Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Network > OAuth 2.0 > Flashcards

OAuth 2.0 Flashcards

1
Q

What are the problems of credentials sharing?

A

The user is impersonated (app acts just like the user and has too much access.
The creds can’t be revoked (needs to change the password)
The credentials are exposed all the time.
SPA’s will never be able to store it securely.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Why cookies isn’t a solution as well?

A

Because of Cross-site request forgery (CSRF, aka XSRF). Meaning that any tab of the browser will be able to acess that api.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Is API key a better solution for credentials sharing? What are the remaining issues?

A

Yes, API keys are still acceptable because you are no longer sharing creds and you can now define scopes for the key… however api keys has no standards, has to have long expirations (e.g 90 days, when the ideal would be 1 hour).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Why is oauth the solution to all problems?

A

Auth is a protocol, built for http apis, scoped access… can be called delegation protocol.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the oauth2 players?

A

The protected resource (http api), the client (the app that wants to access the api, the resource owner (the user) and the authorization server which is responsible for handling the authorization requests (all parties needs to trust it).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Is Oauth for authentication? What to do then?

A

No, meant for authorization only. Access tokens do not represent the user. Also, client cannot reliably verify the token… Use OpenId + OAuth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What OAuth got very right?

A

Delegated access, api access control, separation of user and client creds, user consent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the OAuth big picture?

A

https://pasteboard.co/JDz1kM8.png

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a scope?

A

Defines how much data the client application can access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the minimum query string parameters used an authorization request?

A

?response_type=code&
client_id=example123&
redirect_uri=https://my.client/callback

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the recommended parameter for an authorization request? Is it often used?

A

state=xyz

very often.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the optional parameter of an authorization request? What happens when not defined?

A

scope=ap1 api2.read

the auth server will define a default set of scopes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is included in an authorization response? Where is it sent to? What happens when the state does not match?

A

sent to https://my.client/callback?code=kAsdg412bAdfA&
state=xyz

the client ideally should reject the whole response.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What needs to be done after I get the authorization code?

A

Do a token request, passing the authorization code, defining the grant type as authorization_code and also defining another redirect_uri… needs to define the client id secret.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How many times I can use an authorization code?

A

Once.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does it mean using basic authentication in oauth2? What it actually is asked in the docs?

A

we can use basic auth style:
Base64(client_id + “:” + client_secret)

use urlformencode for client id and secret, then base64 the whole thing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

If the token request works ok, what will I receive?

A

a token response json with the access token, the type and the expiration (in seconds). Optionally the scopes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the Implicit Grant Type?

A

Is the workflow that SPA needs to follow (since they do not have a backend to relly on). Considered less secure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What differs from implicit grant type and the authorization workflow?

A

The token is directly asked (we need to pass most of the data in the request, such as client Id and redirect_uri

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Why redirect URI is important to be as less dynamic as possible (meaning to avoid wildcards)?

A

because this is the main defense (the redirect_uri needs to match in the server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the URL fragment (#)?

A

Is a protected place where the access_token is placed… seems to be a protected type of query string.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Cite 2 concerns of using the implicit grant workflow

A

access token is exposed to resource owner, js libs that the site is using can access this token too (not other websites), no validation of the token (someone might inject a diff one).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is a better option for the implicit flow?

A

CORS + PKCE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the client credentials flow? How many times the credentials are sent?

A

there’s no user involved.. only machines. sent once…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is Resource Owner Password Credentials(ROPC)?

A

A flow targeted for legacy application, should no longer be used (used on 2012).

26
Q

What is a refresh token? What does it enable? Should we treat them the same as other tokens?

A

Swap for new tokens, allow for long-lived access but are highly confidential… the user should give consent about it.

27
Q

How refresh tokens are also called, where are they requested?

A

aka offline_access, requested in the scope of the auth request.

28
Q

When should I swap the token for a new one (make use of the refresh token)?

A

When we get a 401 or based in the time defined in the expiration field.

29
Q

Can the refresh token ask for different scope than originally granted?

A

no… a new workflow is required.

30
Q

How many types of authorization workflows have we seen until now?

A 
4: 
Authorization Code,
Implicit,
Client Credentials,
ROPC
31
Q

What kind of workflows can make use the refresh tokens?

A

Authorization code and ROPC.

32
Q

Can I store the refresh token in the browser? Where to store then?

A

NO - NEVER.

Store in the backend.

33
Q

What is the problem of passing sensitive data in the query string? What is becoming a new standard?

A

The query string will be sent from server to server which increaes the attack surface. New standard is the form post.

34
Q

What is the form post technique similar to?

A

to SAML

35
Q

Why the new Oauth 2.1 is considered a simplification over the 2.0 one?

A 
No more ROPC;
No more implicit flow;
Single-use refresh tokes;
PKCE across all app types;
No more bearer tokens in the query string/hash fragment.
36
Q

Where can I find more information about Oauth 2?

A 
RFC 6749 (Oauth 2.0);
RFC 6819 (threat model & security considerations)
37
Q

How to spell PKCE?

A

PIXIE

38
Q

Are native apps (windows/android) considered public clients?

A

yes

39
Q

Should we use implicit flow for mobile applications? Why?

A

NO. even though there are vendors out there suggesting it. tokens are accessible.

40
Q

What PKCE stands for? What does it do pratically speaking?

A

Proof Key for Code Exchange. Links the authorization request to the token request.

41
Q

How does PKCE looks like in action?

A

1 - native client generate a random code called code_verifier;
2- hash (sha256) this random code and sent it to the auth server as code_challenge and the server stores this value.
3 - Server send back the authorization code and the client will request the token but this time including the code_verifier (unhashed).
4 - The server hashes the code_verifier and compares to the code_challenge.
5 - if both matches, the access token is sent.

42
Q

So it means the PKCE flow is used to guarantee the initial authorization code requester is the same as the token requester?

A

YES

43
Q

Where to learn more about PKCE?

A

RFC 7636

44
Q

How to deal with callback urls in native code?

A

Via the use of private-use URI Scheme;

45
Q

How to make URI Scheme unique?

A

By bounding to the reverted-DNS com.pluralsight.ios:/cb.

46
Q

What happens when someone put in the browser (or the redirection puts it) the private URI Scheme?

A

the app will be launched! (very similar to spotify and stuff).

47
Q

Why are embedded user-agent (browsers) insecure? What to use then?

A

Keystrokes, cookies are exposed and url not shown (encourages phishing). The native browser.

48
Q

What google IDP does when it seens that and embedded browser calls it?

A

blocks.

49
Q

Where to learn more about native app implementation?

A

RFC 8252/8525

50
Q

What is token theft?

A

Code injected by infected CDNs or browser plugins.

51
Q

What is the SameSite cookie? When this might become an issue?

A

new feature of browsers that only the site that stored the cookie is allowed to access it (Same=Strict). When using 3rd party APIs(different domains).

52
Q

What is a “Backend for Frontend”?

A

An own dedicated server that wil act as a single point communication for the frontend, this backend then will talk to oauth servers and third party APIs.

53
Q

What is usually used when “Backend for Frontend” is adopted?

A

SameSite cookie… so that you always communicate to your own sites/domains.

54
Q

What is OpenId, what does it do? Does it change the Oauth framework?

A

OpenId is an Oauth extension. It adds an identity layer on top of oauth 2.0 and formalizes some Oauth ambiguities. Does not change oauth, only extends.

55
Q

So an Oauth server with open ID makes an authorization server to become an identity provider?

A

YES.

56
Q

What are the main features of openid?

A
  • Identity access via UserInfo endpoint (to fetch user name and etc).
  • Identity token (always JWT).
57
Q

What are the three parts of a JWT?

A

Header.Payload.Signature

separated by .

58
Q

What is epoch time?

A

Date in seconds since january 1st 1970.

59
Q

what is nonce?

A

no more than once.

60
Q

How to discover what the oauth server can do (aka metadata document)?

A

/.well-known/oauth-authorization-server

similar to swagger.

61
Q

how to auth IOT device since they do not run browser?

A

via use of secundary device (similar to TV authentication), which is a browser on a smartphone… the iot device will be polling until the auth is complete.

62
Q

how to do an api-to-api delegation?

A

via token-exchange… the api1 which has the access granted will exchange the existing token for a new token for api2

Network (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions