Re: [OAUTH-WG] Using OAuth error_code to glean information from the server

Eran Hammer-Lahav <> Tue, 13 December 2011 02:33 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 6C9F421F8485 for <>; Mon, 12 Dec 2011 18:33:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.52
X-Spam-Status: No, score=-2.52 tagged_above=-999 required=5 tests=[AWL=0.078, BAYES_00=-2.599, HTML_MESSAGE=0.001]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id Bi3L2cmVpnFW for <>; Mon, 12 Dec 2011 18:33:21 -0800 (PST)
Received: from ( []) by (Postfix) with SMTP id 6DB0821F84A8 for <>; Mon, 12 Dec 2011 18:33:16 -0800 (PST)
Received: (qmail 10534 invoked from network); 13 Dec 2011 02:33:15 -0000
Received: from unknown (HELO ( by with SMTP; 13 Dec 2011 02:33:15 -0000
Received: from P3PW5EX1MB01.EX1.SECURESERVER.NET ([]) by P3PW5EX1HT004.EX1.SECURESERVER.NET ([]) with mapi; Mon, 12 Dec 2011 19:33:15 -0700
From: Eran Hammer-Lahav <>
To: Mike Jones <>, "" <>
Date: Mon, 12 Dec 2011 19:33:10 -0700
Thread-Topic: [OAUTH-WG] Using OAuth error_code to glean information from the server
Thread-Index: Acy5GRQ8DCUDRcpaSEuLOrJymTfgmAAF5PRwAAOQbdA=
Message-ID: <90C41DD21FB7C64BB94121FBBC2E723452856C7C78@P3PW5EX1MB01.EX1.SECURESERVER.NET>
References: <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: multipart/alternative; boundary="_000_90C41DD21FB7C64BB94121FBBC2E723452856C7C78P3PW5EX1MB01E_"
MIME-Version: 1.0
Subject: Re: [OAUTH-WG] Using OAuth error_code to glean information from the server
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 13 Dec 2011 02:33:23 -0000

'Client credentials' needs to be removed from invalid_grant. It is not appropriate.

Use invalid_client all the way to a fully authenticate client. ANY failure to authenticate the client should result in invalid_client.

Use unauthorized_client for an authenticate client which is not permitted to use this grant type. There are no other issues with an invalid grant related to client credentials.

I'll drop it from the e.g. list.


From: [] On Behalf Of Mike Jones
Sent: Monday, December 12, 2011 4:52 PM
Subject: [OAUTH-WG] Using OAuth error_code to glean information from the server

I recently received an inquiry regarding invalid_client vs. invalid_grant.  It seems that there is a potential information disclosure in the specification with respect to how these error codes are used:

               Client authentication failed (e.g. unknown client, no
               client authentication included, or unsupported
               authentication method).  The authorization server MAY
               return an HTTP 401 (Unauthorized) status code to indicate
               which HTTP authentication schemes are supported.  If the
               client attempted to authenticate via the "Authorization"
               request header field, the authorization server MUST
               respond with an HTTP 401 (Unauthorized) status code, and
               include the "WWW-Authenticate" response header field
               matching the authentication scheme used by the client.


               The provided authorization grant (e.g. authorization

               code, resource owner credentials, client credentials) is

               invalid, expired, revoked, does not match the redirection

               URI used in the authorization request, or was issued to

               another client.

If one uses invalid_client when the client is unknown and invalid_grant when the client credentials are invalid, then an attacker could deduce whether or not a particular client exists.

First, do people agree that this is a potential information leak and that the leak is meaningful?  If so, what mitigation might be suggested?  For instance, might a server choose to use a single error code for both (and potentially other) cases?

                                                            -- Mike