Re: [OAUTH-WG] Call for Adoption

John Bradley <> Wed, 27 January 2016 13:30 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id B0B3E1B2DB4 for <>; Wed, 27 Jan 2016 05:30:34 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id BnHrDDOZkQgE for <>; Wed, 27 Jan 2016 05:30:32 -0800 (PST)
Received: from ( [IPv6:2607:f8b0:400d:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 579F41B2DB2 for <>; Wed, 27 Jan 2016 05:30:31 -0800 (PST)
Received: by with SMTP id x1so3137203qkc.1 for <>; Wed, 27 Jan 2016 05:30:31 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=WjyTX/7tfOYYijM6M7yNuiXKEfDGMkSnrpQ31YjOk0o=; b=lc9R4EN8Yvb/VXSkFGj57IAqLS2SCzVzb39M0+6J4VF6yUX2PBpSXjksaRQxLOL55o L/GaWlfR39gQ0M23hMp2RfWnXh+jXwZt7e+kDH2zU8Vj+VlKuSg6QgPKFeuSHkK3aM8g QblGKUkFGrhOdDymZfLwkpPBl3WLeGm8lathEtRcMITvuAGBxSClH4KlCT+J7o266hOh +t4jo9weD0qrcUjfXwEeUlNltp/os4HqQN2lWH3xxnbKe/92Br3S+aF2D9PIKJ78u25T lkEgjDXHlx9pmcHAkCmwA86q9j6FVhWK29gk1PaPay/P9mS8zaNUC0th2gPvoI03PKoz /AvQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:message-id:references:to; bh=WjyTX/7tfOYYijM6M7yNuiXKEfDGMkSnrpQ31YjOk0o=; b=IvMAfvqKdTrwTqsFeYdKzFZRBRG+XXQADtqmmsYc82YaHJA6ujwftCS9NZ7exuneI9 M+vEjHOYRfhVun3Rrymev6Zz6MLCj1WGmC0RBp8lqf/Ud1KsRt81TXNJflU0cbrrnQxS 1dvphTl1LrYOqVOQQIPdUbdGzug4jImu6/2c2fYOyOk3L39sjWFxpPerFKYYyQJJC9P2 HzYcqa7fS1BbKI6rFk/OLZUiyRDac0txGOXeeytRztwic+hULyZOl5H4SH3hiMH86v51 xd30mM1h6I0s0Z/SQbvorB3XETfM2rxcREeE2v9hb5j2WtoIagzdQlJZKBs6XCKm7A1y Oa1w==
X-Gm-Message-State: AG10YOSF+jvbfYCVcEFcuS3LocOrRWg8cI1AluW9lxUEztDC1c1BNoJMPJ87Vz9bhg0eZQ==
X-Received: by with SMTP id v84mr36108225qka.9.1453901430415; Wed, 27 Jan 2016 05:30:30 -0800 (PST)
Received: from [] ([]) by with ESMTPSA id d27sm1545546qkj.46.2016. (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 27 Jan 2016 05:30:29 -0800 (PST)
Content-Type: multipart/signed; boundary="Apple-Mail=_95611990-A4E3-4D4C-9F4C-4478603D4EA3"; protocol="application/pkcs7-signature"; micalg="sha1"
Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\))
From: John Bradley <>
In-Reply-To: <>
Date: Wed, 27 Jan 2016 10:30:23 -0300
Message-Id: <>
References: <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <>
To: Nat Sakimura <>
X-Mailer: Apple Mail (2.3112)
Archived-At: <>
Subject: Re: [OAUTH-WG] Call for Adoption
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 27 Jan 2016 13:30:34 -0000

It think requiring a common authority segment for the authorization endpoint and the token endpoint might work in common cases, but there are legitimate cases where the URI of the Authorization endpoint might be a alias in the case of multi tenants, all using a common token endpoint.    

The larger problem would be the RS, it is not uncommon to have the AS and RS in different domains,  so with bearer tokens unless you make the same authority restriction for RS then you are not really stoping the attacker.   They can get the AT by impersonating the RS.

I think trying to enforce a common origin policy over OAuth would be a bad direction to go.

I understand that it seems like a easy fix on the surface, and it works for most of the things people are using OAuth for today, but would be quite limiting over the long term.

John B.
> On Jan 27, 2016, at 7:31 AM, wrote:
> Hi Hans,
> Sorry, I mixed up the IdP mix-up attack and the code phishing attack.
> Mandating the Authorization and Token Endpoint being in the same
> authority would solve the later without changing the wire protocol.
> For AS mix-up attack, mandating the client to change the redirection endpoint
> per AS would solve the problem without change the wire protocol.
> If these are not possible, then we would have to look at changing the
> wire protocol. The solution that solves the both cases must
> provide the token endpoint URI authoritatively, which means
> you have to mandate some variation of discovery mandatory.
> Nat
> At 2016-01-27 17:01  Hans Zandbelt wrote:
>> I don't see how that can deal with the specific form of the attack
>> where the Client would have sent the authorization request to the
>> legitimate authorization endpoint of a compromised AS and believes it
>> gets the response from that, where in fact it was redirected away to
>> the good AS.
>> IOW, I don't think this is so much about mixing up endpoints where to
>> send stuff to, but mixing up the entity/endpoint from which the Client
>> believes the response was received. That may just be terminology
>> though.
>> Bottom line as far as I see is that a wire protocol element in the
>> response is needed to tell the Client who issued it, regardless of how
>> the Client deals with configuration of the AS information.
>> Hans.
>> On 1/27/16 1:31 AM, Nat Sakimura wrote:
>>> So, is there a lot of cases that the authority section of the Good AS's
>>> Authorization Endpoint and the Token Endpoints are different?
>>> If not, then requiring that they are the same seems to virtually remove
>>> the attack surface for the mix-up related attacks. It does not introduce
>>> new parameter nor discovery. If it can be done, it probably is not worth
>>> adding a new wire protocol element to mitigate the mix-up variants.
> _______________________________________________
> OAuth mailing list