IETF Logo Mail Archive

[OAUTH-WG] Browser-Swapping

"Primbs, Jonas" <jonas.primbs@uni-tuebingen.de> Tue, 04 November 2025 04:09 UTC

Return-Path: <jonas.primbs@uni-tuebingen.de>
X-Original-To: oauth@mail2.ietf.org
Delivered-To: oauth@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id A4298822A292 for <oauth@mail2.ietf.org>; Mon, 3 Nov 2025 20:09:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -4.4
X-Spam-Level:
X-Spam-Status: No, score=-4.4 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=uni-tuebingen.de
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kJh4TUeP4sgp for <oauth@mail2.ietf.org>; Mon, 3 Nov 2025 20:09:43 -0800 (PST)
Received: from mx03.uni-tuebingen.de (mx03.uni-tuebingen.de [IPv6:2001:7c0:300c:3105::8602:5d5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id AC7C6822A279 for <oauth@ietf.org>; Mon, 3 Nov 2025 20:09:42 -0800 (PST)
Received: from exchange.uni-tuebingen.de (ex02.uni-tuebingen.de [134.2.21.162]) by mx03.uni-tuebingen.de (Postfix) with ESMTPS id E2B5B20F1794 for <oauth@ietf.org>; Tue, 4 Nov 2025 05:09:34 +0100 (CET)
DKIM-Filter: OpenDKIM Filter v2.11.0 mx03.uni-tuebingen.de E2B5B20F1794
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=uni-tuebingen.de; s=20211202prod; t=1762229374; bh=hbgu1w1i+1uZAMwdTIP5M/b5qLLUOPGNbo5EteiUlpg=; h=From:To:Subject:Date:From; b=IFKVD4SRbT/FJX1rwB2+6lJ2Ej4HfKHLEtM9RFvwAbN+Gu/iVQcsxAF/2/SrZRvKK +sZP1xzpmTvnbXF73R4z6AghfYCZZvBkPxJc2f9GoDIdNnqirgl5OmJuI+0k/xYSay GKyhXR8tSDa3NMmJutb+tmqfx1KdD1+0dsGpA/RqIxslYNI1m2RD9Rvehe2BSZ5Qy/ Pwdfk44sIkJuwKawnKjn7ntB1WAC64hPwa9hE4hWqHzFRWRnEcZwZ0wbFHdKVaSg+1 4rAsdPARF0wTOLTM5UzMkn4/Jl3tI8TdOyY+rjo/o87EbeOiZ8+MyMatRm54XhO+OQ B6XML5Y3XEcPg==
Received: from Ex02.uni-tuebingen.de (134.2.21.162) by EX02.uni-tuebingen.de (134.2.21.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.61; Tue, 4 Nov 2025 05:09:34 +0100
Received: from Ex02.uni-tuebingen.de ([fe80::5ddd:1152:31fc:6bd3]) by EX02.uni-tuebingen.de ([fe80::5ddd:1152:31fc:6bd3%7]) with mapi id 15.01.2507.061; Tue, 4 Nov 2025 05:09:34 +0100
From: "Primbs, Jonas" <jonas.primbs@uni-tuebingen.de>
To: oauth <oauth@ietf.org>
Thread-Topic: Browser-Swapping
Thread-Index: AQHcTUDTZ7fIraDJFUye4l1Hrk/iHg==
Date: Tue, 04 Nov 2025 04:09:34 +0000
Message-ID: <F032F35A-D55E-40A7-8589-3DD64BF8F7A0@uni-tuebingen.de>
Accept-Language: de-DE, en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-mailer: Apple Mail (2.3864.100.1.1.5)
x-originating-ip: [134.2.21.181]
Content-Type: multipart/signed; boundary="Apple-Mail=_A4A4BA19-3161-4392-9948-E1D86B7A7532"; protocol="application/pkcs7-signature"; micalg="sha-256"
MIME-Version: 1.0
Message-ID-Hash: EP3E2REL3RCHYTHQZSFMMRC4BSMKBHN2
X-Message-ID-Hash: EP3E2REL3RCHYTHQZSFMMRC4BSMKBHN2
X-MailFrom: jonas.primbs@uni-tuebingen.de
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-oauth.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [OAUTH-WG] Browser-Swapping
List-Id: OAUTH WG <oauth.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/K8Wnw08GzPstyAQAh0JmSB47pOQ>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Owner: <mailto:oauth-owner@ietf.org>
List-Post: <mailto:oauth@ietf.org>
List-Subscribe: <mailto:oauth-join@ietf.org>
List-Unsubscribe: <mailto:oauth-leave@ietf.org>

Hi all,

according to Aaron’s recommendation, I have created a PR for OAuth 2.1: https://github.com/oauth-wg/oauth-v2-1/pull/230

It references OpenID Connect’s response modes (fragment and form_post) as solutions for Browser-Swapping attacks, which I have presented in today’s OAuth WG meeting.
If you have missed my presentation, but are still interested, here are my slides: https://datatracker.ietf.org/meeting/124/materials/slides-124-oauth-sessa-browser-swapping-01

I’m interested in your feedback on this first draft, which currently covers only recommendation #2 from my slides, because this is probably the least controversial change.
If you are attending onsite, also feel free to speak to me in the hallway. My company gave me enough of the „No, PKCE…“ t-shirts for the rest of the week, so that it’s easier for you to find me. @Brian & Mike: I have learned from the best ;-)

Greetings,
Jonas


Jonas Primbs M.Sc.
University of Tübingen
Faculty of Science
Department of Computer Science
Sand 13, 72076 Tübingen, Germany
Tel.: (+49) 7071 / 29-70512
Mail: jonas.primbs@uni-tuebingen.de
Web: https://kn.inf.uni-tuebingen.de

v2.46.0 | Report a Bug | By Email | System Status