Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-security-topics-05.txt

[Torsten Lodderstedt <[e-mail]>]

Hi all,

thanks for your feedback. Here is my text proposal for section 3.8.1. 

——

Attackers could try to utilize a user's trust in the authorization
   server (and its URL in particular) for performing phishing attacks. 

RFC 6749 already prevents open redirects by stating the AS
MUST NOT automatically redirect the user agent in case 
of an invalid combination of client_id and redirect_uri.  

However, as described in [I-D.ietf-oauth-closing-redirectors], an
attacker could also utilize a correctly registered redirect URI to 
perform phishing attacks. It could for example register a client
via dynamic client registration and intentionally send an 
erroneous authorization request, e.g. by using an invalid 
scope value, to cause the AS to automatically redirect the user
agent to its phishing site. 

The AS MUST take precautions to prevent this threat. 
Based on its risk assessment the AS needs to decide whether 
it can trust the redirect URI or not and should only automatically 
redirect the user agent, if it trusts the redirect URI. If not, it could
inform the user that it is about to redirect her to the another site 
and rely on the user to decide or just inform the user about the 
error. 

——

kind regards,
Torsten.