openid

Does OAuth “state” mitigate any genuinely dangerous attacks?

由 血红的双手。 提交于 2019-12-23 02:03:36
问题 I was using the OAuth Playground to better understand the OpenID Connect flow, and it has this to say about verifying the state parameter: The user was redirected back to the client, and you'll notice a few additional query parameters in the URL: ?state=7ymOWcwttpCfDNcs&code=Tav2TPBjSNvR8aowA3oe Since it's possible for an attacker to craft a GET request that looks similar to this, an attacker could provide your application with junk authorization codes. You need to first verify that the state

Can I use the facebook credentials to for users to access my site?

由 人走茶凉 提交于 2019-12-22 18:51:29
问题 I'm starting to work on a site that will be strongly connected to a corresponding Facebook app. I want the contents to be free for all to view, but only registered users will be able to edit it (quite similar to serverfault, actually). Since I think that most of my users will be logged in to facebook, I would really like to use their facebook credentials as to login to my site - the same way Open-Id registration works here. Can this be done? Thanks, Udi Pasmon 回答1: Yes, this is one of the

how to implement openid support with classic asp?

由 穿精又带淫゛_ 提交于 2019-12-22 09:13:09
问题 I'd like to implement something like stackoverflow's login system in classic asp... is it possible? thanks in advance... 回答1: DotNetOpenAuth supports OpenID on classic ASP. They've got a sample classic ASP login page as well. 来源： https://stackoverflow.com/questions/948681/how-to-implement-openid-support-with-classic-asp

DotNetOpenAuth and Google OpenID implementation

由 谁说我不能喝 提交于 2019-12-22 08:17:55
问题 It's a relatively well-known fact that Googles' OpenID Provider does not provide (no pun) username and various other properties, as well as that it generates really ugly claimed identifiers. However, in a recent Hanselminutes episode (at arount 21 minutes into the show) Andrew Arnott says that "Google has special requirements before they'll actually give a name and an email address". What are these requirements and how can one satisfy Google enough to make it actually return username and

HttpContext.Current is null on TokenCache.BeforeAccess

由 感情迁移 提交于 2019-12-22 05:20:19
问题 I am testing a webproject using OWIN and OpenID Connect against Azure AD. I am using much of the code from this sample: https://github.com/Azure-Samples/active-directory-dotnet-webapp-webapi-openidconnect I have an issue where i get a null exception on line 27 of this file: https://github.com/Azure-Samples/active-directory-dotnet-webapp-webapi-openidconnect/blob/master/TodoListWebApp/Utils/NaiveSessionCache.cs I get the exception because HttpContext.Current is null. I can see that Load() is

DotNetOpenId — “This message has already been processed” Error (Part 2)

由 孤人 提交于 2019-12-22 05:19:20
问题 This has already been asked Here, but not by me and the OP accepted an answer which did not help me. Thus far, I've tried logging in from different browsers, changing the web config, clearing cookies, and loading from an external machine. In fact, I eventually did discover that the problem is specific to my own machine; when I published to another machine, it worked fine. Any suggestions for where to look for solutions? I deliberately used the simplest test code I could think of, a clean

How to detect if an email is a Google Account?

由 别来无恙 提交于 2019-12-22 04:43:40
问题 Me and some guys here are working on an start up. We are currently using Google OpenID API to manage registration and login to our app, but we want to migrate to a easier user registration model. And for this, we need to know if there is a way we can detect if an email (not gmail) is already a Google Account. Is there a way to get this info from the Google Single Sign-on API? Previous thanks for your help! :) 回答1: You cannot do that. I don't think Google could tell you that without user

Where is the source for DotNetOpenAuth? The primary Sourceforge link contains just samples and the ApplicationBlock

由 坚强是说给别人听的谎言 提交于 2019-12-22 04:36:11
问题 Now that DNOA may do Call Home Reporting I want to investigate the source to see exactly what is being transmitted to the DNOA servers. The link on Source Forge only gives me the "Application Block" some samples, and a compiled DLL. Where is the source? Am I just overlooking it? 回答1: The DotNetOpenAuth home page has a link directly to the source code. You can download it by clicking the Download button once you're there. Since you've expressed interested in downloading the source code for

Spring Boot集成Spring Security实现OAuth 2.0登录

由 元气小坏坏 提交于 2019-12-21 23:22:37
Spring Security OAuth项目已弃用，最新的OAuth 2.0支持由Spring Security提供。目前Spring Security尚不支持Authorization Server，仍需使用Spring Security OAuth项目，但最终将被Spring Security完全取代。 本文介绍了Spring Security OAuth2 Client的基础知识，如何利用Spring Security实现微信OAuth 2.0登录。GitHub源码 wechat-api 。 Spring Boot版本：2.2.2.RELEASE 为使用Spring Security OAuth2 Client，仅需在Spring Boot项目中增加以下依赖： dependencies { implementation 'org.springframework.boot:spring-boot-starter-oauth2-client' implementation 'org.springframework.boot:spring-boot-starter-security' ... testImplementation('org.springframework.boot:spring-boot-starter-test') { exclude group: 'org

Getting a gmail address with… openid? oauth?

由 馋奶兔 提交于 2019-12-21 16:17:12
问题 I'm getting confused. I was able to make openid login kinda work using LightOpenID. All I get doing that is just an openid_identity such as " https://www.google.com/accounts/o8/id?id=xxx ". Pretty disappointing: I was expecting to get the email address too. i.e. I need to login (that's what openid does) and to know the email address of the google account the user used to login. There is the function $openid->getAttributes() but all I get from that is just an empty array: I guess google isn't
订阅 openid