Questions tagged [authentication]
Authentication is commonly understood as the act of asserting a user's or entity's identity, although in the wider sense it can refer to asserting the truthfulness of any kind of claim. Authentication, like encryption, is a major component in implementing computer security.
204 questions
11
votes
1
answer
369
views
Automatic reauthenticate at oauth2 endpoint
I am currently (ab)using an oauth2 endpoint of an API to enable users of the API to log in to my site (using response_type=code). I do not save refresh tokens or even access_token as that oauth2 ...
CommunityBot
- 1
1
vote
1
answer
24
views
Trying to authenticate using custom domain through Gmail
I set up a custom domain for our PTA (roosevelt-pta.org) using namecheap.com. We needed more professional email addresses than what was available through gmail, so I set some up for all of our board ...
- 8,546
0
votes
0
answers
43
views
MediaWiki Session lockout
After restarting my computer and trying to log in to my wiki, I got the following message:
There appears to be a problem with your login session. Your operation has been stopped as a precaution ...
- 99.4k
0
votes
1
answer
39
views
How to solve chain of redirects
I have WordPress site where we use alias www.example.com/login to have nice login URL so it redirects user to standard WordPress login URL which is wp-login.php.
For the authentication we use service ...
- 2,691
1
vote
1
answer
434
views
Using dynamic content in Wordpress by decoding and using a JWT passed on the URL, without logging in any user
I have a Wordpress and I don't want to create users for the next functionality:
I need a page that has this behaviour:
URL1 = https://my-site.example.com/some-page/ => Renders some public content
...
- 255
1
vote
0
answers
10
views
How can I avoid my web game's accounts system being spammed?
I've been developing a web game and so far the game can only be played anonymously. However, I'd like to introduce an accounts system to allow some kind of community to build up around the game. ...
- 111
2
votes
3
answers
1k
views
Why do I have to enter basic authentication credentials twice for WordPress with .htaccess?
I protect the wp-login.php file via my .htaccess file:
<Files wp-login.php>
AuthName "Admin-Bereich"
AuthType Basic
AuthUserFile /*path*/htdocs/.htpasswd
require valid-user
</Files&...
- 99.4k
0
votes
0
answers
25
views
Wordpress login attempts with personalized data
I recently got some login attempts on a self-hosted Wordpress site that make me a little bit nervous: The login attempts are non-standard usernames like "admin" or "root". They ...
4
votes
2
answers
418
views
Password protect specific files on root of website
I have had a website running for a while and it has a small following. What I wish to do now is password protect some specific files that sit in the root directory. So I'd like the user not to see any ...
CommunityBot
- 1
3
votes
1
answer
599
views
Does requiring login to access content hinder SEO?
I am wondering what the SEO effects of a 'Login Wall' is. More specifically, we have content that is region specific, so for instance a URL could look like www.example.com/content/Canada/Ontario. This ...
1
vote
1
answer
217
views
How to disable windows login (so that WAMP can auto start)
I have Wamp 3.2.6 installed on a Windows 10 machine. I use it to serve photos and other files, and some apps, to my local community. Its not mission critical, so I don't monitor the machine constantly....
CommunityBot
- 1
2
votes
1
answer
1k
views
Can Google index page that is login-required and redirects to Login page?
I have one link that is login-required http://example.com/secret If user access the page without authentication it will be redirected to http://example.com/login page.
My question is can Google bot ...
- 6,559
2
votes
1
answer
126
views
How to exclude bounces from users just clicking "Sign In App" to navigate to a subdomain in Google Analytics?
I've got www.example.com and app.example.com. I control both. On the "www" site, there's a "Sign In" hyperlink that sends people to the app's login page (a known URL on the app ...
- 99.4k
12
votes
7
answers
3k
views
What is an API key?
When we login to a service via a user account, we are normally required to provide an email and password (and on some occasions a username as well).
But, when one website's API authenticates to ...
- 99.4k
5
votes
2
answers
1k
views
How to allow Googlebot unlimited crawling but to have a limit on individual users?
My website consists of multiple pages, each page is for a company. I plan to allow users that are not signed in to view the company pages, but limit to 10 companies a month. I will use a cookie to ...
- 99.4k
2
votes
1
answer
115
views
Content that should be protected is served without authentication intermittently
Our website hosting is with a shared hosting provider. The only configuration we can make is through .htaccess files, we can't touch the apache configuration files that are sourced when apache first ...
- 43.1k
1
vote
1
answer
2k
views
Can't turn off two-factor authentication for my Heroku web hosting account, even by using the command line instructions
I got a new phone and didn't save the recovery code. One day, when I tried to log in to the Heroku platform using my email and password, Heroku redirected to the https://verify.salesforce.com/v1/...
- 353
3
votes
1
answer
773
views
Should I automatically delete accounts if they have not verified their email address?
I am launching a new site soon and in my previous experience I know many bots will create accounts, I'm trying to avoid this so before a user can sign in they need to verify their email address. If ...
- 5,246
1
vote
1
answer
417
views
Is DMARC relaxed alignment for SPF/DKIM bad?
After studying authentication mechanisms available to prevent e-mail spoofing, still I don't understand how to choose between the relaxed alignment and the strict alignment in DMARC for SPF and DKIM, ...
- 490
1
vote
1
answer
198
views
Order of operations for CloudFlare and WordFence
A friend's website is connected to CloudFlare, through the domain name at least, and has WordFence installed. It was my understanding that CloudFlare has security that would block attackers, but ...
11
votes
4
answers
32k
views
Can I create test accounts in Google for testing Oauth in my application?
My app contains Sign in from Google function that uses Oauth. To test it I'd want to create test accounts at Google. But Google doesn't allow me to create ordinary accounts without entering captcha so ...
- 21
3
votes
1
answer
278
views
How to prevent login from 3rd party sites and apps
Most website content is only accessible after logging in. 3rd party sites (and apps) provide alternative interfaces to the site by passing on the login credentials and scraping content. How do I make ...
CommunityBot
- 1
0
votes
0
answers
14
views
How can you set up certificates for clients to use in to log into a webpage in comparison to a username and password? [duplicate]
I've relatively new here and in the website world. I recently saw that some webpages (eg. some banks) use certificates for logging in. An example of what I'm looking for is here - http://poczta....
0
votes
0
answers
29
views
Show contents of a basic authentication login-protected site on my site with a proxy
I administer website A that provides information for a number of users. Website B is an external website containing information that I would like to provide to the users of site A. Login credentials ...
- 1
1
vote
0
answers
1k
views
How to disable Google Ads two-step authentication
I currently am using my Gmail for SMTP for my site. But I also signed up for Google Ads. To sign into Google Ads, I have to two-step authenticate. But because of this, it disables the SMTP for my ...
- 86.4k
0
votes
1
answer
67
views
Unable to login to local DHIS2: Getting a null value in the SessionId
I have installed DHIS 2 version 2.33.0 on a local instance following steps mentioned here. I have also restored the sample database dump. I am able to create new users, but couldn’t log in using ...
- 111
0
votes
0
answers
16
views
Joomla admin log in denied
I moved my site from wordpress to Joomla. I created account and was working fine. I tried to log into admin few days later but now my credentials arent being accepted. tried retrieving username and ...
- 1
1
vote
1
answer
328
views
Does django-oauth-toolkit handle pkce with oath2?
I am trying to implement oauth2 to my django app. I tried to use django-oauth-toolkit. I think their documentation is outdated and could not find any mention of pkce.
Also, I could not find any ...
- 99.4k
1
vote
0
answers
60
views
How to prepare my website to Google's oncoming change regarding embedded browser frameworks?
I recently received an email from Google saying that:
We are writing to let you know that Google will discontinue support for sign-ins to Google accounts from embedded browser frameworks, starting ...
3
votes
2
answers
2k
views
You don't have permission to access /index.php on this server
I made a 'login with OpenID' page and I had a error when OpenID provider return to my page:
You don't have permission to access /index.php on this server.
Additionally, a 404 Not Found error ...
0
votes
0
answers
75
views
Why can't I send emails with my domain name emails without deliverability issues?
I have separate my website and email hosting. I use yandex smail service for email hosting. Everytime I send and email to an address, I get no dkim authentication issue even though, I have configured ...
0
votes
1
answer
68
views
How to get a website with a custom password entry form in index.php to prohibit access to all other files and folders
I have a family history website, call it "my_family.com". The primary file, index.php, has some introductory remarks of explanation and an html form into which one puts the website's ...
- 11
1
vote
1
answer
6k
views
why I can't login to cPanel, shows error Maximum Users Exceeded?
When I try to login to cPanel,
it shows an error Maximum Users Exceeded. please see the error message below. I didn't do any changes to server. this appears very suddenly. how can I fix this? I ...
- 151
1
vote
1
answer
67
views
How can we turn off some LinkedIn login permissions to our website?
Our website is allowing logins from LinkedIn, but we are asking too many permissions from users.
The permission we are asking are:
Use your name and photo
Use the primary email address associated ...
CommunityBot
- 1
2
votes
0
answers
286
views
Safari prompts for BasicAuth credentials on every request in WordPress admin area, but works fine on the rest of the site
I have a WordPress website which is in development, and is hidden behind a BasicAuth password prompt. My root level .htaccess file:
AuthType Basic
AuthName "Login Details"
AuthUserFile /var/...
- 99.4k
1
vote
0
answers
59
views
SEO URL Behind Login That May/May Not Require Payment Structure
I have the following parent URL:
example.com/courses/course_name/
Currently, that parent URL can be accessed without a login.
When a user is logged in, and they try to access a video child URL, 2 ...
- 99.4k
0
votes
0
answers
1k
views
SEO How To Handle Pages That Require Login & Payment?
If you have URLs on your site that require a login but a user who is not logged in tries to access those login required URLs, how do you handle it? 401, 403, 404, 301 to a login page?
If the page ...
- 21
4
votes
1
answer
1k
views
In Apache make subdirectory require basic authentication while parent directory is open to the public
I want to make the contents of the directory /srv/www/dssx (mostly) public. The sub-directory /srv/www/dssx/basic-auth of /srv/www/dssx I want to protect with basic authentication. However, I cannot ...
CommunityBot
- 1
0
votes
2
answers
4k
views
Is it possible to create a full SEO website with Firebase?
I work a lot with PHP, and as many of you know, you have a lot of flexibility when it comes to creating dynamic pages.
You have sessions for authentication, database queries, etc. But the most ...
- 16.4k
2
votes
1
answer
71
views
increasing number of malicious login attempts- what to do?
My question is similar to this one, except that the automatted login attempts are using not nonsensical user names, but real ones that were used in the past on this site. It became infected with a ...
- 136
8
votes
4
answers
270
views
How should a site respond to automated login attempts with phony usernames?
For the last couple weeks I've been seeing a consistent stream of 15-30 invalid login attempts per hours on my site. Many of them are non-sensical usernames that nobody would ever register for real, ...
- 123
2
votes
3
answers
23k
views
Still prompted for a password after adding SSH public key to a server
I'm attempting to setup a git repository on my Dreamhost web server by following the "Setup: For the Impatient" instructions here. I'm having difficulty setting up public key access to the server.
...
CommunityBot
- 1
1
vote
1
answer
30
views
How to correctly SEO positioning of articles that require authorization
I have website with lot of articles, but that require sign-in to view it. The titles of articles are public.
When user is not logged in but wants to see and read it, then will be redirected to login ...
- 3,807
8
votes
5
answers
70k
views
How to login as another user in phpmyadmin
I installed phpmyadmin in Win7, and if I type http://localhost/phpmyadmin/index.php in the browser, it will log in phpmyadmin as root user by default.
I created a new user but still there's no login ...
- 101
4
votes
1
answer
88
views
Does the presence of a flash banner on a site inherently create a vulnerability on the site?
Does the presence of a flash banner inherently open the site up to exploits, or is there a way to ensure the flash banner does not have "access" to anything important on the page.
The page in ...
- 16.4k
3
votes
2
answers
1k
views
Why does Google report a soft 404 when I redirect to the signup page?
In the last month, I've got an increased number of "soft 404" errors reported by Google webmaster tools which actually work well for users.
Configuration (maybe useless):
I have a website built with ...
- 99.4k
2
votes
1
answer
261
views
How can I ban mediawiki logins from IPs that persistently fail?
I have a MediaWiki website and someone is trying to login as my WikiSysop user by guessing lots of passwords.
What can I do to ban IPs if they exceed a threshold of failed login attempts?
(Okay, no-...
CommunityBot
- 1
2
votes
2
answers
8k
views
How do I automatically log my users into other websites after they have given me their passwords?
I have to program an application where the users can connect to other websites. For example, the user clicks on the "Amazon" button and the application opens the Amazon website. It then needs to pre-...
- 99.4k
2
votes
1
answer
13k
views
How to log username in Apache logs?
I need some help regarding how to log the user-name into apache logs. I'm building a use-case for Security Information Event Management.
Is the method the same in case of IIS or just applicable to ...
- 1
1
vote
0
answers
11
views
Storing session data between servers (and noob guidance) [closed]
First post here, I'm sure this information is somewhere on the web, but the problem is I'm such a noob I don't know what to search for.
So, my problem is that I want to design a sign up API. Let's ...
- 111