4 ms·
For all the complexity of OAuth, an OAuth token is essentially a free pass for $stuff. Perhaps we could start validating that a token not only is valid, but al
by vemv 4y ago
For all the complexity of OAuth, an OAuth token is essentially a free pass for $stuff.
Perhaps we could start validating that a token not only is valid, but also is digitally, freshly signed with a known certificate?
I'd say there's a huge difference between:
* I stole a token
* I stole the token AND am able to keep signing said token with my victim's public certificate
A token can be stolen from many places and is comparatively easy to obtain, while full intrusion into an org's infrastructure is less likely, and even if it happens, eventually will be remediated (and the related certificate will be revoked).
Edit: looks like https://tools.ietf.org/id/draft-ietf-oauth-mtls-09.html https://tools.ietf.org/id/draft-ietf-oauth-mtls-09.html would fit the bill.
- taf2 4y agoI like this idea makes tons of sense… not only is the token valid but it’s from a trusted source… it is not going to prevent future attacks but it will add one more lock for an attacker to break before gaining access that is a good thing…
- remram 4y agomtls is problematic because it is not proxy friendly (needs special support in the frontmost proxy). AWS and Mastodon use HTTP request signing which seems interesting.
- bbtcyyzv 4y agoI think HTTP request signing will be a non-starter for an interoperable standard like oauth because of the difficulty of canonicalization without an authoritative library. AWS can pull that off because they have an SDK that will canonicalize requests for you, and it's tested in lockstep with the server accepting it. Historically, XML (and JSON to a lesser extent) have been security minefields for this exact reason.
- varanauskas 4y agoAFAIK according the draft HTTP request signing rfc [1] defines explicit instructions for normalising, serialising and signing HTTP headers (not body). However, you can use an HTTP Digest header for example, that is a hash of the plaintext body to authenticate the body [1] https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-message-signatures https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-mes...
- woranl 4y agoIsn’t this how OAuth 1.0a work? It is more secured for a reason. https://developer.mastercard.com/blog/why-mastercard-doesnt-use-oauth-20/ https://developer.mastercard.com/blog/why-mastercard-doesnt-...
- bbtcyyzv 4y agoThe other competing standard draft to OAuth mTLS is DPoP: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-dpop https://datatracker.ietf.org/doc/html/draft-ietf-oauth-dpop