OAuth 2.0 and OpenID Redirect Vulnerability

Re:OAuth 2.0 and OpenID Redirect Vulnerability by tveita on Friday May 02, 2014 @10:56AM (#7686044)

I think this is even covered in the spec.

  The authorization server MUST require the following clients to
   register their redirection endpoint:

   o  Public clients.

   o  Confidential clients utilizing the implicit grant type.

   The authorization server SHOULD require all clients to register their
   redirection endpoint prior to utilizing the authorization endpoint.

http://tools.ietf.org/html/rfc6749#section-3.1.2.2

[ Parent | on HN ]

Re:OAuth 2.0 and OpenID Redirect Vulnerability by kodablah on Friday May 02, 2014 @11:36AM (#7686308)

The OAuth servers I have developed have done like GitHub does [1] and at least confirm the redirect given during auth starts with the application-level URI. I think it gives plenty of flexibility while still not openly redirecting. Edit: Or maybe I don't understand the flaw since it says GitHub is vulnerable...

1 - https://developer.github.com/v3/oauth/#redirect-urls

[ Parent | on HN ]

Re:OAuth 2.0 and OpenID Redirect Vulnerability by cratermoon on Friday May 02, 2014 @12:51PM (#7686767)

Good Oauth2.0 and later implementations enforce this. Note that Twitter does not fall into that category.

[ Parent | on HN ]