Skip to main content
Software Engineering

Questions tagged [authentication]

Ask Question

Authentication is the act of one entity proving its identity to another entity. Common examples involve public key cryptography. For example, proving that a banking web site actually belongs to the bank you think it does.

438 questions
Newest Active Bountied Unanswered
Filter by
Sorted by
Tagged with
1 vote
1 answer
212 views

I am working on an identity and users service in a microservices system for which a passwordless, SMS-based authentication is a hard requirement, i.e. User enters their phone number System sends the ...
dzenesiz's user avatar
  • 227
6 votes
2 answers
1k views

Since I started studying security in web applications, it seems that everyone always says to never store sensitive information (e.g., refresh tokens, access tokens, and so on) due to the risk of ...
ikiwq's user avatar
  • 165
3 votes
4 answers
417 views

I am tasked with implementing authentication and authorization in a distributed environment, so I plan to use JWT. I get how authorization works with JWT - if the token is not expired, and the ...
dzenesiz's user avatar
  • 227
4 votes
3 answers
227 views

We are designing a backend system for a large platform where users can interact with multiple products on behalf of different companies. We plan to use Keycloak as an external identity provider. The ...
ikiwq's user avatar
  • 165
2 votes
3 answers
421 views

Recently, I’ve found myself designing a microservices system, and I’m currently facing some challenges with authentication and authorization. Context All my microservices will be placed behind an API ...
ikiwq's user avatar
  • 165
2 votes
0 answers
161 views

when user login in my web application (Article Website) I'm using Redis to cache the refresh token. So when user login I will generate refresh token and send it to him. While caching in my Redis the ...
Osama Assi's user avatar
  • 21
1 vote
1 answer
102 views

The specs: Mobile apps LLM wrapper (of e.g. OpenAI API) The chat history will be stored on the client Backend is needed to manage the api key and to track token consumption / payment (how many tokens ...
ixx's user avatar
  • 391
0 votes
2 answers
108 views

Suppose a user can have multiple emails. A given email may be held by at most one user. Is email a good pick for login purposes (so that it's used instead of the username)? Should an authentication ...
Sergey Zolotarev's user avatar
  • 2,030
1 vote
2 answers
267 views

I am currently looking at building an API server that will support multiple authentication providers (Google, GitHub, Keycloak, etc) and I am trying to work out what’s a good way to go about it. Two ...
Andre M's user avatar
  • 119
3 votes
1 answer
116 views

I am developing a home-grade web application (server-client, based on Nuxt and nuxt-auth-utils). I am using the opportunity to learn something about oAuth (and OpenID). One of the issues I face is ...
WoJ's user avatar
  • 1,661
3 votes
2 answers
510 views

I'm working on a Spring-based micro service project and considering different approaches for handling authentication and authorization. Instead of setting up a dedicated authorization server, I'm ...
GeekChap's user avatar
  • 59
-1 votes
1 answer
189 views

I have a REST API with protected endpoints, which require an AccessToken for access. For the user to receive the AccessToken, they need to access the login endpoint and with the correct credentials (...
Joao's user avatar
  • 11
4 votes
1 answer
179 views

I plan to have a frontend web app written with Next.js using the AuthJS library to provide user authentication using Oauth. This frontend application depends on a backend API. I want to make sure my ...
Romuloux's user avatar
  • 149
0 votes
1 answer
120 views

I'm trying to design a database for supporting a multi-step registration flow. The registration flow goes like this: the user logs in via OAuth (which creates a session and user), then they're asked ...
Kyle Richards's user avatar
  • 123
0 votes
0 answers
103 views

I have a React frontend and a Nodejs backend that uses authentication via an OIDC service provider. After a user goes through the SSO authentication flow I store the token (containing a refresh token ...
John's user avatar
  • 9
2 votes
3 answers
1k views

I'm quite new to the world of access and refresh tokens, so bear with me. Client uses its refresh token to get a new access token. The server invalidates the just used refresh token and contextually ...
Fabio A.'s user avatar
  • 125
0 votes
1 answer
68 views

I have a web game design question. I am trying to build a multiplayer web game with non-intensive graphics (ex tic-tac-toe, chess). I am trying to figure out how to take already authenticated users in ...
Mr. Octodood's user avatar
  • 3
1 vote
1 answer
218 views

Why is it that some services, when they conduct 2FA ask you to rewrite a code from an app, even if that app is part of that service's infrastructure? For example, when I log in via the web to ...
Karaal's user avatar
  • 21
3 votes
2 answers
881 views

Website multifactor authentication prompts will often include a "remember this computer" checkbox. How does this work? In order to be secure, it needs to be more than just a cookie, as a ...
Mud's user avatar
  • 476
0 votes
1 answer
141 views

Just for some context, I am a CS student in my second-year who is working on a C++ desktop application (using the Qt framework) made by an engineering professor. The application is an educational tool ...
Johnny's user avatar
  • 1
0 votes
1 answer
170 views

Context: I have an API (using DDD) with an entity lets call it "Content" that only can be update by certain users. For example Content with Id = 1, can only be modified by User Id = 1, ...
Danielbahe's user avatar
  • 9
0 votes
1 answer
59 views

I have an Azure App Service running a .NET (Core) API for an inhouse application, which I'm integrating with Twilio to handle Whatsapp communication. To handle the web hook responsible for receiving a ...
jarodsmk's user avatar
  • 141
2 votes
1 answer
91 views

Azure Managed Identity provides a mean to only allow explicitly defined users/apps to access a given resource. For instance I can setup that no-one can access my database except the Managed Identities ...
Jakob Busk Sørensen's user avatar
  • 766
1 vote
2 answers
419 views

We're building an application that needs to log into a website using built-in credentials. It's not optimal to say the least, but we're stuck with "knowing" the username and password ...
glades's user avatar
  • 493
0 votes
0 answers
141 views

I'm working on an Excel tool that needs to synchronize with a CRM via its API. The CRM's API authentication process involves logging in with a username and password, after which a session key is ...
Alon Cohen's user avatar
  • 1
1 vote
0 answers
74 views

I have Firebase connected to my web app and users can authenticate using the 'microsoft' provider. The provider only allows authenticating with the active directory tenant that I specified in my ...
Clay Casper's user avatar
  • 19
1 vote
1 answer
87 views

I have a question about what's the best approach to handle persistent data for web apps. I have a web app that is authenticating through an auth service. once authenticated it makes requests to the ...
BigL's user avatar
  • 13
2 votes
1 answer
224 views

I've created a small prototype browser plugin and am now thinking about making it accessible to the public. This brings up an important question about gatekeeping API access and the right way to ...
lhk's user avatar
  • 446
0 votes
0 answers
223 views

Background I have an authentication microservice that handles the user authentication and returns 2 JWT cookies (access_token and refresh_token). I want to incorporate an API gateway that does the JWS ...
Neil's user avatar
  • 9
-1 votes
1 answer
115 views

I have a web service. When a user makes a request, traefik first redirects it to my users micro service, to pass through an authentication function. The token (or username+password, on first request) ...
Juan Perez's user avatar
  • 143
1 vote
0 answers
212 views

Currently my company has 2 applications that use Identity Server for SSO. Not every client we have uses both applications but some do. The part I'm uneasy about is that both apps have a user ...
Brad Firesheets's user avatar
  • 146
18 votes
9 answers
5k views

Currently, I'm involved in a research project in which we are evaluating an existing web environment providing a safe online playground for children/adolescents with intellectual disabilities. Certain ...
KDW's user avatar
  • 349
5 votes
3 answers
1k views

We're designing the architecture of an embedded device (esp32). One of the tasks is that the device should connect to the internet and use a preprovisioned redeem code to register itself with our web ...
glades's user avatar
  • 493
2 votes
1 answer
132 views

We are trying to implement an authorization and authentication service for our product. Now, we would have to cater to different kinds of IAM systems like SSO, LDAP and Basic Username+Password in ...
Anirban Das's user avatar
  • 29
-1 votes
1 answer
148 views

I am trying to build an IVR system that requires some form of username & password/pin entry to access sensitive data. My naïve solution seemed obvious enough, until I realized that username/pass ...
Noob Saibot's user avatar
  • 579
0 votes
1 answer
382 views

I'm currently using Azure AD as my identity provider and Keycloak as my intermediary/broker for my client applications. However, I need some user attributes (such as phone, email, picture, and ...
linus's user avatar
  • 121
0 votes
1 answer
75 views

I am building a .Net Core Blazor Server application. The application creates records of a Project class which move through a workflow with various phases of review and acceptance/rejection before ...
aterbo's user avatar
  • 111
0 votes
1 answer
187 views

For compliance reasons, we want admins of a web app to work on it from devices (phones or computers) approved by IT. Or rather, they can work from other devices, but should get logged out quickly, so ...
Alexey Romanov's user avatar
  • 1,477
0 votes
0 answers
283 views

I'm thinking about a rewrite of a existing application. This legacy application does not separate frontend and backend. It's a single application with server side rendering. I want to rewrite it to a ...
samjaf's user avatar
  • 121
0 votes
0 answers
68 views

I am currently working on my own iOS application and am going to be using a locally developed API for fetching data. I wanted to outline my current account sign-in architecture and verify this is ...
Trenton's user avatar
  • 17
0 votes
1 answer
2k views

I want to build a web application with a Single Page Application as the front end and an API as the back end. The front-end SPA will read and write data to the API. The SPA and the API will be hosted ...
Damien Monni's user avatar
  • 101
0 votes
0 answers
184 views

SituationI have a Single page web app with REST API. When the user logs in, they receive an authorization token. The token which will expire after some time. When the user tries to make a server ...
DarkTrick's user avatar
  • 286
0 votes
2 answers
174 views

I have a scenario I am considering, and I don't quite find out what's the best solution with OAuth. Hopefully I can learn good things here. We are company A and we specialize in managing secure text ...
diegosasw's user avatar
  • 407
1 vote
0 answers
1k views

TLDR: I am trying to validate a Azure AD B2C access token in my Flask web API use scopes from that access token to authorize calling protected resources use timely and secure solutions such as PKCE ...
linus's user avatar
  • 121
0 votes
5 answers
912 views

I'm going to write a blog app for myself, and though I've written authentication for multiple users. It seems heavy handed to use the same kind of architecture for one user. The only alternatives to ...
bonum_cete's user avatar
  • 111
1 vote
1 answer
763 views

Description This is a long shot, but I'm in dire need of advice. If you know of a more appropriate forum for this type of question please share! I'm working with a legacy OAuth system using email + ...
cjhines's user avatar
  • 11
3 votes
2 answers
3k views

We are looking at implementing Multi-factor authentication for our application, using Time-based one-time password (TOTP) algorithm. What we want to achieve: Users should have the option to enable ...
user1583803's user avatar
  • 133
-1 votes
1 answer
283 views

I am looking into building an iOS application and using an internally built API to access data. My API has some authentication endpoints that takes in a username and password and, if the login is ...
Trenton's user avatar
  • 17
0 votes
0 answers
221 views

I have a multitenant application where a user can belong to multiple tenants. I'm using Identity-Server 4 for the authentication. I have two applications Angular and API. When a user is not ...
Replay's user avatar
  • 109
0 votes
1 answer
229 views

In a web app I'm writing, a singed-in user is recognized by their cookie containing a session identifier. That session id has sixty-four bits of entropy, so I believe brute-force attacks are ...
Schmo's user avatar
  • 113

1
2 3 4 5
…
9