Explaining the OAuth Session Fixation Attack

Re:Explaining the OAuth Session Fixation Attack by thorax on Thursday April 23, 2009 @11:43AM (#575812)

For what it's worth (not much), a few months ago I did my own quick, amateur analysis of the OAuth security. I suspect it's more of the case that it's easy to get stuck looking at the raw protocol itself for vulnerabilities to see how best to avoid allowing people to spoof the communication, get data they shouldn't get, etc. Those seem the riskiest areas in the whole process and where you'd find the weakest links.

So while they focused on protecting the information assets that OAuth shuffled around, they overlooked using the URLs in the middle as a way to fool the requesting app itself. It's one of those design-level flaws that are difficult to see until you've gotten past full analysis of the other high-risk portions of the OAuth chain.

[ Parent | on HN ]

Re:Explaining the OAuth Session Fixation Attack by tptacek on Thursday April 23, 2009 @05:19PM (#576499)

We had someone on the team looking at it, but our emphasis was on things that a consumer or service provider stack could screw up in software, not so much on the protocol itself. (Our analysis was also very, very casual; we wrote code for it, but we didn't have a project plan.)

The other thing that messes with you with OAuth is how closely OAuth resembles a lot of ad-hoc schemes that preceded it; many of them have been tested and analyzed to death, so it lulls you into a false sense of confidence.

[ Parent | on HN ]