Archive for month: May, 2025

The Security BCP updates and extends the original threat model (RFC 6819) with current best practices — reflecting years of real-world implementation experience and newly discovered attack vectors. For developers, we’ve provided some guidance on how you can avoid introducing these vulnerabilities into your own websites and applications. For a detailed description of these features, and some more labs related to vulnerabilities that they can introduce, see our OpenID Connect topic. Ideally, the OAuth service should validate this scope value against the one that was used when generating the token, but this isn’t always the case. For example, let’s say the attacker’s malicious client application initially requested access to the user’s email address using the openid email scope.

Those who clicked on the link within the email were directed to sign in and allow a potentially malicious third-party program called “Google Apps” to access their “email account, contacts and online documents”. In April and May 2017, about one million users of Gmail (less than 0.1% of users as of May 2017) were targeted by an OAuth-based phishing attack, receiving an email purporting to be from a colleague, employer or friend wanting to share a document on Google Docs. It specifies a process for resource owners to authorize third-party access to their https://iwantmyopenid.org/2022/11/page/4 server resources without providing credentials. RFC 9700 supersedes RFC 6819 and consolidates guidance that was previously spread across multiple documents.

Attackers that can read, but not modify, the contents of the authorization response (i.e., the authorization response can leak to an attacker).¶ Implementers MUST take into account all possible types of attackers in the environment of their OAuth implementations. If the authorization response is sent with in-browser communication techniques like postMessage WHATWG.postmessage_api instead of HTTP redirects, both the initiator and receiver of the in-browser message MUST be strictly verified as described in Section 4.17.¶ To this end, authorization servers MUST NOT allow redirection URIs that use the http scheme except for native clients that use loopback interface redirection as described in Section 7.3 of RFC8252.¶ It is therefore RECOMMENDED that authorization servers publish OAuth Authorization Server Metadata according to RFC8414 and that clients make use of this Authorization Server Metadata (when available) to configure themselves.¶

• OAuth authentication vulnerabilities arise partly because the OAuth specification is relatively vague and flexible by design.
• The authorization server checks the credentials and, if successful, redirects the user agent to the client’s redirection endpoint.¶
• Except in these special cases, authorization code injection is usually not interesting when the code is created for a public client, as sending the code to the token endpoint is a simpler and more powerful attack, as described above.¶
• A sender-constrained access token scopes the applicability of an access token to a certain sender.

2.2. Refresh Tokens

Since 31 August 2010, all third party Twitter applications have been required to use OAuth. https://labverra.com/articles/ai-machine-learning-coding-github-resources/ At the 73rd Internet Engineering Task Force (IETF) meeting in Minneapolis in November 2008, an OAuth BoF was held to discuss bringing the protocol into the IETF for further standardization work. They concluded that there were no open standards for API access delegation.

• It is RECOMMENDED for authorization servers to publish the element code_challenge_methods_supported in their Authorization Server Metadata RFC8414 containing the supported PKCE challenge methods (which can be used by the client to detect PKCE support).
• Some authorization servers allow clients to register redirection URI patterns instead of complete redirection URIs.
• It specifies a process for resource owners to authorize third-party access to their server resources without providing credentials.
• This specification gives recommendations beyond the scope of RFC6749 and clarifications.¶
• Doing some basic recon of the OAuth service being used can point you in the right direction when it comes to identifying vulnerabilities.

Grant Types in OAuth 2.0

Instead, an attacker can directly call the token endpoint with the stolen authorization code.¶ It is important to note that nonce does not protect authorization codes of public clients, as an attacker does not need to execute an authorization code injection attack. The client is supposed to bind it to the user agent session and send it with the initial request to the OpenID Provider (OP). Asymmetric methods for client authentication do not stop this attack, as the legitimate client authenticates at the token endpoint.¶

• As soon as the browser navigates to the attacker’s page or loads the third-party content, the attacker receives the authorization response URL and can extract code or state (and potentially access_token).¶
• In a similar way, an attacker can learn state from the authorization request if the authorization endpoint at the authorization server contains links or third-party content as above.¶
• Designed specifically to work with Hypertext Transfer Protocol (HTTP), OAuth essentially allows access tokens to be issued to third-party clients by an authorization server, with the approval of the resource owner.
• RFC6749 also lays the foundation for further (implementation-specific) security measures, such as refresh token expiration and revocation as well as refresh token rotation by defining respective error codes and response behaviors.¶
• It is important to note that just storing the authorization server URL is not sufficient to identify mix-up attacks.