3 ms·
OAuth 1.0a includes authentication and authorization. OAuth 2.0 is designed for authorization only and could be vulnerable to account takeover/impersonation att
by woranl 8y ago
OAuth 1.0a includes authentication and authorization. OAuth 2.0 is designed for authorization only and could be vulnerable to account takeover/impersonation attacks. MasterCard uses OAuth 1.0a instead of 2.0
https://developer.mastercard.com/blog/why-mastercard-doesnt-use-oauth-20 https://developer.mastercard.com/blog/why-mastercard-doesnt-...
- nradov 8y agoGiven that OAuth 2.0 uses TLS, could you please explain how such an attack could actually be executed?
- function_seven 8y agoA MITM TLS-busting proxy. Like on many corporate networks and in many country firewalls. Might seem like a remote chance from a user's point of view, but could be a threat from a payment processor's view, with billions of daily transactions. Also, easier to prove the integrity of the message when you're handling the authentication piece yourself rather than assuming TLS was correctly enforced end-to-end.
- user5994461 8y agoThe authentication part is called OpenID Connect and that's a subset of the OAuth 2.0 spec. Thus OAuth 2.0 supports both authorization and authentication. However providers are free to pick what features they want to provide to clients.