https://www.ory.com/ logo
Join Slack
Powered by
Hi, I'm implementing my own login & consent pa...
# talk-hydra
p
Hi, I'm implementing my own login & consent pages and are wondering about the security. Can the login/consent endpoints be completely unprotected without using sessions or would there be any way for an attacker to hijack the authentication process during consent step or something? Are there anything I need to be aware of?
p
Hi @polite-continent-45297 Do you mean the 
/login
and 
/consent
paths of the UI? The UI doesn't need to be protected since it is used to get a session after successful login. The only thing that should be secured is the Hydra admin api which you call from the backend after the user has "accepted" or "denied" a consent. Please see this document https://www.ory.sh/docs/oauth2-oidc/custom-login-consent/flow In Ory Network this will require your login and consent UI to call hydra using an API key from the server and not the browser
p
Yeah, that's what I'm doing 👍 just wanted to make sure 🙂
Followup question, do Ory take care of the session? Can I tweak the session behaviour? For example, let's say I want SSO for some clients but not for others, would that be possible?
p
Yes Ory can take care of the session for you. I guess in a Single Sign on scenario where you are the provider as well (using Ory) you would need to have separate projects for each client to separate the session cookie domains or use multiple custom domains on a single project
p
ok
Hmm, now I'm having that issue again..
This is the redirect url 
<https://stoic-rhodes-da9n7ls10h.projects.oryapis.com/oauth2/auth?client_id=606d01f7-00d0-4817-ae8b-9086735fe929&consent_verifier=8a7681aa666a4e8d8b39d52d2b8ef85f&nonce=jItwNfIdJafs884Tbq6GHXCgL08mqddb-G2DbfgV4kw&redirect_uri=http%3A%2F%2F127.0.0.1%3A8000%2Flogin%2Foauth2%2Fcode%2Fmessaging-client-oidc&response_type=code&scope=openid&state=E7hBP6cfs45GVHhOYfxm5mSkyRBp0UADEUjErY2_qAQ%3D|https://stoic-rhodes-da9n7ls10h.projects.oryapis.com/oauth2/auth?client_id=606d01f7-00d0-4817-ae8b-[…]E7hBP6cfs45GVHhOYfxm5mSkyRBp0UADEUjErY2_qAQ%3D>
13 Views
Open in Slack
PreviousNext
Powered by