Re: [OAUTH-WG] OAuth Security Topics -- Recommend authorization code instead of implicit

["Richard Backman, Annabelle" <[e-mail]>]

I strongly support the author’s proposed text recommending that “Clients SHOULD NOT use the implicit grant or any other response type causing the authorization server to issue an access token in the authorization response.” While it may be possible to construct scenarios in which use of sender-constrained access tokens mitigates the major known threats, this strikes me as a niche use case that will be very hard for developers to get right, in practice (particularly if browsers don’t support token binding). This seems to meet the criteria for “SHOULD NOT.”

Bear in mind that the proposed text does not prohibit the practice, but it informs the reader that they had better know what they are doing if they’re going to use implicit grant (or the OIDC hybrid flow, etc.). I think that is good guidance – sending access tokens through a front channel is definite “here there be dragons” territory.

--
Annabelle Richard Backman
AWS Identity


From: OAuth <[e-mail]> on behalf of n-sakimura <[e-mail]>
Date: Wednesday, November 28, 2018 at 12:11 PM
To: Dick Hardt <[e-mail]>, Hannes Tschofenig <[e-mail]>
Cc: "[e-mail]" <[e-mail]>
Subject: Re: [OAUTH-WG] OAuth Security Topics -- Recommend authorization code instead of implicit

I would support

1) clearly defining Implicit as the flow that returns access token from the authorization endpoint ( some people confuses implicit as the flow that returns ID Token in the front channel)

2) Banning the returning of the access token that are not sender constrained from the authorization endpoint

Best,

Nat


Outlook for iOS<https://aka.ms/o0ukef> を入手

________________________________
差出人: OAuth <[e-mail]> (Dick Hardt <[e-mail]> の代理)
送信日時: 水曜日, 11月 28, 2018 8:58 午後
宛先: Hannes Tschofenig
Cc: [e-mail]
件名: Re: [OAUTH-WG] OAuth Security Topics -- Recommend authorization code instead of implicit

+1

While there are various mechanisms to alleviate some of the issues of implicit, I don't think we can recommend specifics, and there may be future ones in the future. I think we all agree that implicit without any mitigation is problematic.

How about we recommend against using implicit alone?


On Mon, Nov 19, 2018 at 2:34 AM Hannes Tschofenig <[e-mail]<mailto:[e-mail]>> wrote:

Hi all,

The authors of the OAuth Security Topics draft came to the conclusion that it is not possible to adequately secure the implicit flow against token injection since potential solutions like token binding or JARM are in an early stage of adoption. For this reason, and since CORS allows browser-based apps to send requests to the token endpoint, Torsten suggested to use the authorization code instead of the implicit grant in call cases in his presentation (see https://datatracker.ietf.org/meeting/103/materials/slides-103-oauth-sessb-draft-ietf-oauth-security-topics-01).

A hum in the room at IETF#103 concluded strong support for his recommendations. We would like to confirm the discussion on the list.

Please provide a response by December 3rd.

Ciao

Hannes & Rifaat

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
_______________________________________________
OAuth mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/oauth