[OAUTH-WG] End-User Authorization Endpoint is an Open Redirect

[Michael D Adams <[e-mail]>]

The second to last paragraph in section 3 of draft-10 states:

> The authorization server validates the request to ensure all required
> parameters are present and valid.  If the request is invalid, the
> authorization server immediately redirects the user-agent back to the
> client using the redirection URI provided with the appropriate error
> code as described in Section 3.2.

There's a couple problems here.

1. What if the client didn't register a redirect_uri and also didn't
include one in the request?  The request is invalid, but there's
nowhere to redirect the user-agent.

2. A malicious client can use the end-user authorization endpoint as
an open redirect by intentionally making an invalid request.  For
example:

End-User Authorization Endpoint: http://service.example.com/oauth/authorize/
Malicious Site: http://jerk.example.net/

I send a phishing attempt to a user of service.example.com with
something like the following link in it:

http://service.example.com/oauth/authorize/?redirect_uri=http%3A%2F%2Fjerk.example.net%2Fsteal-your-identity%2F&response_type=haha

The link looks OK at a glance, but clicking on it takes the victim to:

http://jerk.example.net/steal-your-identity/?error=unsupported_response_type

And now I do whatever evil thing I've planned.

Mike
--mdawaffe