JWT (RFC7519) is just a compact way to safely transmit claims from an issuer to the audience over HTTP. JWT can be: signed (JWS – RFC7515) encrypted (JWE – RFC7516) signed then encrypted (this order is highly recommended). The whole JWS is the payload of the JWE encrypted then signed. It makes sense to encrypt … Read more
You should have some Redirect URL defined for Google to redirect to after the authentication is done. If you cant host your pages on any web site, you can very well host it in local host. Regarding getting the access token from the popup to the main parent window, you can setup a timer in … Read more
I was getting the redirect error for my python / tornado app running on ubuntu. Using localhost didn’t work as the accepted answer highlighted. Google wants a public domain. My solution was to piggyback “example.com” which is public and create a sub domain in my /etc/hosts file. The sub domain would work on my local … Read more
Here is a simple example using just redirects with angular js Here is how to redirect to authentication angular.module(‘angularoauthexampleApp’) .controller(‘MainCtrl’, function ($scope) { $scope.login=function() { var client_id=”your client id”; var scope=”email”; var redirect_uri=”http://localhost:9000″; var response_type=”token”; var url=”https://accounts.google.com/o/oauth2/auth?scope=”+scope+”&client_id=”+client_id+”&redirect_uri=”+redirect_uri+ “&response_type=”+response_type; window.location.replace(url); }; }); Here is how to handle the redirect after authentication angular .module(‘angularoauthexampleApp’, [ ]) .config(function … Read more
OAauth2 framework docs : https://www.rfc-editor.org/rfc/rfc6749 (A) The client requests an access token by authenticating with the authorization server and presenting an authorization grant. (B) The authorization server authenticates the client and validates the authorization grant, and if valid, issues an access token and a refresh token. (C) The client makes a protected resource request to … Read more
I’ve successfully done this very task within my own ASP.NET MVC application using ASP.NET Identity, but then hit the issue you mention: I need this to work using Web API as well so that my mobile app can interact natively. I was unfamiliar with the article you linked, but after reading through it, I noticed … Read more
OpenID Connect is built on top of OAuth2. An access_token is useful to call certain APIs in Auth0 (e.g. /userinfo) or an API you define in Auth0. An id_token is a JWT and represents the logged in user. It is often used by your app. A refresh_token (only to be used by a mobile/desktop app) … Read more
We have 3 main security concerns when creating an API. Authentication: An identify provider like Google is only a partial solution. Because you don’t want to prompt the user to login / confirm their identity for each API request, you must implement authentication for subsequent requests yourself. You must store, accessible to backend: A user’s … Read more
I finally found a solution that works well and seems to be “the Keycloak way” to issue credentials to external applications. To create a new set of credentials, add a new Keycloak client and change the following settings: Standard Flow Enabled: OFF Direct Access Grants Enabled: OFF Access Type: Confidential Service Accounts Enabled: ON The … Read more
A JWT has readable content, as you can see for example on https://jwt.io/. Everyone can decode the token and read the information in it. The format is documented in RFC 7519. An opaque token on the other hand has a format that is not intended to be read by you. Only the issuer knows the … Read more