Re: [OAUTH-WG] Facebook, OAuth, and WRAP

[Brian Eaton <[e-mail]>]

On Mon, Nov 30, 2009 at 2:52 PM, Mike Malone <[e-mail]> wrote:
> As far as I can tell, if we're treating everything as opaque strings,
> the only real difference between a WRAP "refresh token" and an OAuth
> "request token" is that a "refresh token" can be exchanged for an
> "access token" multiple times in WRAP (since the access tokens
> expire). Is there some other non-trivial difference that I'm missing?

The main difference between the OAuth request token and the WRAP
refresh token is when they are generated and how they are used.

> Again, maybe I'm mistaken, but the verification code seems to be
> included in WRAP to protect against the sort of session fixation
> attack that OAuth 1.0 was susceptible to. In OAuth 1.0a the OAuth
> Verifier was added to fix that vulnerability, which is why I said the
> OAuth Verifier and WRAP Verification Code were essentially equivalent.

In WRAP we combined the OAuth request token and the OAuth verification
code into a single value.  It saves a round trip in the protocol.  The
verification code serves both as a form of user identifier and as an
unguessable value used to prevent session fixation.

Cheers,
Brian