IETF Logo Mail Archive

Re: [OAUTH-WG] OAuth Security Topics -- Recommend authorization code instead of implicit

"Brock Allen" <brockallen@gmail.com> Sun, 09 December 2018 02:51 UTC

Return-Path: <brockallen@gmail.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40CC412F1AC for <oauth@ietfa.amsl.com>; Sat, 8 Dec 2018 18:51:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oRllsM7kK6LK for <oauth@ietfa.amsl.com>; Sat, 8 Dec 2018 18:51:41 -0800 (PST)
Received: from mail-qk1-x72c.google.com (mail-qk1-x72c.google.com [IPv6:2607:f8b0:4864:20::72c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C95C12E7C1 for <oauth@ietf.org>; Sat, 8 Dec 2018 18:51:41 -0800 (PST)
Received: by mail-qk1-x72c.google.com with SMTP id y16so4713238qki.7 for <oauth@ietf.org>; Sat, 08 Dec 2018 18:51:41 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:date:message-id:subject:from:to:cc:in-reply-to :references:user-agent; bh=py0jKtokHE+KpzwlH3fhtuW2TJdVXPyeoHr0bj+O6yI=; b=p71Rzuoq7vmPwQ8zqekxWB/CYIJbWNUHPMeE8shTm2Abrim/buYMu33emyymh01oLT tRLUFF2b1fH303D/rLPEgUI9Lj4sDY6MCWspKgxLnI+ctnIbk5xMpLWZRkQ0Ejx2LWMw uJCjKA1IeSjX8/JW+U/TC/0iKq5+VHjGZLMRk4K5ARimvwSNOgxuULid1NqPSZNExgvI 7UCM0OfFKyzAOcVv9Me7SSLs/PjoZK+ea0ULISmM5CE/58BjN97AgCqyoPhbg4gxNF32 X+M0l6i1MGN0a7GXi63P4UovhfPDZu+dbNz7aYPp6wnkrzo868K2MJx+A3ZouZ0ufZaT QeNQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:message-id:subject:from:to:cc :in-reply-to:references:user-agent; bh=py0jKtokHE+KpzwlH3fhtuW2TJdVXPyeoHr0bj+O6yI=; b=W7ev2RpP28Wwme5fYg2DyUa/GeFfFBVoNVEJjto65LBAhMs0nErJX8rMrtIU5ARFzb yHHmOOs4EsrMwA1i8KZRiN/3nTwhBEMddBmOQTDaIPkghjge9rPWMgmhMnRroVOWtpo9 UPkVMo1BdJ10FJ99rgzlKysW6DFTRySN0QJcPuLCMFm0egdJMqPg/mmSunayZ9he5MCT RxIjtWAnGdRVyhx71exkSarkXqtW6r8VxU24rNLTcbBZWaU1PqI2bVRFnNLA/VMsC2v4 dgE0iR5tasCOMOOQRSKJyz1xOlP/r/rMFv6Lnfbe7cVSJ2Vqug7MLHAaCetP6auaCRTi yUww==
X-Gm-Message-State: AA+aEWZ+CN3+i7PugHSuUW7C10j9Xe8CtT9MKpB0UqRhqgSxUlwV6hnq s5wDv6sx0PZlPBXdYOHSbsM=
X-Google-Smtp-Source: AFSGD/UIvfh2GvIvTGxJlkK6lpFebp7F9xyiQhdMGbG1UTm84Z6lXZ+3MFMwos9di5blztL9cSpvBQ==
X-Received: by 2002:a37:b646:: with SMTP id g67mr6817141qkf.326.1544323900358; Sat, 08 Dec 2018 18:51:40 -0800 (PST)
Received: from [10.0.1.3] (pool-96-253-25-169.prvdri.fios.verizon.net. [96.253.25.169]) by smtp.gmail.com with ESMTPSA id c48sm5291690qtd.9.2018.12.08.18.51.38 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 08 Dec 2018 18:51:39 -0800 (PST)
Content-Type: multipart/alternative; boundary="----=_NextPart_65825061.563492151040"
MIME-Version: 1.0
Date: Sat, 08 Dec 2018 21:51:37 -0500
Message-ID: <d6d4ecf5-39ea-489c-8024-87c760a9ec23@getmailbird.com>
From: Brock Allen <brockallen@gmail.com>
To: Phil Hunt <phil.hunt@oracle.com>, David Waite <david@alkaline-solutions.com>
Cc: oauth@ietf.org
In-Reply-To: <8A2BC516-69AA-4CDB-A31E-5AF59FBA9CF0@oracle.com>
References: <VI1PR0801MB211266BA6F6E06FFB3081425FAD80@VI1PR0801MB2112.eurprd08.prod.outlook.com> <CAD9ie-v3onmKc498cg_-a0AD58ZV=aZANtz=UV+Q0f=9N3nSzQ@mail.gmail.com> <OSBPR01MB2869E83F37046C7FCD4463DDF9D10@OSBPR01MB2869.jpnprd01.prod.outlook.com> <9FF3F589-0423-4CBC-B323-481F771D097C@lodderstedt.net> <OSBPR01MB28690F77DFFB2A85BDB83FBAF9D10@OSBPR01MB2869.jpnprd01.prod.outlook.com> <D6C66E6A-687B-4997-B830-980BE25994C2@lodderstedt.net> <CAANoGhL9aD75AV9QQRdeGE1=4ynjTnULNVr0PXXvt20ipsb4Rw@mail.gmail.com> <FE51CE20-7A49-4A13-A180-6A7C481F3965@lodderstedt.net> <CAGBSGjrzeeR5QQ=nA=gTj0q7sRvRVc0DDacbxB+ED87ymHSOuA@mail.gmail.com> <VI1PR0801MB21120AA6CC9437E237F481A2FAAC0@VI1PR0801MB2112.eurprd08.prod.outlook.com> <EA38C666-2325-430A-91B0-C02AAC65FCC8@lodderstedt.net> <CAO_FVe7j_79sPrRSFXvQJax3vDjT_0=ZaWHW9aan9rJnLUftkA@mail.gmail.com> <CAO7Ng+vsQ2i4=V0nq+ymO6aNCvurb02+Zt7HHwp4=FnWCO4pUQ@mail.gmail.com> <CAANoGhLx42Noqw4WN-THXbGYvS3t1Z2_EmPs+z641-cNovFNvw@mail.gmail.com> <CAANoGh+1w!Rzz5x7jJrMy-KzCpeK0KN3fK2Qo62KEhz+9SE83=g@mail.gmail.com> <CA+k3eCRjET6gJjX+G7pq-kwFUDgppTK-mrXCAgMtYtW+gVrCbw@mail.gmail.com> <CAD9ie-t=wM6D_zwz0kuPkR19xGfFwfYP=0vjX8uGd4oKsukAOg@mail.gmail.com> <458858450.1398445.1543913404101@mail.yahoo.com> <9DF33F99-E78A-4197-BCEA-AC715761FE87@lodderstedt.net> <942315098.1664424.1543946581453@mail.yahoo.com> <FAFC4820-982B-49B9-9CC5-AFD5CFC4CA3B@lodderstedt.net> <1316266210.2176632.1544020051230@mail.yahoo.com> <468E0532-1B5D-4116-B930-A9B8AB7CDA5A@lodderstedt.net> <CAO_FVe4HrnnQb5-shvgeSAGa+XVKhHtXPsDT_TPezu4Y-CaD=A@mail.gmail.com> <693F457E-3B0F-4612-AE3B-D18462055932@lodderstedt.net> <CAO_FVe7_CsqkTCRSPK5iT5dH5w_NmDuZ-g-2UJgHefUP2i3beQ@mail.gmail.com> <194886B0-D8C8-4489-B66B-7993C7FA0F63@lodderstedt.net> <CAO_FVe7QhqZEcqeSurPU5QxTN3Z1Lp9zY6XpVQxk1VdCGLMUhA@mail.gmail.com> <1D4D8636-9C50-4AA0-BF33-3427FCD0E938@oracle.com> <9E0E2FD0-ECE7-4A71-870B-21938B8C267F@alkaline-solutions.com> <8A2BC516-69AA-4CDB-A31E-5AF59FBA9CF0@oracle.com>
User-Agent: Mailbird/2.5.24.0
X-Mailbird-ID: d6d4ecf5-39ea-489c-8024-87c760a9ec23@getmailbird.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/UTSJC03gjcSM_QynSWa1t2Gk22U>
Subject: Re: [OAUTH-WG] OAuth Security Topics -- Recommend authorization code instead of implicit
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 09 Dec 2018 02:51:43 -0000

> How would the token endpoint detect login status of the user?

Oddball idea: why not use the cookie? If the assumption is that the RT is being used from a client-side browser-based app, and CORS allows for credentials, then perhaps this is a way to bind the RT to the user's browser session. The spec does say that alternative credentials are allowed at the token endpoint...

Sounds icky, but compared to iframes back to the authorize endpoint?


-Brock

v2.23.0 | Report a Bug | By Email