single-sign-on

Integrate Spring Security OAuth2 and Spring Social

by

I had a similar problem on a JHipster-generated web application. Finally I decided to go with the SocialAuthenticationFilter option from Spring Social (via the SpringSocialConfigurer). After a successful social login, the server automatically generates and returns the “own” access token via redirection to the client app. Here’s my try: @Configuration @EnableResourceServer protected static class ResourceServerConfiguration … Read more

Pass cookies from HttpURLConnection (java.net.CookieManager) to WebView (android.webkit.CookieManager)

by

I would like to suggest a completely different approach to your problem. Instead of copying cookies from one place to another (manual sync), let’s make HttpURLConnection and WebViews use the same cookie storage. This completely eliminates the need for sync. Any cookie updated in any one of them, will be immediately and automatically reflected in … Read more

Stackoverflow’s use of localstorage for Authorization seems unsafe. Is this correct else how do we strengthen it?

by

Well, rather than looking at the vulnerability, let’s look at the possible attack vectors. I’ll add a table here as a TL/DR Attacker | Vulnerable? Eavesdropper | Yes MITM | Yes Local Attack | Yes Server Attack | Yes So yes, it is an issue. Remote Attacker, can observe traffic, but cannot modify traffic Consider … Read more

Automatic cookie single sign on on multiple domains – like google

by

The cookies are set on specific domains. Ex: setcookie(name,value,expire,path,domain) When you log in on gmail, before “mail.google.com”, you have been redirected to “accounts.google.com” then to “mail.google.com” so the cookies are on “accounts.google.com” too. In this case, the domain is “accounts.google.com” and the path is “/” (the home path). When you request “www.youtube.com” then you click … Read more