oauth 2.0 - Confused about which type of OAuth2 flow to implement for our web app to web app communication -


we have small .net mvc legacy website trying implement oauth2 for. here's how works: website has no user accounts. so, no login required - no authentication performed. instead requests sent controller method. these requests consist of encrypted parameters, received, decrypted, , webpage displayed. "client" (a wep app) sends these requests has unique encryption key , iv provided them. of course trust them keep information "secret". if there actual resource owner in scenario, seems actual "client app" request coming from.

alas, time has come make process little more secure. there many articles oauth2 flows , client credentials flow seems fit use case, typically information regarding flow suggests "client app" "trusted", , implication of "trust" own "client app". well, don't own client app makes me question if right flow use case. every other oauth2 flow seems best fit accessing resources of resource owner tends user username , password. don't have actual user accounts authenticate usernames , passwords for, leading me right client credentials flow.

furthermore, haven't been able find examples similar our particular use case, web app web app communication client web app not owned us. after reading article: consuming own api web app - authentication process oauth2, client credentials flow not recommended, we're wondering flow recommended.

for use case described above, oauth2 flow think work best?

app app pretty simple. refer older article wrote on subject while ago : https://eidand.com/2015/03/28/authorization-system-with-owin-web-api-json-web-tokens/. article pretty long , convers lot hence why don't paste stuff here.

all need protect resource server , can issue each client app unique clientid / clientsecret , that's they'll use authenticate themselves.

your clients responsible keeping clientid , secret private, of course.


Comments

Post a Comment

Popular posts from this blog

php - Vagrant up error - Uncaught Reflection Exception: Class DOMDocument does not exist -

i've set bento/ubuntu-16.04 vagrant box using php 5.6, , getting following error quite few times when try , run shell script: "uncaught reflection exception: class domdocument not exist". i've tried adding following top of script (not together), each no success: "sudo apt-get install php5.6-xml", "sudo apt-get install php5-xml", "sudo apt-get install php-dom" i've tried resetting server "sudo service apache2 restart". does have suggestions?
Read more

vue.js - Create hooks for automated testing -

Image
qa guys complained can't automate frontend testing. because our html looks same outside. lazy hack did this <template> <div :role="$options.name"> ... </div> </template> <script> export default { name: 'vmcomponentname' } </script> which takes name script , applies html. in browser get: <div role="vmcomponentname"> ... </div> line :role="$options.name" goes in every component. is there dry er solutions? please share. additional details i'll explain in details looking for. imagine have vmusercreate form creates user. test case can create user . to automatically test without role, have use following selector: .wrapper > .wrapper > .wrapper > .submit-button the test extremely brittle (will break lot). if use roles can use [role="vmusercreateform"] .submit-button selector. many folds less brittle. so basically, i'm ...
Read more

Add new key value to json node in java -

i have json file : { "id":1, "name":"abc", "addressdetails": { "city":"newyork" } } i wanted add 1 more key-value ("pincode" : "414141") node 'addressdetails'. i tried using : objectmapper mapper = new objectmapper(); jsonnode root = mapper.readtree(new file("d://test.json")); objectnode node = mapper.createobjectnode(); node.with("addressdetails").put("pincode", "414141"); but it's not getting added, there way can ? you can try you should modify file path objectmapper mapper = new objectmapper(); objectnode nodes = mapper.readvalue(new file("d:\\test.txt"), objectnode.class); nodes.with("addressdetails").put("pincode", "414141"); mapper.writer().writevalue(new file("d:\\test.txt"), nodes);
Read more