The biggest problem with this attack is the passing of the access token to a backend server (and its subsequent passing of that token to someone else) and the assumption that the presentation of the access token means that the user is authenticated and present. It simply doesn't mean that, and this is a bad assumption that unfortunately many people make thanks to providers like Facebook using OAuth (or, mostly-OAuth since they're not actually RFC compliant) in the authentication protocol.
It's also a problem that so many people are using the implicit flow "because it's easy", missing the point of why it's there in the first place. The implicit flow is really only intended for cases where you can't hide secrets from the user agent, cases like an in-browser application. The flow diagrams that you have don't fit the implicit flow very well at all, since the access token is getting passed back to some other service. -- Justin On May 13, 2013, at 11:14 AM, Antonio Sanso <asa...@adobe.com> wrote: > Hi *, > > I wrote a blog post showing two well known OAuth related attacks. I paste > here the link for your consideration: > > http://intothesymmetry.blogspot.ch/2013/05/oauth-2-attacks-introducing-devil-wears.html > > Any comment is more than appreciated. > > Regards > > Antonio > _______________________________________________ > OAuth mailing list > OAuth@ietf.org > https://www.ietf.org/mailman/listinfo/oauth _______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
