4 ms·
Never, ever use access tokens as proof of identity the way you are doing it. It makes you vulnerable to token substitution attacks. OAuth2 is not an authenticat
by arekkas 10y ago
Never, ever use access tokens as proof of identity the way you are doing it. It makes you vulnerable to token substitution attacks. OAuth2 is not an authentication protocol.
https://oauth.net/articles/authentication/ https://oauth.net/articles/authentication/
DO NOT USE THIS in its current state. Stop upvoting this.
- ziikutv 10y agoUpvotes happen from titles only
- imh 10y agoI've been recently learning my way around web dev. Most of it is straightforward enough, but security is my sticking point. Everything on the web is contradictory, half explained, and rapidly changing. Seems like you know your way around best practices. Can you point to a decent trustworthy tutorial/book on how to handle logins and identity? Seems like lesson one is "don't implement it yourself" and lesson two is never quite spelled out.
- rblatz 10y agoSo how would this apply to using a JWT as a bearer token?
- Cyph0n 10y agoAgreed. The token should be used only after the user is authenticated through another channel (e.g., username+password). Otherwise, an attacker could obtain the target's OAuth token by getting the target to provide the token to a malicious application. The attacker can then easily authenticate through your library.
- donpark 10y agoOn OAuth 2.0 token substitution threat model: https://tools.ietf.org/html/rfc6819#section-4.4.2.6 https://tools.ietf.org/html/rfc6819#section-4.4.2.6 Given that OAuth is all about delegated authorization, meaning entity that uses the access token may not be the user but some third-party service using the token on behalf of the user, using it as proof-of-identity makes no sense. This point becomes clearer with limited permissions. If access token is proof-of-identity, why limit what the user can do when you know it's the user?
- homakov 10y agoThat attack is trivially fixed - just inspect token and see its app id. But no one should use oauth for auth.
- pluma 10y agoMaybe I'm missing something but isn't every single "social login" effectively using OAuth for auth?
- homakov 10y agoYes. Some apps without sensitive info can do it, but that's it.
- pluma 10y agoSo in other words StackOverflow etc (i.e. all non-trivial apps that support third-party login via OAuth) are all broken from a security POV?
- homakov 10y agoIn one way or another. Most are vulnerable to bugs in standard (see sakurity.com/oauth) but every single one depends on central authority which is just stupid for auth.