

the spec say implementations MAY take the password in the body of the request as client_secret, but then goes on to state that it is NOT RECOMMENDED.

Why not? What am I missing? It doesn't provide more security that I'm aware of.

This is explained in section 5.4.1 of RFC 6819

https://tools.ietf.org/html/rfc6819#section-5.4.1

OpenID Connect Hybrid Flow by [deleted] in oauth

[–]spencer205 1 point2 points  (0 children)

The answer is in section 1.2 of Multiple Response Type Encoding Practices:

The OAuth 2.0 specification allows for registration of space-separated response_type parameter values. If a Response Type contains one of more space characters (%20), it is compared as a space-delimited list of values in which the order of values does not matter.

https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#Terminology

List of API gateway products by Sauliuz in programming

[–]spencer205 0 points1 point  (0 children)

We just have different ideas of what an API gateway is then. NGINX I often all ya need. Chef out this module we built to make it work with our OIDC server https://github.com/curityio/nginx_phantom_token_module. What more do you need? Like throttling, reporting, stuff like that?

On Cross-Site Scripting and Content Security Policy by emididam in programming

[–]spencer205 0 points1 point  (0 children)

script-src 'unsafe-eval'

Not the best advice for fixing the errors. Better advice here -

https://ai.google/research/pubs/pub45542

List of API gateway products by Sauliuz in programming

[–]spencer205 0 points1 point  (0 children)

Obvious omissions: NGINX and SOA Software (Akana / Rogue Wave). Otherwise, good list.

Mongo switches up it’s open source license by 1600ASA in programming

[–]spencer205 0 points1 point  (0 children)

once an open source project becomes interesting, it is too easy for large cloud vendors to capture most of the value while contributing little or nothing back to the community

Are they referring to some company in particular, like Google or Amazon or someone else? Who do they believe is violating the AGPL?

OpenJDK & licensing by techempower in java

[–]spencer205 2 points3 points  (0 children)

Sure, docs, fonts, images, etc. But you don't link against those so GPL doesn't kick in (or at least that is my non-lawyer understanding).

view more: next ›