What about me? I was not surprised because OAuth2 is far from perfect. But there is no 推論する／理由 to give up, it's in our 手渡すs. ( By the way I'm waiting for comments on Hacker News 承認する?)
Below I explain some 安全 and usability 関心s about 現在の OAuth2 and 提案する(I do, not just say 'it is bad') 改良s to make it more agile and 安全な-by-default. OAuth2.a is going to be easier to 器具／実施する and more 安全な・保証する.
TL;DR:
- redirect_uri can be on any domain and 量 of redirect_uri-s is 制限のない. They are whitelisted and only exact match 立証 is 適用するd(redirect_uri IS NOT 柔軟な domain.com/*). （弁護士の）依頼人 始める，決めるs redirect_uri-s on his admin page in Provider.
- for every redirect_uri MUST be defined 確かな response_type - 記念品 or code. It must not be possible to 始める，決める response_type in 権限を与える URL. Every redirect_uri has its own defined response_type
- Most ありふれた OAuth2 CSRF Vulnerability from my previous 地位，任命する. We should either introduce a new *compulsory* param(e.g. csrf_token) or just raise 認識／意識性 about the 問題／発行する.
- We need either 割り当てる '範囲' to 確かな redirect_uri 同様に as response_type(it MUST not be in URL) or 許す 使用者 to choose what parts of 範囲 to 許す. It's up to Provider's 実施.
- We should introduce '集まり refreshing' of access_token-s. （弁護士の）依頼人 sends an array of refresh_token-s and （弁護士の）依頼人's 信任状 and get's hash with refresh_token=>接近 記念品.
- We need to define some DEFAULT URL paths and error codes to 追加する a little bit more "interoperability". Really, is it so damn hard to keep your endpoints and error codes 類似の to other services?
 |
Points and 詳細（に述べる）s:
1. Matching redirect_uri domain is futile! We SHOULD NOT have only 1 domain 許すd.
井戸／弁護士席, I have no idea why all providers 要求する only 1 domain in redirect_uri. 現実に, stealing 'code' is 価値（がある） nothing.
Providers MUST 要求する 'redirect_uri' to 得る access_token(（許可，名誉などを）与えるing specs). If 'code' was 問題／発行するd for different redirect_uri - server 味方する will not get access_token for your stolen code. Again - even if I steal 'code' with redirect_uri = mydomain.com anyway I won't be able to use it.
Providers, relax, all redirect_uri checks are futile, if you follow OAuth documentation(ugly example - social 網状組織 vk.com doesn't https://gist.github.com/3075898 and if you steal code you can get access_token for it)
井戸／弁護士席, I have no idea why all providers 要求する only 1 domain in redirect_uri. 現実に, stealing 'code' is 価値（がある） nothing.
Providers MUST 要求する 'redirect_uri' to 得る access_token(（許可，名誉などを）与えるing specs). If 'code' was 問題／発行するd for different redirect_uri - server 味方する will not get access_token for your stolen code. Again - even if I steal 'code' with redirect_uri = mydomain.com anyway I won't be able to use it.
Providers, relax, all redirect_uri checks are futile, if you follow OAuth documentation(ugly example - social 網状組織 vk.com doesn't https://gist.github.com/3075898 and if you steal code you can get access_token for it)
ーするために 妨げる such an attack, the authorization server MUST 確実にする that the redirection URI used to 得る the authorization code is 同一の to the redirection URI 供給するd when 交流ing the authorization code for an 接近 記念品. The authorization server MUST 要求する public （弁護士の）依頼人s and SHOULD 要求する confidential （弁護士の）依頼人s to 登録（する） their redirection URIs. If a redirection URI is 供給するd in the request, the authorization server MUST val idate it against the 登録（する）d value.
Provider SHOULD 許す many redirect_uri-s for one （弁護士の）依頼人. Provider SHOULD NOT 制限する all redirect_uri-s to match the same domain.
Now you are able to 追加する a lot of redirect_uris on さまざまな domains(e.g. 開発 方式 and multi lang 方式):
場所／位置.com/facebook/callback
場所／位置.de/facebook/callback
場所／位置.localdev/facebook/callback
場所／位置.com/facebook/callback
場所／位置.de/facebook/callback
場所／位置.localdev/facebook/callback
redirect_uri checks MUST be done in exact match 方式 against whitelist of callbacks. (現在／一般に it only checks domains 場所／位置.com/*anything*). It will mitigate all 肉親，親類d of XSS-漏れるs, backend-漏れるs, referer 漏れるs etc once and for all. Also, please remember, callback MUST redirect 使用者 即時に.
Provider SHOULD NOT 要求する redirect_uri param anymore to 得る access_token. All redirect_uri-s are whitelisted now, redirect_uri 偽造 will not work anymore. It will really 簡単にする the 過程 since you don't need to remember 現在の callback URL to 得る access_token.
2. 現在／一般に Authorization Code Flow is not any safer than Implicit Flow
Implicit Flow is the most insecure OAuth flow because access_token is exposed to 使用者-スパイ／執行官, scripts(内部の/外部の), possible XSSes and so on - a lot of 危険s and ways to 妥協 it.
If hacker get's your access_token he automatically 伸び（る）s all the 許可s (述べるd in '範囲') on your account in OAuth Provider(google, twitter, facebook, github etc).
避ける it!(引用する from IEFT):
If hacker get's your access_token he automatically 伸び（る）s all the 許可s (述べるd in '範囲') on your account in OAuth Provider(google, twitter, facebook, github etc).
避ける it!(引用する from IEFT):
However, this convenience should be 重さを計るd against. the 安全 関わりあい／含蓄s of using implicit 認めるs, 特に when the authorization code 認める type is 利用できる.
Even if website uses response_type=code, 攻撃者 easily 取って代わるs it with response_type=記念品 in 権限を与える URL, points redirect_uri to some XSS-exploitable page on your domain, 抽出するs 文書.場所.hash when 使用者 is 支援する. He receives 使用者's access_token, jack マリファナ. Stolen access_token means hacker gets (限られた／立憲的な) 接近 to your 資源s on provider.
Even if website uses Authorization Code Flow you can 'downgrade' it to response_type=記念品 and 得る opaque access_token. This is a gaping 欠陥 in OAuth2.
response_type param MUST be defined along with redirect_uri in admin パネル盤 of （弁護士の）依頼人. Provider MUST NOT 受託する change of response_type within authorization 過程. If 場所／位置 uses response_type=code it must be impossible to use response_type=記念品 until you change （弁護士の）依頼人's 詳細（に述べる）s in Provider's admin page.
3. 範囲 or I still need my children alive.
Here is a nice article on this topic by Zach Holman, written ~2 years ago: http://zachholman.com/2011/01/oauth_will_murder_your_children/
Nothing has changed.
Let me remind you that （弁護士の）依頼人 始める，決めるs '範囲' in 権限を与える URL param. What does it mean? There is 絶対 no 保証（人） that 使用者 gave you those 範囲s you asked for!
現実に, when I スピードを出す／記録につける in with facebook/twitter somewhere I just 取って代わる '範囲' with empty string and （弁護士の）依頼人 簡単に gets 接近 to some profile 詳細（に述べる）s and my user_id. MWAHAHA.
There are two ways to 直す／買収する，八百長をする it:
first - 貯蔵所d 範囲 value to 確かな 登録（する）d redirect_uri. If 使用者 権限を与えるd this 'redirect_uri' - than （弁護士の）依頼人 definitely will get 接近 to 範囲 he asked for. No damn surprises.
second - stop 要求するing stupid 許可s. It's up to me what to give you. Providers should let me choose as in Holman's article - what to 許す and what to 否定する. It's MY 資源s, it's MY 許可.
Let me remind you that （弁護士の）依頼人 始める，決めるs '範囲' in 権限を与える URL param. What does it mean? There is 絶対 no 保証（人） that 使用者 gave you those 範囲s you asked for!
現実に, when I スピードを出す／記録につける in with facebook/twitter somewhere I just 取って代わる '範囲' with empty string and （弁護士の）依頼人 簡単に gets 接近 to some profile 詳細（に述べる）s and my user_id. MWAHAHA.
There are two ways to 直す／買収する，八百長をする it:
first - 貯蔵所d 範囲 value to 確かな 登録（する）d redirect_uri. If 使用者 権限を与えるd this 'redirect_uri' - than （弁護士の）依頼人 definitely will get 接近 to 範囲 he asked for. No damn surprises.
second - stop 要求するing stupid 許可s. It's up to me what to give you. Providers should let me choose as in Holman's article - what to 許す and what to 否定する. It's MY 資源s, it's MY 許可.
4. CSRF or Stop Insecure-By-Default 承認する?
Yes, it is rather （弁護士の）依頼人's vulnerability than in Provider. But it is still vulnerability because it's really ありふれた and OAuth2 should 直す／買収する，八百長をする it.
Again, two ways to go:
first - 追加する new compulsory param 'csrf_token' 特に for CSRF 予防.
second - educate developers about CSRF and make documentation 発言／述べるs cleaner. I see について言及する about CSRF in Providers' 手動式のs very rarely. 現実に '明言する／公表する' was not supposed to be CSRF 記念品 but just to keep 明言する／公表する of your 使用／適用. You can 蓄える／店 both values using delimiter: 明言する／公表する=CSRFTOKEN_APPSTATE and I think it's 承認する.
I also don't 提案する oauth to be more interoperable about 記念品 世代 and length and other stuff. It would be just utopia, it's not our 商売／仕事 how Providers 器具／実施する OAuth FRAMEWORK.
I just want you guys to 直す／買収する，八百長をする these few minor things(many redirect_uri-s, 範囲 is not reliable etc) and 2 major vulnerabilities(response_type 交替／補充 and ありふれた CSRF).
Yes, it is rather （弁護士の）依頼人's vulnerability than in Provider. But it is still vulnerability because it's really ありふれた and OAuth2 should 直す／買収する，八百長をする it.
Again, two ways to go:
first - 追加する new compulsory param 'csrf_token' 特に for CSRF 予防.
second - educate developers about CSRF and make documentation 発言／述べるs cleaner. I see について言及する about CSRF in Providers' 手動式のs very rarely. 現実に '明言する／公表する' was not supposed to be CSRF 記念品 but just to keep 明言する／公表する of your 使用／適用. You can 蓄える／店 both values using delimiter: 明言する／公表する=CSRFTOKEN_APPSTATE and I think it's 承認する.
This is it.
I don't 提案する to 追加する encryption. No fucking way. It was 極端に tedious to work with OAuth1 and I am fully 承認する with HTTPS.I also don't 提案する oauth to be more interoperable about 記念品 世代 and length and other stuff. It would be just utopia, it's not our 商売／仕事 how Providers 器具／実施する OAuth FRAMEWORK.
I just want you guys to 直す／買収する，八百長をする these few minor things(many redirect_uri-s, 範囲 is not reliable etc) and 2 major vulnerabilities(response_type 交替／補充 and ありふれた CSRF).
Do you have any suggestions on how to 直す／買収する，八百長をする "response_type 交替／補充" ?
Reply削除する